b16b8ca2ec151d50e0b4e101b9af43ca5865d307abd4ca64ac6945ce4ae7d3e6 | Triage

Sharing

General

Target

b16b8ca2ec151d50e0b4e101b9af43ca5865d307abd4ca64ac6945ce4ae7d3e6
Size

30KB
Sample

241009-cs95qsyanh
MD5

b3231fd0869e7516b90662051e8f86ec
SHA1

acf9550e30aac38f153395539100102118c7208e
SHA256

b16b8ca2ec151d50e0b4e101b9af43ca5865d307abd4ca64ac6945ce4ae7d3e6
SHA512

c548edf303447d34df6ef86bf95934f501ac637ae3904234144612fc057b1b22b38d6138ab53bd1c111ee0b38f04bbb46e9f6c1d3deb99840352ed8aced42c33
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznStL:b/yC4GyNM01GuQMNXw2PSjSx

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  b16b8ca2ec151d50e0b4e101b9af43ca5865d307abd4ca64ac6945ce4ae7d3e6
- Size
  
  30KB
- MD5
  
  b3231fd0869e7516b90662051e8f86ec
- SHA1
  
  acf9550e30aac38f153395539100102118c7208e
- SHA256
  
  b16b8ca2ec151d50e0b4e101b9af43ca5865d307abd4ca64ac6945ce4ae7d3e6
- SHA512
  
  c548edf303447d34df6ef86bf95934f501ac637ae3904234144612fc057b1b22b38d6138ab53bd1c111ee0b38f04bbb46e9f6c1d3deb99840352ed8aced42c33
- SSDEEP
  
  384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznStL:b/yC4GyNM01GuQMNXw2PSjSx
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2