01fd97a91980ab394a02d2b25f0cba4e54983852e7b1fbe0a8ca0e8c263e149d | Triage

Sharing

General

Target

01fd97a91980ab394a02d2b25f0cba4e54983852e7b1fbe0a8ca0e8c263e149d
Size

124KB
Sample

221030-ae3gmadedn
MD5

8470e5f055b4736b7881182d03d98f80
SHA1

896bf1685ed6c45f4db3188024c470f60da70d2f
SHA256

01fd97a91980ab394a02d2b25f0cba4e54983852e7b1fbe0a8ca0e8c263e149d
SHA512

fa20ffc8ac186dbf587ae21d1c5f30ecc3bb93f5c907ec5ba3b405d4d4593c255e39006f9f8d493c4fce13a5aee5ac11ca61c74b33396230fbce872b78cb716d
SSDEEP

1536:6YJQ/0At4JEk5KO98p+kzGDwTc6bdaR+aLCFJTZS6Gc:dbAtCYOGDz0wwydjHFJ3j

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  01fd97a91980ab394a02d2b25f0cba4e54983852e7b1fbe0a8ca0e8c263e149d
- Size
  
  124KB
- MD5
  
  8470e5f055b4736b7881182d03d98f80
- SHA1
  
  896bf1685ed6c45f4db3188024c470f60da70d2f
- SHA256
  
  01fd97a91980ab394a02d2b25f0cba4e54983852e7b1fbe0a8ca0e8c263e149d
- SHA512
  
  fa20ffc8ac186dbf587ae21d1c5f30ecc3bb93f5c907ec5ba3b405d4d4593c255e39006f9f8d493c4fce13a5aee5ac11ca61c74b33396230fbce872b78cb716d
- SSDEEP
  
  1536:6YJQ/0At4JEk5KO98p+kzGDwTc6bdaR+aLCFJTZS6Gc:dbAtCYOGDz0wwydjHFJ3j
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence