d14aeb7bc839d01b74a772ab6c995c32e91ce662f195d6cf8a19e9bf718e3a6b | Triage

Sharing

General

Target

d14aeb7bc839d01b74a772ab6c995c32e91ce662f195d6cf8a19e9bf718e3a6b
Size

140KB
Sample

221019-ykr5vaefa6
MD5

c877fbcee4f35f501d14f8ac4c06e5ac
SHA1

ab94bb0737647016ea69ed3141651d3774ba4ee5
SHA256

d14aeb7bc839d01b74a772ab6c995c32e91ce662f195d6cf8a19e9bf718e3a6b
SHA512

3281d9367d029d263804c285510904edc78f9a125b468eeb258fd1de583bc728fdcc722f5c431981d8a124ac0beba3978a7887ea8db226a25b92ebf7b3d142db
SSDEEP

1536:Ru0EA4hNyLV4Ji2+6wl4fAsyCsJ2AyJOSfNifNuzyW14oQ/hKeXsjEFUK6E:QiCi2+6CXfCZAyJH1i1uzD4oQZiESE

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  d14aeb7bc839d01b74a772ab6c995c32e91ce662f195d6cf8a19e9bf718e3a6b
- Size
  
  140KB
- MD5
  
  c877fbcee4f35f501d14f8ac4c06e5ac
- SHA1
  
  ab94bb0737647016ea69ed3141651d3774ba4ee5
- SHA256
  
  d14aeb7bc839d01b74a772ab6c995c32e91ce662f195d6cf8a19e9bf718e3a6b
- SHA512
  
  3281d9367d029d263804c285510904edc78f9a125b468eeb258fd1de583bc728fdcc722f5c431981d8a124ac0beba3978a7887ea8db226a25b92ebf7b3d142db
- SSDEEP
  
  1536:Ru0EA4hNyLV4Ji2+6wl4fAsyCsJ2AyJOSfNifNuzyW14oQ/hKeXsjEFUK6E:QiCi2+6CXfCZAyJH1i1uzD4oQZiESE
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence