5d6ea89dd3f0d774156b447b6ce1fc50c25bbdffadcbb940a082a9b1a7de8106 | Triage

Sharing

General

Target

5d6ea89dd3f0d774156b447b6ce1fc50c25bbdffadcbb940a082a9b1a7de8106
Size

152KB
Sample

221028-w2gpbsabd7
MD5

09c3e7718b8b86fc3a9295788aee3918
SHA1

9bac5d3cb73d7a9fb14311f9fb3e43e8b430d6e5
SHA256

5d6ea89dd3f0d774156b447b6ce1fc50c25bbdffadcbb940a082a9b1a7de8106
SHA512

5d305730c7e3b60301f4c87ba806efd22da434a7ca8ba97f302b94225dff07c794bbf5732ea472e9155af7cb8239da9c8c62bba4fde17e8486717370043e75c0
SSDEEP

3072:ShUFghTQtKrueiygR4O6avJamoff/4oQZiE8U12/vi:PgxQtKSMgR56avUm4Wl12/K

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  5d6ea89dd3f0d774156b447b6ce1fc50c25bbdffadcbb940a082a9b1a7de8106
- Size
  
  152KB
- MD5
  
  09c3e7718b8b86fc3a9295788aee3918
- SHA1
  
  9bac5d3cb73d7a9fb14311f9fb3e43e8b430d6e5
- SHA256
  
  5d6ea89dd3f0d774156b447b6ce1fc50c25bbdffadcbb940a082a9b1a7de8106
- SHA512
  
  5d305730c7e3b60301f4c87ba806efd22da434a7ca8ba97f302b94225dff07c794bbf5732ea472e9155af7cb8239da9c8c62bba4fde17e8486717370043e75c0
- SSDEEP
  
  3072:ShUFghTQtKrueiygR4O6avJamoff/4oQZiE8U12/vi:PgxQtKSMgR56avUm4Wl12/K
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence