e75ddd9196e0209c29c6b4f62bd9f59c811b548f7084b70731f6d811df1d7fdd | Triage

Sharing

General

Target

e75ddd9196e0209c29c6b4f62bd9f59c811b548f7084b70731f6d811df1d7fdd
Size

164KB
Sample

221030-yps8pshefq
MD5

81e644b34c6cc1d165828ff9901ed848
SHA1

ccb7d2f7345acab457b127e7471a34894d3b5a51
SHA256

e75ddd9196e0209c29c6b4f62bd9f59c811b548f7084b70731f6d811df1d7fdd
SHA512

06245bf7445fe9c6ec32df4705c25dc27ad38f692c41d5c021f5e5c58361be7c87286c5c5bc92270d320ca47e44b142c53f7bc11295dbe94066e5c1ed3455491
SSDEEP

3072:jmkMCSLsNgqNWO3xDAaEskq8+L4VEDoZD4mfrmZs20/GX0:/SLsNgMWO3xDAaER+L4VfZkmfrIs2S

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  e75ddd9196e0209c29c6b4f62bd9f59c811b548f7084b70731f6d811df1d7fdd
- Size
  
  164KB
- MD5
  
  81e644b34c6cc1d165828ff9901ed848
- SHA1
  
  ccb7d2f7345acab457b127e7471a34894d3b5a51
- SHA256
  
  e75ddd9196e0209c29c6b4f62bd9f59c811b548f7084b70731f6d811df1d7fdd
- SHA512
  
  06245bf7445fe9c6ec32df4705c25dc27ad38f692c41d5c021f5e5c58361be7c87286c5c5bc92270d320ca47e44b142c53f7bc11295dbe94066e5c1ed3455491
- SSDEEP
  
  3072:jmkMCSLsNgqNWO3xDAaEskq8+L4VEDoZD4mfrmZs20/GX0:/SLsNgMWO3xDAaER+L4VfZkmfrIs2S
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence