67d87a67fd38a462607cb5b37f19d4fe43990ae15127d826c8aab386129a79ff | Triage

Sharing

General

Target

67d87a67fd38a462607cb5b37f19d4fe43990ae15127d826c8aab386129a79ff
Size

180KB
Sample

221020-2ncfcahhb2
MD5

11d8f608eb9c99a631b9806bc117b630
SHA1

dc7f032df7fca28b0eec93c75de1138eb196459a
SHA256

67d87a67fd38a462607cb5b37f19d4fe43990ae15127d826c8aab386129a79ff
SHA512

458a9d5eca1a7561b64709e1970547b3ae252ea3ca35824088da0444526455b48a35f3d5ddf7bc8e78e5748fbf4c22b01c0cae107ada461db2f186d106bed8b9
SSDEEP

3072:6IWiGdYRLoeEdRos/eaqFnqWDb+uTyLDC6s5sSYqGlC6YViZj5HQXZmmJ0yCFio8:VccKPpm2lC6YViZj5HQXZmmJ0yCF9Bx3

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  67d87a67fd38a462607cb5b37f19d4fe43990ae15127d826c8aab386129a79ff
- Size
  
  180KB
- MD5
  
  11d8f608eb9c99a631b9806bc117b630
- SHA1
  
  dc7f032df7fca28b0eec93c75de1138eb196459a
- SHA256
  
  67d87a67fd38a462607cb5b37f19d4fe43990ae15127d826c8aab386129a79ff
- SHA512
  
  458a9d5eca1a7561b64709e1970547b3ae252ea3ca35824088da0444526455b48a35f3d5ddf7bc8e78e5748fbf4c22b01c0cae107ada461db2f186d106bed8b9
- SSDEEP
  
  3072:6IWiGdYRLoeEdRos/eaqFnqWDb+uTyLDC6s5sSYqGlC6YViZj5HQXZmmJ0yCFio8:VccKPpm2lC6YViZj5HQXZmmJ0yCF9Bx3
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence