2c3fe021c4b428624773fa54c14b02f400f0f3d701ee9e31e8b3f4aecfb253be | Triage

Sharing

General

Target

2c3fe021c4b428624773fa54c14b02f400f0f3d701ee9e31e8b3f4aecfb253be
Size

215KB
Sample

221002-k4djxagff7
MD5

5232b0ad9b650217d9b49238aa60f2a0
SHA1

d978b5ae74c3bcfa093c993376cd7bcbc5a70942
SHA256

2c3fe021c4b428624773fa54c14b02f400f0f3d701ee9e31e8b3f4aecfb253be
SHA512

5544f37b4f6b68589a0bbcbcaf377d33464bfeb61acf9f594a70162e3d65bf2d8b0d8476c31555c3d0c74da2c443d024afada22d40cf27e213bd20936a18b976
SSDEEP

6144:OQHdov3zLgGXXXXyyyyyyyyyyyy8XXXXXXWbbbbbbbbbN3334wGkmZ+7g78fXDa9:OQa4n

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  2c3fe021c4b428624773fa54c14b02f400f0f3d701ee9e31e8b3f4aecfb253be
- Size
  
  215KB
- MD5
  
  5232b0ad9b650217d9b49238aa60f2a0
- SHA1
  
  d978b5ae74c3bcfa093c993376cd7bcbc5a70942
- SHA256
  
  2c3fe021c4b428624773fa54c14b02f400f0f3d701ee9e31e8b3f4aecfb253be
- SHA512
  
  5544f37b4f6b68589a0bbcbcaf377d33464bfeb61acf9f594a70162e3d65bf2d8b0d8476c31555c3d0c74da2c443d024afada22d40cf27e213bd20936a18b976
- SSDEEP
  
  6144:OQHdov3zLgGXXXXyyyyyyyyyyyy8XXXXXXWbbbbbbbbbN3334wGkmZ+7g78fXDa9:OQa4n
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence