741bfe935b97c2d76868ac0a313911018497b42d971cce56a968f92e6623c76b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

741bfe935b97c2d76868ac0a313911018497b42d971cce56a968f92e6623c76b
Size

96KB
Sample

221003-c99waschd5
MD5

40282254d5e90c6dbac4dd7de9805137
SHA1

05b3cc130500b5d0dfd50161832776dafd4ee9f8
SHA256

741bfe935b97c2d76868ac0a313911018497b42d971cce56a968f92e6623c76b
SHA512

7e9611d30108df65aad3a215d91aecc0efcac49d58e6e4af069aea8f8eb38ff61b0141b7e8cd06c796c2740eac5382f26e41271649107af43c2cff2a774a0b5d
SSDEEP

1536:whhBHHf6cOahyvHNkGulSc16l6u+NMMl/KlYv1T4hThF/NIjnZLn:Mdhkqlu88FF/Cnhn

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  741bfe935b97c2d76868ac0a313911018497b42d971cce56a968f92e6623c76b
- Size
  
  96KB
- MD5
  
  40282254d5e90c6dbac4dd7de9805137
- SHA1
  
  05b3cc130500b5d0dfd50161832776dafd4ee9f8
- SHA256
  
  741bfe935b97c2d76868ac0a313911018497b42d971cce56a968f92e6623c76b
- SHA512
  
  7e9611d30108df65aad3a215d91aecc0efcac49d58e6e4af069aea8f8eb38ff61b0141b7e8cd06c796c2740eac5382f26e41271649107af43c2cff2a774a0b5d
- SSDEEP
  
  1536:whhBHHf6cOahyvHNkGulSc16l6u+NMMl/KlYv1T4hThF/NIjnZLn:Mdhkqlu88FF/Cnhn
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence