dd4d2911a1257c1737098beec2424f0e0658545ec106df8b4d24c3a5112893a0 | Triage

Sharing

General

Target

dd4d2911a1257c1737098beec2424f0e0658545ec106df8b4d24c3a5112893a0
Size

108KB
Sample

221030-tt6blshgd9
MD5

82e692b27abda4a45506b28e7edbc40c
SHA1

1fd3e5e823729ded7d672f66f1c3301710eecc3e
SHA256

dd4d2911a1257c1737098beec2424f0e0658545ec106df8b4d24c3a5112893a0
SHA512

e7b947929b92e924c08b0d33fbe6a7882e134dd2709a3aa61d68f222ab87182a728ddcc764b0998d210f091c8cc21b802f2604612591b8535aaa9459abe5ab5a
SSDEEP

1536:xjX/V5d4jes5mBVKuCrENMRs7I9cLwhJt5G35Xm4ofWmkVpgWKBjWSKM8IVbnOhF:VX/iQCs7I9mWyYzr8H

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  dd4d2911a1257c1737098beec2424f0e0658545ec106df8b4d24c3a5112893a0
- Size
  
  108KB
- MD5
  
  82e692b27abda4a45506b28e7edbc40c
- SHA1
  
  1fd3e5e823729ded7d672f66f1c3301710eecc3e
- SHA256
  
  dd4d2911a1257c1737098beec2424f0e0658545ec106df8b4d24c3a5112893a0
- SHA512
  
  e7b947929b92e924c08b0d33fbe6a7882e134dd2709a3aa61d68f222ab87182a728ddcc764b0998d210f091c8cc21b802f2604612591b8535aaa9459abe5ab5a
- SSDEEP
  
  1536:xjX/V5d4jes5mBVKuCrENMRs7I9cLwhJt5G35Xm4ofWmkVpgWKBjWSKM8IVbnOhF:VX/iQCs7I9mWyYzr8H
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence