3b27ea92710f6d6878e8f89c104b302bc7d9375358070fe3c395837d0bcc6ffe | Triage

Sharing

General

Target

3b27ea92710f6d6878e8f89c104b302bc7d9375358070fe3c395837d0bcc6ffe
Size

192KB
Sample

221012-rxfh9affcr
MD5

774dc306af3514c331414659f287c450
SHA1

191de70c62cb05ce7d4d0d6f08452c738220d533
SHA256

3b27ea92710f6d6878e8f89c104b302bc7d9375358070fe3c395837d0bcc6ffe
SHA512

669a8f99f88624e121e918e00a72aadde1a0f71dde4e8613a3d3570773c8c273b8eaff65f5f40613b2661d36ffc42d639593093ea211f45333b88e0f734f6b0c
SSDEEP

3072:wu8+lE5yDnOBrpM3lt0bqO4deKIpS2Q9tC3UwtxaTSGzGXDzp8D8OJbhaDDe3ofE:tDnOBr63cbqO40K394aTSGzGZ8ognYM

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  3b27ea92710f6d6878e8f89c104b302bc7d9375358070fe3c395837d0bcc6ffe
- Size
  
  192KB
- MD5
  
  774dc306af3514c331414659f287c450
- SHA1
  
  191de70c62cb05ce7d4d0d6f08452c738220d533
- SHA256
  
  3b27ea92710f6d6878e8f89c104b302bc7d9375358070fe3c395837d0bcc6ffe
- SHA512
  
  669a8f99f88624e121e918e00a72aadde1a0f71dde4e8613a3d3570773c8c273b8eaff65f5f40613b2661d36ffc42d639593093ea211f45333b88e0f734f6b0c
- SSDEEP
  
  3072:wu8+lE5yDnOBrpM3lt0bqO4deKIpS2Q9tC3UwtxaTSGzGXDzp8D8OJbhaDDe3ofE:tDnOBr63cbqO40K394aTSGzGZ8ognYM
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence