cec5b57d5d76e6051d098c5a1247e70e9fab4bf98370f3c07924d958607250be | Triage

Sharing

General

Target

cec5b57d5d76e6051d098c5a1247e70e9fab4bf98370f3c07924d958607250beN
Size

520KB
Sample

241017-287rzssbrg
MD5

4f145030e1545cc01bfa347441a5b5f0
SHA1

23be52f419d0c0952d6badd58494a0bbd70fbeea
SHA256

cec5b57d5d76e6051d098c5a1247e70e9fab4bf98370f3c07924d958607250be
SHA512

c08aa11f69d58d9555c5f1fddcecd8a79a0e9286d7d8247a82db0e124c56d927f2e759cd553f2a85a78c2ad3a81f18dd88c4875b3271bf90c8baac9a3fe606c2
SSDEEP

12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXt:zW6ncoyqOp6IsTl/mXt

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  cec5b57d5d76e6051d098c5a1247e70e9fab4bf98370f3c07924d958607250beN
- Size
  
  520KB
- MD5
  
  4f145030e1545cc01bfa347441a5b5f0
- SHA1
  
  23be52f419d0c0952d6badd58494a0bbd70fbeea
- SHA256
  
  cec5b57d5d76e6051d098c5a1247e70e9fab4bf98370f3c07924d958607250be
- SHA512
  
  c08aa11f69d58d9555c5f1fddcecd8a79a0e9286d7d8247a82db0e124c56d927f2e759cd553f2a85a78c2ad3a81f18dd88c4875b3271bf90c8baac9a3fe606c2
- SSDEEP
  
  12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXt:zW6ncoyqOp6IsTl/mXt
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence