b1553875800004384ad9d6870f086ed483c8986855c5de1ac034d241ba222206 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b1553875800004384ad9d6870f086ed483c8986855c5de1ac034d241ba222206
Size

252KB
Sample

221020-2l82jahge5
MD5

7470da3929046fafcd7cae5ed5b53d27
SHA1

c9d3e6cbb9459b59b19fd7674ea3015afc5eedd1
SHA256

b1553875800004384ad9d6870f086ed483c8986855c5de1ac034d241ba222206
SHA512

c56aa2bd9d335c00efbac583ee4073112f637df36dba055b5d61dc3e57ace030467dcbd56e8847c04253ee6c4884e80a4214990d35c117e1341684e402518e69
SSDEEP

3072:lrAcTx7LaXsWvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKHT0:lrwFx/ZLA4PmG6d

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  b1553875800004384ad9d6870f086ed483c8986855c5de1ac034d241ba222206
- Size
  
  252KB
- MD5
  
  7470da3929046fafcd7cae5ed5b53d27
- SHA1
  
  c9d3e6cbb9459b59b19fd7674ea3015afc5eedd1
- SHA256
  
  b1553875800004384ad9d6870f086ed483c8986855c5de1ac034d241ba222206
- SHA512
  
  c56aa2bd9d335c00efbac583ee4073112f637df36dba055b5d61dc3e57ace030467dcbd56e8847c04253ee6c4884e80a4214990d35c117e1341684e402518e69
- SSDEEP
  
  3072:lrAcTx7LaXsWvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKHT0:lrwFx/ZLA4PmG6d
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence