5154a21ef7e8664da1bf7649aefbc41271b3037f81a0a2626b9a609176e7ca3c | Triage

Sharing

General

Target

5154a21ef7e8664da1bf7649aefbc41271b3037f81a0a2626b9a609176e7ca3c
Size

232KB
Sample

221003-dkvkraddf3
MD5

680b405aedc62f28b3666c1025c33c2e
SHA1

d7631163c1c612a71d70b1dd5f4f1ca0d15a25fd
SHA256

5154a21ef7e8664da1bf7649aefbc41271b3037f81a0a2626b9a609176e7ca3c
SHA512

c5910ea1bbcdb9e875058b789979cbf957b6029c3d68f8e90b58faf0888404ef0d9839c50b2df7d4a136b4a9df787df2910bd9481844ed40545ef35f8b585f4e
SSDEEP

3072:mtAKE9tG8lsaDWYCs5fDF4LJSImbV8UvR77D9G5UEDVR/bwutUqQJ823:m0txzbF4NN28UJ77hGGED/bbJa

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  5154a21ef7e8664da1bf7649aefbc41271b3037f81a0a2626b9a609176e7ca3c
- Size
  
  232KB
- MD5
  
  680b405aedc62f28b3666c1025c33c2e
- SHA1
  
  d7631163c1c612a71d70b1dd5f4f1ca0d15a25fd
- SHA256
  
  5154a21ef7e8664da1bf7649aefbc41271b3037f81a0a2626b9a609176e7ca3c
- SHA512
  
  c5910ea1bbcdb9e875058b789979cbf957b6029c3d68f8e90b58faf0888404ef0d9839c50b2df7d4a136b4a9df787df2910bd9481844ed40545ef35f8b585f4e
- SSDEEP
  
  3072:mtAKE9tG8lsaDWYCs5fDF4LJSImbV8UvR77D9G5UEDVR/bwutUqQJ823:m0txzbF4NN28UJ77hGGED/bbJa
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence