c85c3ac09b39cbc9e852328b5f238f58b05d99d78f40ddce4a5c2ba3ee3fad9d | Triage

Sharing

General

Target

c85c3ac09b39cbc9e852328b5f238f58b05d99d78f40ddce4a5c2ba3ee3fad9d
Size

65KB
Sample

241120-d8b4bavmbl
MD5

5d7d70d71a24dd6ba50da66027256b27
SHA1

c1c9f30ded31f805a0b1b258491a87fc2d6fc339
SHA256

c85c3ac09b39cbc9e852328b5f238f58b05d99d78f40ddce4a5c2ba3ee3fad9d
SHA512

9df1cb14f0d343a59d0933197b80d0bb387f7fa4fa46cbbddf6249be17d21f001e6427bb124d13e83a90b3c24f537c4d4cd5d6fd5c7bb5f6db834c1a722a90fa
SSDEEP

1536:PLXzYi/jbOshaV6tSipX/4cAlRBFmH6J9cB+iK:PLXzYWXS4/NE3mH6J9Ok

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  c85c3ac09b39cbc9e852328b5f238f58b05d99d78f40ddce4a5c2ba3ee3fad9d
- Size
  
  65KB
- MD5
  
  5d7d70d71a24dd6ba50da66027256b27
- SHA1
  
  c1c9f30ded31f805a0b1b258491a87fc2d6fc339
- SHA256
  
  c85c3ac09b39cbc9e852328b5f238f58b05d99d78f40ddce4a5c2ba3ee3fad9d
- SHA512
  
  9df1cb14f0d343a59d0933197b80d0bb387f7fa4fa46cbbddf6249be17d21f001e6427bb124d13e83a90b3c24f537c4d4cd5d6fd5c7bb5f6db834c1a722a90fa
- SSDEEP
  
  1536:PLXzYi/jbOshaV6tSipX/4cAlRBFmH6J9cB+iK:PLXzYWXS4/NE3mH6J9Ok
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence