97703e467c7959e9b757153f15e208ed235cba6b8950666dc583b14b049341b6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

97703e467c7959e9b757153f15e208ed235cba6b8950666dc583b14b049341b6
Size

316KB
Sample

221020-b1kpdahaeq
MD5

56b0b7660588804e426513b2988652c6
SHA1

92ce0ac70f41b0f43bf433373f12842ed9666b3f
SHA256

97703e467c7959e9b757153f15e208ed235cba6b8950666dc583b14b049341b6
SHA512

1c2dffcd1cea7e953e3107f25011cc42b6db7a9592d5fa92cbc9a90f54642c9f81ee9ffaca91d4d16af67e7e6c6ef32f595fb3c35f087fb3bc7e8a332ba62f9c
SSDEEP

6144:tkSD9tulRyIghtsKnvmb7/D26EO/v5WbBX7zZ8RzRNjL6ZkCnbM3F1QSBx8evAZU:tp3gghtsKnvmb7/D26FWbBX7zZ8RzRNR

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  97703e467c7959e9b757153f15e208ed235cba6b8950666dc583b14b049341b6
- Size
  
  316KB
- MD5
  
  56b0b7660588804e426513b2988652c6
- SHA1
  
  92ce0ac70f41b0f43bf433373f12842ed9666b3f
- SHA256
  
  97703e467c7959e9b757153f15e208ed235cba6b8950666dc583b14b049341b6
- SHA512
  
  1c2dffcd1cea7e953e3107f25011cc42b6db7a9592d5fa92cbc9a90f54642c9f81ee9ffaca91d4d16af67e7e6c6ef32f595fb3c35f087fb3bc7e8a332ba62f9c
- SSDEEP
  
  6144:tkSD9tulRyIghtsKnvmb7/D26EO/v5WbBX7zZ8RzRNjL6ZkCnbM3F1QSBx8evAZU:tp3gghtsKnvmb7/D26FWbBX7zZ8RzRNR
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence