8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac | Triage

Sharing

General

Target

8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac
Size

260KB
Sample

221106-sq83nabbem
MD5

0e89b140c3393615a3fc815f290f8b1b
SHA1

1998e24ee4b1f4d028653c1494ca90417e2ff2f3
SHA256

8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac
SHA512

0bb8d744492e763cc3baff0c93256f8fe65530797c9caf32411ea93b9a282f1f83774473ad975921f1df8faca559b067d1c0d55273962dbc0b44db6d23c97d28
SSDEEP

3072:6gfAlNGvh25n/kZoSUjMqXnpWAkpAmTSrMaIOYt/jo7LAtPhjjtZnfHFEoWBfGVa:6dLgTSrMaIl/jcLijfHFEHWzXvjT85R

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac
- Size
  
  260KB
- MD5
  
  0e89b140c3393615a3fc815f290f8b1b
- SHA1
  
  1998e24ee4b1f4d028653c1494ca90417e2ff2f3
- SHA256
  
  8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac
- SHA512
  
  0bb8d744492e763cc3baff0c93256f8fe65530797c9caf32411ea93b9a282f1f83774473ad975921f1df8faca559b067d1c0d55273962dbc0b44db6d23c97d28
- SSDEEP
  
  3072:6gfAlNGvh25n/kZoSUjMqXnpWAkpAmTSrMaIOYt/jo7LAtPhjjtZnfHFEoWBfGVa:6dLgTSrMaIl/jcLijfHFEHWzXvjT85R
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence