91854316f00adf72d44e2fa22bee508e2d7505f933a386e6b4cf9618377510a2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

91854316f00adf72d44e2fa22bee508e2d7505f933a386e6b4cf9618377510a2
Size

248KB
Sample

221002-a2pt2seba9
MD5

6f35309c93e6d2e08f6b8c32c409dd20
SHA1

bd567cc54bd7906ea8476c77c79b13772e92df93
SHA256

91854316f00adf72d44e2fa22bee508e2d7505f933a386e6b4cf9618377510a2
SHA512

c19442f1a55eb63fd7cd0f12bbcda82d4d13764ff2a7cabb4eaf43d9ace307c1b744f2bcbfb6728388229ec739837fb9c363e0878bb219f265e63934679e89b3
SSDEEP

3072:qf3AVhqYaGUe1AK8b/EQk28wlowMmbz1gNNdeHd1fdVcjsQyO1obomeBnZXG:Kq71U/EQk28wlowbIGysQscme1Z2

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  91854316f00adf72d44e2fa22bee508e2d7505f933a386e6b4cf9618377510a2
- Size
  
  248KB
- MD5
  
  6f35309c93e6d2e08f6b8c32c409dd20
- SHA1
  
  bd567cc54bd7906ea8476c77c79b13772e92df93
- SHA256
  
  91854316f00adf72d44e2fa22bee508e2d7505f933a386e6b4cf9618377510a2
- SHA512
  
  c19442f1a55eb63fd7cd0f12bbcda82d4d13764ff2a7cabb4eaf43d9ace307c1b744f2bcbfb6728388229ec739837fb9c363e0878bb219f265e63934679e89b3
- SSDEEP
  
  3072:qf3AVhqYaGUe1AK8b/EQk28wlowMmbz1gNNdeHd1fdVcjsQyO1obomeBnZXG:Kq71U/EQk28wlowbIGysQscme1Z2
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence