f4112c350e9f0a897589868e2ec37775a34d2d35d315be0ee44b5d8b9ad08781 | Triage

Sharing

General

Target

f4112c350e9f0a897589868e2ec37775a34d2d35d315be0ee44b5d8b9ad08781
Size

124KB
Sample

221030-ap4sfadce7
MD5

a35346853247567ee32ff6f4e53f0650
SHA1

7f3a12677c4f9ec31aad5a8d745db20e5f71254a
SHA256

f4112c350e9f0a897589868e2ec37775a34d2d35d315be0ee44b5d8b9ad08781
SHA512

07e3e04b0c2c7818d2c8d3cf54936a4e30c4a73ed1505e348783fa4a19aede637938790809a7e80a1e6dd1faf664392f88b738664964fef03b58fcae2ae0ed47
SSDEEP

1536:0pszq5YahRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUmE:yGIYahkFoN3Oo1+FvfSW

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  f4112c350e9f0a897589868e2ec37775a34d2d35d315be0ee44b5d8b9ad08781
- Size
  
  124KB
- MD5
  
  a35346853247567ee32ff6f4e53f0650
- SHA1
  
  7f3a12677c4f9ec31aad5a8d745db20e5f71254a
- SHA256
  
  f4112c350e9f0a897589868e2ec37775a34d2d35d315be0ee44b5d8b9ad08781
- SHA512
  
  07e3e04b0c2c7818d2c8d3cf54936a4e30c4a73ed1505e348783fa4a19aede637938790809a7e80a1e6dd1faf664392f88b738664964fef03b58fcae2ae0ed47
- SSDEEP
  
  1536:0pszq5YahRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUmE:yGIYahkFoN3Oo1+FvfSW
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence