e4425adf97bd596fbfe8cc4a4435f1f2bcefc434e2e6766b6b2e6e5def1271c1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e4425adf97bd596fbfe8cc4a4435f1f2bcefc434e2e6766b6b2e6e5def1271c1
Size

88KB
Sample

221106-sc4wsaadhp
MD5

08badb44bde7d32e34bc2f216353d130
SHA1

99c261c1a162238fc9576583cc40533a9651bf76
SHA256

e4425adf97bd596fbfe8cc4a4435f1f2bcefc434e2e6766b6b2e6e5def1271c1
SHA512

bd1854c9186d3ca93765b6402b0c88fe099ca089c982429cfca6728b326b7fd856346ef783ea93d8b284d381909eab272c77b3f77930b76ce4bd85a581c2d22b
SSDEEP

768:ulb6o5+nURLQ/JD60XDeVtA5YxmHwWW2iYf/ce2NZQcyVbdg5CIBT/DCwaTDNmfP:uV+IQ/JDHKa5LJW6/Z2NZQIvDmNmoGp

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  e4425adf97bd596fbfe8cc4a4435f1f2bcefc434e2e6766b6b2e6e5def1271c1
- Size
  
  88KB
- MD5
  
  08badb44bde7d32e34bc2f216353d130
- SHA1
  
  99c261c1a162238fc9576583cc40533a9651bf76
- SHA256
  
  e4425adf97bd596fbfe8cc4a4435f1f2bcefc434e2e6766b6b2e6e5def1271c1
- SHA512
  
  bd1854c9186d3ca93765b6402b0c88fe099ca089c982429cfca6728b326b7fd856346ef783ea93d8b284d381909eab272c77b3f77930b76ce4bd85a581c2d22b
- SSDEEP
  
  768:ulb6o5+nURLQ/JD60XDeVtA5YxmHwWW2iYf/ce2NZQcyVbdg5CIBT/DCwaTDNmfP:uV+IQ/JDHKa5LJW6/Z2NZQIvDmNmoGp
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence