d5948b0414c858d1ab429726755e888c53dfd9f34153bcd59961f6c9b64bf90a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5948b0414c858d1ab429726755e888c53dfd9f34153bcd59961f6c9b64bf90a
Size

153KB
Sample

221030-vnqjmsbbh3
MD5

81ad58023c4b3987d1cf7a5c7511cda0
SHA1

eaa28daa8ac4767fcdc4371a5dfcbe5ecb3e8e70
SHA256

d5948b0414c858d1ab429726755e888c53dfd9f34153bcd59961f6c9b64bf90a
SHA512

619425aa58a3f61c62e37f3e22182064e53e09c674568085547917c3b6ad2deb00b6caa3fce586666a9b85f044729b60a0e43064378fba562335f3cabcb27c2d
SSDEEP

3072:9ucZsvR21nEHdrknaMTL+70nVOIk4kDtmIXkn3+mvpRr2x:9UHdon9LE0VOwwmIa72x

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  d5948b0414c858d1ab429726755e888c53dfd9f34153bcd59961f6c9b64bf90a
- Size
  
  153KB
- MD5
  
  81ad58023c4b3987d1cf7a5c7511cda0
- SHA1
  
  eaa28daa8ac4767fcdc4371a5dfcbe5ecb3e8e70
- SHA256
  
  d5948b0414c858d1ab429726755e888c53dfd9f34153bcd59961f6c9b64bf90a
- SHA512
  
  619425aa58a3f61c62e37f3e22182064e53e09c674568085547917c3b6ad2deb00b6caa3fce586666a9b85f044729b60a0e43064378fba562335f3cabcb27c2d
- SSDEEP
  
  3072:9ucZsvR21nEHdrknaMTL+70nVOIk4kDtmIXkn3+mvpRr2x:9UHdon9LE0VOwwmIa72x
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistence