14f4581bcb3707517496e511ecc6311a35d77baad958f9f7d7d1c70a9fcf4bf4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14f4581bcb3707517496e511ecc6311a35d77baad958f9f7d7d1c70a9fcf4bf4
Size

212KB
Sample

221011-r26w1aaeep
MD5

08a08ec7f16429657a084dbdb5fefc33
SHA1

8b1b702dbae9b7ae15b53dd4c26a0d9e13fdeb10
SHA256

14f4581bcb3707517496e511ecc6311a35d77baad958f9f7d7d1c70a9fcf4bf4
SHA512

ce168eb433ccfa2d54d542251a2257a910824c17d86a794f5a4e457dced17f08c51e8ba7d7860f12028876ac39fa1f8923d0fb34c50178893a328035691e5d2f
SSDEEP

1536:+tVVLz2cGCl4LAx4cd9Lv2PElgWcNoN274B/K51ptaHElfTczp6Far2/AgAISFwO:CLygEUp+NNoN2N04A1n3

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  14f4581bcb3707517496e511ecc6311a35d77baad958f9f7d7d1c70a9fcf4bf4
- Size
  
  212KB
- MD5
  
  08a08ec7f16429657a084dbdb5fefc33
- SHA1
  
  8b1b702dbae9b7ae15b53dd4c26a0d9e13fdeb10
- SHA256
  
  14f4581bcb3707517496e511ecc6311a35d77baad958f9f7d7d1c70a9fcf4bf4
- SHA512
  
  ce168eb433ccfa2d54d542251a2257a910824c17d86a794f5a4e457dced17f08c51e8ba7d7860f12028876ac39fa1f8923d0fb34c50178893a328035691e5d2f
- SSDEEP
  
  1536:+tVVLz2cGCl4LAx4cd9Lv2PElgWcNoN274B/K51ptaHElfTczp6Far2/AgAISFwO:CLygEUp+NNoN2N04A1n3
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence