e63bf0c30243f5cce14257ff5c7b93d511dcf316cbae0cc5c58755f84be1b206 | Triage

Sharing

General

Target

e63bf0c30243f5cce14257ff5c7b93d511dcf316cbae0cc5c58755f84be1b206
Size

228KB
Sample

221003-gyb74sahf2
MD5

69a36a2e4ef16cbacc4c360edd14f4a1
SHA1

415e12cd37bb12eefa502a83863a6e8c1416e03a
SHA256

e63bf0c30243f5cce14257ff5c7b93d511dcf316cbae0cc5c58755f84be1b206
SHA512

dbf7a30e9e52306f909245663deb1db608cdce778e81e622720907a2ffc28d46c24b6518b2f1f7ea6e2027694b325acbf42463d2166a1ec7dc731593e57b6294
SSDEEP

6144:pK353dwqsNy5ibpNjl4EqxF6snji81RUinKICuL:c31dQxl+

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  e63bf0c30243f5cce14257ff5c7b93d511dcf316cbae0cc5c58755f84be1b206
- Size
  
  228KB
- MD5
  
  69a36a2e4ef16cbacc4c360edd14f4a1
- SHA1
  
  415e12cd37bb12eefa502a83863a6e8c1416e03a
- SHA256
  
  e63bf0c30243f5cce14257ff5c7b93d511dcf316cbae0cc5c58755f84be1b206
- SHA512
  
  dbf7a30e9e52306f909245663deb1db608cdce778e81e622720907a2ffc28d46c24b6518b2f1f7ea6e2027694b325acbf42463d2166a1ec7dc731593e57b6294
- SSDEEP
  
  6144:pK353dwqsNy5ibpNjl4EqxF6snji81RUinKICuL:c31dQxl+
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence