468ca1e0d8a22f5df11c2e42bdc7ce95e8d0fccb574b09f2e429efb47a00c9e1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

468ca1e0d8a22f5df11c2e42bdc7ce95e8d0fccb574b09f2e429efb47a00c9e1
Size

212KB
Sample

221030-alp5wadbd2
MD5

92c521fa86902ee4a32406b9b45fa810
SHA1

8c863440dd115791a72936cc1f15caf2e9f37407
SHA256

468ca1e0d8a22f5df11c2e42bdc7ce95e8d0fccb574b09f2e429efb47a00c9e1
SHA512

d020866de729d3cd1ff912bc51336fb6ec1e975b02d82a527453680d9e13ab235c23cd978bb3ab6a9428cce769b5445fcca0119bc401411c02a64a18537cb4d6
SSDEEP

6144:up4V7IrqJQNbufrI4ukDnx/8vtvwzsmMAEu3Wev5kBirl87VFt6En9x7Xf7oufab:up4CmGbMrI4ukDnx/8vtvwzsmMAEGHv/

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  468ca1e0d8a22f5df11c2e42bdc7ce95e8d0fccb574b09f2e429efb47a00c9e1
- Size
  
  212KB
- MD5
  
  92c521fa86902ee4a32406b9b45fa810
- SHA1
  
  8c863440dd115791a72936cc1f15caf2e9f37407
- SHA256
  
  468ca1e0d8a22f5df11c2e42bdc7ce95e8d0fccb574b09f2e429efb47a00c9e1
- SHA512
  
  d020866de729d3cd1ff912bc51336fb6ec1e975b02d82a527453680d9e13ab235c23cd978bb3ab6a9428cce769b5445fcca0119bc401411c02a64a18537cb4d6
- SSDEEP
  
  6144:up4V7IrqJQNbufrI4ukDnx/8vtvwzsmMAEu3Wev5kBirl87VFt6En9x7Xf7oufab:up4CmGbMrI4ukDnx/8vtvwzsmMAEGHv/
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence