948b14bb33266b42422b1f462a8015be19ed9e4903b6a16c6a2728163c745f09 | Triage

Sharing

General

Target

948b14bb33266b42422b1f462a8015be19ed9e4903b6a16c6a2728163c745f09
Size

152KB
Sample

221004-ehebesbed5
MD5

553b93b3263ee15ce4a87e9113dab7e0
SHA1

24ae039f0659e104386d00bc39044746632ea29a
SHA256

948b14bb33266b42422b1f462a8015be19ed9e4903b6a16c6a2728163c745f09
SHA512

1e763b9d1cb6eb5e3b25b56509bab5a338f1de45a206677a0419ddb7763c92743018f185027df2a4203f423c5d0d5619e9f10ed768d98f947c588f7fbe6ea39e
SSDEEP

3072:ptDgF0NCmeGMS6WLI3kTB58hahpkzFhPAOJ0NAW/pC4oQZiET9f:kzmeGMS6Wc3kn9ADPAOJ0NJUW91

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  948b14bb33266b42422b1f462a8015be19ed9e4903b6a16c6a2728163c745f09
- Size
  
  152KB
- MD5
  
  553b93b3263ee15ce4a87e9113dab7e0
- SHA1
  
  24ae039f0659e104386d00bc39044746632ea29a
- SHA256
  
  948b14bb33266b42422b1f462a8015be19ed9e4903b6a16c6a2728163c745f09
- SHA512
  
  1e763b9d1cb6eb5e3b25b56509bab5a338f1de45a206677a0419ddb7763c92743018f185027df2a4203f423c5d0d5619e9f10ed768d98f947c588f7fbe6ea39e
- SSDEEP
  
  3072:ptDgF0NCmeGMS6WLI3kTB58hahpkzFhPAOJ0NAW/pC4oQZiET9f:kzmeGMS6Wc3kn9ADPAOJ0NJUW91
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence