25700718c2ecc955b23220c70c9640a6a3930bba9bc7279820aea6cc7bd83ad7 | Triage

Sharing

General

Target

25700718c2ecc955b23220c70c9640a6a3930bba9bc7279820aea6cc7bd83ad7
Size

5.4MB
Sample

241120-ej1k2szpfs
MD5

ee9138bacbe8df4862f312efac5bdcf2
SHA1

6c104732c30c32977cf93368c304f806022ee9b0
SHA256

25700718c2ecc955b23220c70c9640a6a3930bba9bc7279820aea6cc7bd83ad7
SHA512

adf3b2b40abf1cb0c7a744b2628816aebe54e91596132587b579011dea4a0832080fe8e361f84a0a05a9c05e4f9e08bf2fc1ce43aa743fd7ccf4788ad6b18a71
SSDEEP

98304:I3YZ0ov1IxIB0PtYKUs1P2vkEzCig3YLGc5Qws+/e2I2xDmDqYgxX:btkQJs6p2ig3YUwvPTtmDe

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  25700718c2ecc955b23220c70c9640a6a3930bba9bc7279820aea6cc7bd83ad7
- Size
  
  5.4MB
- MD5
  
  ee9138bacbe8df4862f312efac5bdcf2
- SHA1
  
  6c104732c30c32977cf93368c304f806022ee9b0
- SHA256
  
  25700718c2ecc955b23220c70c9640a6a3930bba9bc7279820aea6cc7bd83ad7
- SHA512
  
  adf3b2b40abf1cb0c7a744b2628816aebe54e91596132587b579011dea4a0832080fe8e361f84a0a05a9c05e4f9e08bf2fc1ce43aa743fd7ccf4788ad6b18a71
- SSDEEP
  
  98304:I3YZ0ov1IxIB0PtYKUs1P2vkEzCig3YLGc5Qws+/e2I2xDmDqYgxX:btkQJs6p2ig3YUwvPTtmDe
Score

8^/10

discovery persistence
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence