23c0dc2bc05fea98d53a8abcece52f88d95273e068e733dc5a38cce47a8a4c1e | Triage

Sharing

General

Target

23c0dc2bc05fea98d53a8abcece52f88d95273e068e733dc5a38cce47a8a4c1e
Size

212KB
Sample

220919-mhxrrsgfer
MD5

4c378acf5c11a25c7c3377ada09fb2ac
SHA1

842ab9bf9337e45a626e89674ee35602f7c063a1
SHA256

23c0dc2bc05fea98d53a8abcece52f88d95273e068e733dc5a38cce47a8a4c1e
SHA512

c65b7eeb0c318e73ec0af83bfee6fb7be4c9115b739230417aec55e4a1cd4bd4dccb24790e8e6bfe4dda0de05d3235387380fdde71ddc1a8137370938a538f34
SSDEEP

1536:wodH3UyOEGYf+u2wW4cd9Lv2PElgW7NoN274B/K51UtaHElfTczpqVar1/AgAIS:jUxS+Dzp+GNoN2I0jASrB

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  23c0dc2bc05fea98d53a8abcece52f88d95273e068e733dc5a38cce47a8a4c1e
- Size
  
  212KB
- MD5
  
  4c378acf5c11a25c7c3377ada09fb2ac
- SHA1
  
  842ab9bf9337e45a626e89674ee35602f7c063a1
- SHA256
  
  23c0dc2bc05fea98d53a8abcece52f88d95273e068e733dc5a38cce47a8a4c1e
- SHA512
  
  c65b7eeb0c318e73ec0af83bfee6fb7be4c9115b739230417aec55e4a1cd4bd4dccb24790e8e6bfe4dda0de05d3235387380fdde71ddc1a8137370938a538f34
- SSDEEP
  
  1536:wodH3UyOEGYf+u2wW4cd9Lv2PElgW7NoN274B/K51UtaHElfTczpqVar1/AgAIS:jUxS+Dzp+GNoN2I0jASrB
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence