2059da764efe63c0be201fb02200e27f6f4e4ceca0a053c149082b7186a08aaf | Triage

Sharing

General

Target

2059da764efe63c0be201fb02200e27f6f4e4ceca0a053c149082b7186a08aaf
Size

272KB
Sample

221030-yma94sgdd6
MD5

a107b8b3326ee5ac4a4362a9dd64d0e0
SHA1

c2b0a5aa39c796a905d19a4f05d5c0e6c9be8c4c
SHA256

2059da764efe63c0be201fb02200e27f6f4e4ceca0a053c149082b7186a08aaf
SHA512

3a6c1a8df5c8c4f0094b667b5f5bd6f96b4c1efb0d79eafea62de05ca22ff148c5dc1ca1ab2b25bce1eeefe0ce2928b3d3b8a4c2914970acbb56ad379fa0d2c5
SSDEEP

3072:Z4g9gmss0FvbVJznCRcz/hVFA9MSs/PLLj+Qm4U3YwgTeA3WQ:2tvbfznH7O9G/PLLxU3YwgT

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  2059da764efe63c0be201fb02200e27f6f4e4ceca0a053c149082b7186a08aaf
- Size
  
  272KB
- MD5
  
  a107b8b3326ee5ac4a4362a9dd64d0e0
- SHA1
  
  c2b0a5aa39c796a905d19a4f05d5c0e6c9be8c4c
- SHA256
  
  2059da764efe63c0be201fb02200e27f6f4e4ceca0a053c149082b7186a08aaf
- SHA512
  
  3a6c1a8df5c8c4f0094b667b5f5bd6f96b4c1efb0d79eafea62de05ca22ff148c5dc1ca1ab2b25bce1eeefe0ce2928b3d3b8a4c2914970acbb56ad379fa0d2c5
- SSDEEP
  
  3072:Z4g9gmss0FvbVJznCRcz/hVFA9MSs/PLLj+Qm4U3YwgTeA3WQ:2tvbfznH7O9G/PLLxU3YwgT
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence