017e5cc2f5d277a9949bfd5fd33cf859036f1de49c965b75b4761ba50a2b85dc | Triage

Sharing

General

Target

017e5cc2f5d277a9949bfd5fd33cf859036f1de49c965b75b4761ba50a2b85dc
Size

56KB
Sample

221001-24a78acebk
MD5

03537c8c6a2fe409887fae7425232540
SHA1

608a1243f9f0ae11a3107f44321cd05da9a38f61
SHA256

017e5cc2f5d277a9949bfd5fd33cf859036f1de49c965b75b4761ba50a2b85dc
SHA512

48671da9c4de610864fc6a6f3f81ae8eae183da449dc6a44d79e99a82f17e10d9fb08454cb3d947ebb85e0e531c03319d27a8b8d54ee2587e62f86b09d721105
SSDEEP

768:jjIAHrJH5MTDUb0rc2O1Dmnag0xc1ChTsDoCoJOe2atoLQzJ4:Qyp6Dlrc2omN061ChTsDXe2aEQz

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  017e5cc2f5d277a9949bfd5fd33cf859036f1de49c965b75b4761ba50a2b85dc
- Size
  
  56KB
- MD5
  
  03537c8c6a2fe409887fae7425232540
- SHA1
  
  608a1243f9f0ae11a3107f44321cd05da9a38f61
- SHA256
  
  017e5cc2f5d277a9949bfd5fd33cf859036f1de49c965b75b4761ba50a2b85dc
- SHA512
  
  48671da9c4de610864fc6a6f3f81ae8eae183da449dc6a44d79e99a82f17e10d9fb08454cb3d947ebb85e0e531c03319d27a8b8d54ee2587e62f86b09d721105
- SSDEEP
  
  768:jjIAHrJH5MTDUb0rc2O1Dmnag0xc1ChTsDoCoJOe2atoLQzJ4:Qyp6Dlrc2omN061ChTsDXe2aEQz
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence