b75da48de674a97357c62fde4cd22aa44bca5f1b7ee8b40142fc8d3bf10989d3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b75da48de674a97357c62fde4cd22aa44bca5f1b7ee8b40142fc8d3bf10989d3
Size

268KB
Sample

221014-mcjb7aahf9
MD5

632a36449f9ce494518ffe9e5a4e01e2
SHA1

1bbe1756e73d2d33e8ababb1902e1f338c9c6b37
SHA256

b75da48de674a97357c62fde4cd22aa44bca5f1b7ee8b40142fc8d3bf10989d3
SHA512

290cd18e3ff11132859b37082c15cf23aa7e8d4cd1f9fcc45ef01d7b7afbd6499134559580f83fe17c4845bee106751bf49e9e04c61a42e936f450b1100c300d
SSDEEP

6144:Spfwz2Eu+yV2PL9JhCNjKV6MG31luID8NLJTPxhMbmNPjiiSIE:SWMs0Nz8tJTZhMiid

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  b75da48de674a97357c62fde4cd22aa44bca5f1b7ee8b40142fc8d3bf10989d3
- Size
  
  268KB
- MD5
  
  632a36449f9ce494518ffe9e5a4e01e2
- SHA1
  
  1bbe1756e73d2d33e8ababb1902e1f338c9c6b37
- SHA256
  
  b75da48de674a97357c62fde4cd22aa44bca5f1b7ee8b40142fc8d3bf10989d3
- SHA512
  
  290cd18e3ff11132859b37082c15cf23aa7e8d4cd1f9fcc45ef01d7b7afbd6499134559580f83fe17c4845bee106751bf49e9e04c61a42e936f450b1100c300d
- SSDEEP
  
  6144:Spfwz2Eu+yV2PL9JhCNjKV6MG31luID8NLJTPxhMbmNPjiiSIE:SWMs0Nz8tJTZhMiid
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence