11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8 | Triage

Sharing

General

Target

11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8
Size

60KB
Sample

221019-rhx5rabfhk
MD5

921532d96f4b89101035374a84f9ffe0
SHA1

dd72f16d97f810da90af0c12fc26999a7a2e455f
SHA256

11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8
SHA512

23ed51f061d5b15110324fa948a97670a0e42bb7494146da4dae03d1e11f2d6cbb85035b54bace396e7f15b70f135bd34d490baf8634ff76daf1086b58369a78
SSDEEP

1536:8KqxQGmzLOJXEm5pnnvKfM0cu5tz9r4KbBi6GePt:Ej4kEm76cOzJbi6Ge

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8
- Size
  
  60KB
- MD5
  
  921532d96f4b89101035374a84f9ffe0
- SHA1
  
  dd72f16d97f810da90af0c12fc26999a7a2e455f
- SHA256
  
  11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8
- SHA512
  
  23ed51f061d5b15110324fa948a97670a0e42bb7494146da4dae03d1e11f2d6cbb85035b54bace396e7f15b70f135bd34d490baf8634ff76daf1086b58369a78
- SSDEEP
  
  1536:8KqxQGmzLOJXEm5pnnvKfM0cu5tz9r4KbBi6GePt:Ej4kEm76cOzJbi6Ge
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence