293d87d989c8a11f3a763d6546b811b190dd4ca34c41a31b68d97bc70a46b529

Sharing

Copy URL Twitter E-mail

General

Target
Tax-Number735863.zip
Size 2.2MB
Sample260709-pfe52saz9w
SHA256 293d87d989c8a11f3a763d6546b811b190dd4ca34c41a31b68d97bc70a46b529
MD5 e2b16834b50ac5b2989ce7d889c7e2fb
SHA1 851b8bd9eaa34d867fe3d666186784d09486737e
SHA512 23d215b475371d2b2a234155a4aaddc7ffd8491db95e0bd64c413eedaca8ef3b3eb070b495f116df3c7154b46a180fd3916c357286329516df0656816726ef87
SSDEEP 49152:ogkl3L9xlYWpLFlZObP+k9QO5es/WF84P7YV6Ph5WrT7G:ogkR/bDkPGO5e7W4PUV6PTWXS
TLSH
T1FEB51279FB3431C1F85CDEB0BF446A5557EEBEEA92CCCF9426807A064CF52A09249532
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Targets

- Target
  Tax-Number735863.exe
- Size 24KB
- SHA256 1e65229c7ae8f54f282db4820173977bfd2c95898fec8fcc6b389bd3159e9b1c
- MD5 3df7aaba0cdbb92bad78b741a92a95dc
- SHA1 73c04e036cecbb365f2cf43c92c08ce4dcab5e47
- SHA512 d47a04f3c62b918b1c1a75a06abfc11d4fd159a9fc64ca1edd5ae3f48e3333bc94f28656708611c889caa236ac4d612fb20a0ef8efc7a8a80f867e58848498ca
- SSDEEP 384:8+TPFGyFPLDw5A+e9F7hRJAX0y8RbmL4nNy1DNr:dxF3w5stRB5ALDJ
- TLSH
  T1A3B27D66CE600CCBEE1A86B0A0E5962BFD31B2999ED1D3C35379C1180F513817BDA6DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  jli.dll
- Size 216.2MB
- SHA256 0c87645997a76d06a480ef4a1513f9f046ab5328a2761d07478906f7d74d5e19
- MD5 c82f05835f47b10264616c735bfaa530
- SHA1 8b814b150181953943d337a7d03403c7d3d2587f
- SHA512 8b667569dbda056b460bc1079802280708b6233b8e713a7753f0959cbc2d4a0e20841ab32872a4bc9b838b90142a5f0d94e4a8ad81a328e7e3d07388d840141e
- SSDEEP 49152:HMA1WjSDFkGEfRbd3y5NyYDkIT4IZdx0rwfPMbjKR3m7gdDYmIY:RWjElDkyZdx0rwfPMbjKR3m7gdDYmIY
- TLSH
  T12FB87C4563C0FAADD116D93486279732C1B2B8DE07B7C5CB6996E6091E37F8C8A39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral3 behavioral4
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Checks computer location settings

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11