d2dcdbeb20a3e1e25a4dbe6cd47d98ec0eed89fa9d42b697dfd6126dc7af77c3 | Triage

Sharing

General

Target

d2dcdbeb20a3e1e25a4dbe6cd47d98ec0eed89fa9d42b697dfd6126dc7af77c3N.exe
Size

191KB
Sample

241121-kk624szejd
MD5

b7e677576ce30a867c03075371e63910
SHA1

92f8596b8732431e74e0647a650c1c47f7b2583e
SHA256

d2dcdbeb20a3e1e25a4dbe6cd47d98ec0eed89fa9d42b697dfd6126dc7af77c3
SHA512

f48d948cfeb63991725f86070eb9a12bf4266b2c588ed3cd9eda9ce0ace93d4569fa23b246d849188e887c326a42f5d363d3e41371247665b04888d5b8e7fbda
SSDEEP

1536:AvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjdPSrow4Mz:AvVQLIkLWeaA8KlCph98row48

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  d2dcdbeb20a3e1e25a4dbe6cd47d98ec0eed89fa9d42b697dfd6126dc7af77c3N.exe
- Size
  
  191KB
- MD5
  
  b7e677576ce30a867c03075371e63910
- SHA1
  
  92f8596b8732431e74e0647a650c1c47f7b2583e
- SHA256
  
  d2dcdbeb20a3e1e25a4dbe6cd47d98ec0eed89fa9d42b697dfd6126dc7af77c3
- SHA512
  
  f48d948cfeb63991725f86070eb9a12bf4266b2c588ed3cd9eda9ce0ace93d4569fa23b246d849188e887c326a42f5d363d3e41371247665b04888d5b8e7fbda
- SSDEEP
  
  1536:AvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjdPSrow4Mz:AvVQLIkLWeaA8KlCph98row48
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2