b8cc401165bf7518fad74d7fd26d1ee61e99160dbca852b835c4fdba88b8c0de | Triage

Sharing

General

Target

b8cc401165bf7518fad74d7fd26d1ee61e99160dbca852b835c4fdba88b8c0de
Size

136KB
Sample

221002-swpafaeael
MD5

39d09e250e0296e32b87e466b1e27410
SHA1

91e7245272c1f4f888b7a3f836c5a4ad475f974e
SHA256

b8cc401165bf7518fad74d7fd26d1ee61e99160dbca852b835c4fdba88b8c0de
SHA512

61a7ce8a3c45c07dd5f7ceb33d1f868c1bb1b803adbf28750a3a8ee794cd92a5507d53bc69294a8341c745d24acb39fc24aafbd2d2d6e6b32a3e89f8e463953b
SSDEEP

1536:Ya3kLrBVL5nPn5QaTNUbaxaZ65gX4Pv9u2y0aZAbs/nLziow28fz+DliO3MxOmdD:gLNVIkUbaxHg+g/nvif7hOAMWP

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  b8cc401165bf7518fad74d7fd26d1ee61e99160dbca852b835c4fdba88b8c0de
- Size
  
  136KB
- MD5
  
  39d09e250e0296e32b87e466b1e27410
- SHA1
  
  91e7245272c1f4f888b7a3f836c5a4ad475f974e
- SHA256
  
  b8cc401165bf7518fad74d7fd26d1ee61e99160dbca852b835c4fdba88b8c0de
- SHA512
  
  61a7ce8a3c45c07dd5f7ceb33d1f868c1bb1b803adbf28750a3a8ee794cd92a5507d53bc69294a8341c745d24acb39fc24aafbd2d2d6e6b32a3e89f8e463953b
- SSDEEP
  
  1536:Ya3kLrBVL5nPn5QaTNUbaxaZ65gX4Pv9u2y0aZAbs/nLziow28fz+DliO3MxOmdD:gLNVIkUbaxHg+g/nvif7hOAMWP
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence