165ac0d8f6f51bd819214693a4dbd43dc4cf56f76a30c8f22636725d5c4ab786 | Triage

Sharing

General

Target

165ac0d8f6f51bd819214693a4dbd43dc4cf56f76a30c8f22636725d5c4ab786
Size

201KB
Sample

221004-cznkbahber
MD5

424641f17d69abf134d2bd862a2a5f80
SHA1

b648bbb3cb58b61c3eb1827cadbd61350297d805
SHA256

165ac0d8f6f51bd819214693a4dbd43dc4cf56f76a30c8f22636725d5c4ab786
SHA512

6bb4e91353560762a9e3c201e835625611b0dc1e26bb6fa09f78323e3e659a93c37a912833ab59b93c7507d428f74edcb28412ebb8f1f1be17b2c16a535d0b63
SSDEEP

3072:NK4pAKaF0+xVf/qLkmpZ+rjmuHLBKeAYs5FT0nvvgJZdsVNwoCAY:NlaF0uV6LkmLgmbws5FT0ngJZ6NwonY

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  165ac0d8f6f51bd819214693a4dbd43dc4cf56f76a30c8f22636725d5c4ab786
- Size
  
  201KB
- MD5
  
  424641f17d69abf134d2bd862a2a5f80
- SHA1
  
  b648bbb3cb58b61c3eb1827cadbd61350297d805
- SHA256
  
  165ac0d8f6f51bd819214693a4dbd43dc4cf56f76a30c8f22636725d5c4ab786
- SHA512
  
  6bb4e91353560762a9e3c201e835625611b0dc1e26bb6fa09f78323e3e659a93c37a912833ab59b93c7507d428f74edcb28412ebb8f1f1be17b2c16a535d0b63
- SSDEEP
  
  3072:NK4pAKaF0+xVf/qLkmpZ+rjmuHLBKeAYs5FT0nvvgJZdsVNwoCAY:NlaF0uV6LkmLgmbws5FT0ngJZ6NwonY
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2