12623a9123b78cad8e64342237d3806b6afc92c885facaa73cccb7dc333c83a7 | Triage

Sharing

General

Target

12623a9123b78cad8e64342237d3806b6afc92c885facaa73cccb7dc333c83a7
Size

220KB
Sample

221020-2sljtaaag4
MD5

417f4e6b6c0b2aa0de104619e917c0b8
SHA1

6ed537f83b4d9e6506039d4b2a372e908702080a
SHA256

12623a9123b78cad8e64342237d3806b6afc92c885facaa73cccb7dc333c83a7
SHA512

fc302a4ec240c9db8ce6758401827ec7172e930ee0fa88ca7b87ff13f312d3cb9764d3cda21531bb153ee3e577c00328b6ec79600a7d63e718d3758b9d813983
SSDEEP

3072:mRR1SrBkY8YUL4qx9RIHgil3UuhSa3U3dD8d6Oy+MIrnj3JjNoD:a1S1kx15x9SHVeOjfo

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  12623a9123b78cad8e64342237d3806b6afc92c885facaa73cccb7dc333c83a7
- Size
  
  220KB
- MD5
  
  417f4e6b6c0b2aa0de104619e917c0b8
- SHA1
  
  6ed537f83b4d9e6506039d4b2a372e908702080a
- SHA256
  
  12623a9123b78cad8e64342237d3806b6afc92c885facaa73cccb7dc333c83a7
- SHA512
  
  fc302a4ec240c9db8ce6758401827ec7172e930ee0fa88ca7b87ff13f312d3cb9764d3cda21531bb153ee3e577c00328b6ec79600a7d63e718d3758b9d813983
- SSDEEP
  
  3072:mRR1SrBkY8YUL4qx9RIHgil3UuhSa3U3dD8d6Oy+MIrnj3JjNoD:a1S1kx15x9SHVeOjfo
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence