b04fcf49a0661e1b233480648fff3988eb359a0bc712c621a26c9f65693ff486 | Triage

Sharing

General

Target

b04fcf49a0661e1b233480648fff3988eb359a0bc712c621a26c9f65693ff486.exe
Size

15.9MB
Sample

241121-jcqjqazlg1
MD5

6d3ce30a01237bc8af69656d73b2777f
SHA1

637e9fd35f8ca3745abb30d25c2bb2042ce34c0f
SHA256

b04fcf49a0661e1b233480648fff3988eb359a0bc712c621a26c9f65693ff486
SHA512

17bd1bd38e7dd6af7e65ee6190eb07311f779319658b2e69ecd30658b01c277aa593649ff7796cd5e25f2995b479a6ed76b68420c6818059c58bf94042f8395e
SSDEEP

393216:kg7ucg7ucg7ucg7ucg7ucg7ucg7ucg7u9:5ShShShShShShShS9

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  b04fcf49a0661e1b233480648fff3988eb359a0bc712c621a26c9f65693ff486.exe
- Size
  
  15.9MB
- MD5
  
  6d3ce30a01237bc8af69656d73b2777f
- SHA1
  
  637e9fd35f8ca3745abb30d25c2bb2042ce34c0f
- SHA256
  
  b04fcf49a0661e1b233480648fff3988eb359a0bc712c621a26c9f65693ff486
- SHA512
  
  17bd1bd38e7dd6af7e65ee6190eb07311f779319658b2e69ecd30658b01c277aa593649ff7796cd5e25f2995b479a6ed76b68420c6818059c58bf94042f8395e
- SSDEEP
  
  393216:kg7ucg7ucg7ucg7ucg7ucg7ucg7ucg7u9:5ShShShShShShShS9
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence