569b20b5c29521ef8ae02ce31de4216b1d30c194d101e63f6987f47f3832e293 | Triage

Sharing

General

Target

569b20b5c29521ef8ae02ce31de4216b1d30c194d101e63f6987f47f3832e293
Size

156KB
Sample

221011-y9rwdadag8
MD5

6c0a33f53233906586cd6ba124aa1dc8
SHA1

9165be1ca5a0f91d8d21b173ac4be7188418e3f9
SHA256

569b20b5c29521ef8ae02ce31de4216b1d30c194d101e63f6987f47f3832e293
SHA512

42d6704a63d5b98ece548da88d1ecccd15b7fff4469753328f5b31bac2b898a23153d0b95a639f9af7abbbd592f9bb41eb77ba52154cdd3988d215ae7c3c66e2
SSDEEP

1536:MZan4ngzp0B8GMNuRe305Xrud5N9jRMmBUKH7zD87/u+JcBqVbv1BsbhbEle+RRw:fogekufubFKVXcBqB1BGSjNX

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  569b20b5c29521ef8ae02ce31de4216b1d30c194d101e63f6987f47f3832e293
- Size
  
  156KB
- MD5
  
  6c0a33f53233906586cd6ba124aa1dc8
- SHA1
  
  9165be1ca5a0f91d8d21b173ac4be7188418e3f9
- SHA256
  
  569b20b5c29521ef8ae02ce31de4216b1d30c194d101e63f6987f47f3832e293
- SHA512
  
  42d6704a63d5b98ece548da88d1ecccd15b7fff4469753328f5b31bac2b898a23153d0b95a639f9af7abbbd592f9bb41eb77ba52154cdd3988d215ae7c3c66e2
- SSDEEP
  
  1536:MZan4ngzp0B8GMNuRe305Xrud5N9jRMmBUKH7zD87/u+JcBqVbv1BsbhbEle+RRw:fogekufubFKVXcBqB1BGSjNX
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence