3fc2ae50cdcac490a95d55ac2462423945d765fbddbdbface31c45584070fdb5 | Triage

Sharing

General

Target

3fc2ae50cdcac490a95d55ac2462423945d765fbddbdbface31c45584070fdb5
Size

68KB
Sample

221106-qynetadge6
MD5

14884e9e7367632ecab21056d0c7eda7
SHA1

9a9049dde7f8e604b2f8db7eccb1e6144b519e78
SHA256

3fc2ae50cdcac490a95d55ac2462423945d765fbddbdbface31c45584070fdb5
SHA512

4ad34d2f05f0227ab21066eb9dc99bfa620ccf70fa945c49c7f787ee377b5208d5a68cf3f3032ae13c42528d1ff290834a1d0b7978e323e4c0366c0c8b9a2f3c
SSDEEP

768:RrpeUKbGP2fSy1A+pGmLZ8veIouYFvDEKqOt5bKP9nbcuyD7Utn:RMqy1AGGmLZ8GI3YpqOt5bsnouy8tn

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  3fc2ae50cdcac490a95d55ac2462423945d765fbddbdbface31c45584070fdb5
- Size
  
  68KB
- MD5
  
  14884e9e7367632ecab21056d0c7eda7
- SHA1
  
  9a9049dde7f8e604b2f8db7eccb1e6144b519e78
- SHA256
  
  3fc2ae50cdcac490a95d55ac2462423945d765fbddbdbface31c45584070fdb5
- SHA512
  
  4ad34d2f05f0227ab21066eb9dc99bfa620ccf70fa945c49c7f787ee377b5208d5a68cf3f3032ae13c42528d1ff290834a1d0b7978e323e4c0366c0c8b9a2f3c
- SSDEEP
  
  768:RrpeUKbGP2fSy1A+pGmLZ8veIouYFvDEKqOt5bKP9nbcuyD7Utn:RMqy1AGGmLZ8GI3YpqOt5bsnouy8tn
Score

8^/10

evasion persistence
- Executes dropped EXE
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence