0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561
Size

132KB
Sample

221030-qtzx2scfb2
MD5

a2831f7853731b81715f241bd9f35462
SHA1

958678130f379f456b92a2e806aa16d8a1749aaa
SHA256

0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561
SHA512

f35d1693171bd32d6d966f2dca61b9871f4f07fe12d16bb7226dd66faa284be47edf9d793129e3b41f5f2e60cbe3c1641b8a9f7e6609a941104c896d3013556b
SSDEEP

3072:yREL2hDBTjkJlUub06rN6eE8/o2X5kg2bHOL5PFn0wcccccccc:UTd203qt2g2bH0PFn0wcccccccc

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561
- Size
  
  132KB
- MD5
  
  a2831f7853731b81715f241bd9f35462
- SHA1
  
  958678130f379f456b92a2e806aa16d8a1749aaa
- SHA256
  
  0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561
- SHA512
  
  f35d1693171bd32d6d966f2dca61b9871f4f07fe12d16bb7226dd66faa284be47edf9d793129e3b41f5f2e60cbe3c1641b8a9f7e6609a941104c896d3013556b
- SSDEEP
  
  3072:yREL2hDBTjkJlUub06rN6eE8/o2X5kg2bHOL5PFn0wcccccccc:UTd203qt2g2bH0PFn0wcccccccc
Score

8^/10

persistence
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2