b6978c8e3428e636f3d378d8e9eb2a913a4ba9e7a2d5c243a60aba8eb0b26421 | Triage

Sharing

General

Target

b6978c8e3428e636f3d378d8e9eb2a913a4ba9e7a2d5c243a60aba8eb0b26421
Size

50KB
Sample

221012-tv38msbcd4
MD5

6af3ade90d5bca71a2e8d5cb881d0330
SHA1

e2738bf7c2513c5fdad44d74c2c0e9e033a830c6
SHA256

b6978c8e3428e636f3d378d8e9eb2a913a4ba9e7a2d5c243a60aba8eb0b26421
SHA512

33e5f00d1b8f4d1007aa1fee2b082c4ee99c6e6e66faff80c95e4442a39634455a0ec09c241a6c66ba39f6e19321f37ca7d6a953f996b1cef509125e9608fabb
SSDEEP

768:grpaGOJk7OSSxAkOcYBfvZ8veIIFzirYinbcuyD7Ubf:gadxApcYBvZ8GIuirHnouy8bf

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  b6978c8e3428e636f3d378d8e9eb2a913a4ba9e7a2d5c243a60aba8eb0b26421
- Size
  
  50KB
- MD5
  
  6af3ade90d5bca71a2e8d5cb881d0330
- SHA1
  
  e2738bf7c2513c5fdad44d74c2c0e9e033a830c6
- SHA256
  
  b6978c8e3428e636f3d378d8e9eb2a913a4ba9e7a2d5c243a60aba8eb0b26421
- SHA512
  
  33e5f00d1b8f4d1007aa1fee2b082c4ee99c6e6e66faff80c95e4442a39634455a0ec09c241a6c66ba39f6e19321f37ca7d6a953f996b1cef509125e9608fabb
- SSDEEP
  
  768:grpaGOJk7OSSxAkOcYBfvZ8veIIFzirYinbcuyD7Ubf:gadxApcYBvZ8GIuirHnouy8bf
Score

8^/10

evasion persistence
- Executes dropped EXE
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence