9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c | Triage

Submit
Reports

Overview

overview

Static

static

9905a9b56a...1c.exe

windows7-x64

9905a9b56a...1c.exe

windows10-2004-x64

Sharing

General

Target

9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c
Size

367KB
Sample

221106-qcqm2scga2
MD5

03d59a294951b4b4a8026e5dede58ec7
SHA1

bdeb0d484970a309c655019755d6604ec42a2b20
SHA256

9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c
SHA512

cbc09e48cdb5e41e27f8099c33a0f1709ddab131494aadaca7caa8f30e03c35b168294d331bfed8d01ae5ada4e34772909bffedb05e0f1c2d4725742c88bdfce
SSDEEP

6144:gDCwfG1bnxLERR9saMDCwfG1bnxLERR9satG14W:g72bntEL9/M72bntEL9/tG1p

Score

10^/10

evasion persistence

Static task

static1

Behavioral task

behavioral1

Sample

9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe

Resource

win7-20220812-en

evasion persistence

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe

Resource

win10v2004-20220812-en

evasion persistence

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c
- Size
  
  367KB
- MD5
  
  03d59a294951b4b4a8026e5dede58ec7
- SHA1
  
  bdeb0d484970a309c655019755d6604ec42a2b20
- SHA256
  
  9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c
- SHA512
  
  cbc09e48cdb5e41e27f8099c33a0f1709ddab131494aadaca7caa8f30e03c35b168294d331bfed8d01ae5ada4e34772909bffedb05e0f1c2d4725742c88bdfce
- SSDEEP
  
  6144:gDCwfG1bnxLERR9saMDCwfG1bnxLERR9satG14W:g72bntEL9/M72bntEL9/tG1p
Score

10^/10

evasion persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence

© 2018-2025

Terms | Privacy