78703dbeb0533a84fecf03ca712476c8e3935a547ad61e0acf311d68378b6fee | Triage

Sharing

Copy URL Twitter E-mail

General

Target

78703dbeb0533a84fecf03ca712476c8e3935a547ad61e0acf311d68378b6fee
Size

1.3MB
Sample

221001-3tyffadgbj
MD5

8ed36d7dbeac05121b5fe3e9fcc6dd8f
SHA1

33f20cc1a80cb6df57f75b5b8cbc8f88f5c77489
SHA256

78703dbeb0533a84fecf03ca712476c8e3935a547ad61e0acf311d68378b6fee
SHA512

cfbb5482f657d0137e84cbbac8bef0813f837de280dd03519b990d293af0e2e2a845ea6e88797fb1894f6949a1332155180a9ca222d8cad349adaf4a185550f9
SSDEEP

24576:7YHhxfcWxwQ8WQxqafr9TSof8/hCh1S4k4T348HXNINUma1MDufrft1Lj:4cM6XUUSb4s83NaajZ1Lj

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  78703dbeb0533a84fecf03ca712476c8e3935a547ad61e0acf311d68378b6fee
- Size
  
  1.3MB
- MD5
  
  8ed36d7dbeac05121b5fe3e9fcc6dd8f
- SHA1
  
  33f20cc1a80cb6df57f75b5b8cbc8f88f5c77489
- SHA256
  
  78703dbeb0533a84fecf03ca712476c8e3935a547ad61e0acf311d68378b6fee
- SHA512
  
  cfbb5482f657d0137e84cbbac8bef0813f837de280dd03519b990d293af0e2e2a845ea6e88797fb1894f6949a1332155180a9ca222d8cad349adaf4a185550f9
- SSDEEP
  
  24576:7YHhxfcWxwQ8WQxqafr9TSof8/hCh1S4k4T348HXNINUma1MDufrft1Lj:4cM6XUUSb4s83NaajZ1Lj
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence