75b21a8af1826a88d59e7eb3e13268fe36fdf887ff7cd93ac2f1a07d65701fa9 | Triage

Sharing

General

Target

75b21a8af1826a88d59e7eb3e13268fe36fdf887ff7cd93ac2f1a07d65701fa9
Size

42KB
Sample

221020-kjss4adgfk
MD5

81174dd701d4aec16dcbb6cd12d60ac0
SHA1

b54635abd29754c3007d9afca40248e1dbc96e13
SHA256

75b21a8af1826a88d59e7eb3e13268fe36fdf887ff7cd93ac2f1a07d65701fa9
SHA512

1ccc3c1a7ee6c25c2ad1389bb387907c9b427087bd8f85dddc772b146374b567bde3d074cee0af87d71f925609f105bde3ed2afd57a1f0aff66272c3803cec32
SSDEEP

768:B2p5vACedoO9mL//lldkbZnribCyOMZA2fDa2JsyE6scXsqIY8qlQbDzQC9:B2p5vACYhClgbZi2jcz9OyECGY8qlw9

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  75b21a8af1826a88d59e7eb3e13268fe36fdf887ff7cd93ac2f1a07d65701fa9
- Size
  
  42KB
- MD5
  
  81174dd701d4aec16dcbb6cd12d60ac0
- SHA1
  
  b54635abd29754c3007d9afca40248e1dbc96e13
- SHA256
  
  75b21a8af1826a88d59e7eb3e13268fe36fdf887ff7cd93ac2f1a07d65701fa9
- SHA512
  
  1ccc3c1a7ee6c25c2ad1389bb387907c9b427087bd8f85dddc772b146374b567bde3d074cee0af87d71f925609f105bde3ed2afd57a1f0aff66272c3803cec32
- SSDEEP
  
  768:B2p5vACedoO9mL//lldkbZnribCyOMZA2fDa2JsyE6scXsqIY8qlQbDzQC9:B2p5vACYhClgbZi2jcz9OyECGY8qlw9
Score

8^/10

evasion persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence