6fd673e51aa293d323d71404fc0b61110ac41a4ac91a672c0d466f14b521768c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6fd673e51aa293d323d71404fc0b61110ac41a4ac91a672c0d466f14b521768c
Size

272KB
Sample

221003-dah4zaedfj
MD5

6348503ccfaa4d343cc5f20d86cdf0b0
SHA1

dd65da18454d735356fdbba851acc4b260c91d0d
SHA256

6fd673e51aa293d323d71404fc0b61110ac41a4ac91a672c0d466f14b521768c
SHA512

1ac8ba92de83ab8acbb4fa068189e5cf42c64daf4e14840ec37fcb651d40e821c65c4e8dcf28e11bdedae65df1828ec08921fc2e2da87f42a6e34a3d11d3bfc4
SSDEEP

3072:NDce7C230FvbVJznCRck/hqF69MSs/PLLK+JmmU3YwgTgA3Yy:tZdefznHk39G/PLLDU3YwgT

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  6fd673e51aa293d323d71404fc0b61110ac41a4ac91a672c0d466f14b521768c
- Size
  
  272KB
- MD5
  
  6348503ccfaa4d343cc5f20d86cdf0b0
- SHA1
  
  dd65da18454d735356fdbba851acc4b260c91d0d
- SHA256
  
  6fd673e51aa293d323d71404fc0b61110ac41a4ac91a672c0d466f14b521768c
- SHA512
  
  1ac8ba92de83ab8acbb4fa068189e5cf42c64daf4e14840ec37fcb651d40e821c65c4e8dcf28e11bdedae65df1828ec08921fc2e2da87f42a6e34a3d11d3bfc4
- SSDEEP
  
  3072:NDce7C230FvbVJznCRck/hqF69MSs/PLLK+JmmU3YwgTgA3Yy:tZdefznHk39G/PLLDU3YwgT
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence