d9ad0ed4bc5a64761993e5742b7f80a6b98a3eb13866d830eefe527d56b7b280 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d9ad0ed4bc5a64761993e5742b7f80a6b98a3eb13866d830eefe527d56b7b280
Size

172KB
Sample

241013-egssessclr
MD5

836f47db0811046178129bbe3097aa7d
SHA1

a63d6916c8e663e80f76c51b389a3c7cec60d49c
SHA256

d9ad0ed4bc5a64761993e5742b7f80a6b98a3eb13866d830eefe527d56b7b280
SHA512

3f1c1ab2b2f12ed6ee11ebfb983c4a52e96e9598310dc6bb706795442082a5037a4b79d15912bf52e3ac0062483bee6ba0d1446177f142a7888a2343b4029bae
SSDEEP

3072:d14mOxrKFNZYhrgtRFuV2DDbuiTf3hPsOraS87FYqjTZbn4TGh:dnYWYhrgtRo6DSiTf3hPswa1TZjxh

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  d9ad0ed4bc5a64761993e5742b7f80a6b98a3eb13866d830eefe527d56b7b280
- Size
  
  172KB
- MD5
  
  836f47db0811046178129bbe3097aa7d
- SHA1
  
  a63d6916c8e663e80f76c51b389a3c7cec60d49c
- SHA256
  
  d9ad0ed4bc5a64761993e5742b7f80a6b98a3eb13866d830eefe527d56b7b280
- SHA512
  
  3f1c1ab2b2f12ed6ee11ebfb983c4a52e96e9598310dc6bb706795442082a5037a4b79d15912bf52e3ac0062483bee6ba0d1446177f142a7888a2343b4029bae
- SSDEEP
  
  3072:d14mOxrKFNZYhrgtRFuV2DDbuiTf3hPsOraS87FYqjTZbn4TGh:dnYWYhrgtRo6DSiTf3hPswa1TZjxh
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence