0bcc9deee53c2f2ba6facf71ca96609d7ada6e7db9911b502d3660852dccb7f5 | Triage

Sharing

General

Target

0bcc9deee53c2f2ba6facf71ca96609d7ada6e7db9911b502d3660852dccb7f5
Size

220KB
Sample

221107-zlxmdsghg8
MD5

0e4382d7dc2ef1c54d2e00cb0e3c5944
SHA1

5856c2b3a4da277a6ac2636b2e4720fdfaf6dcff
SHA256

0bcc9deee53c2f2ba6facf71ca96609d7ada6e7db9911b502d3660852dccb7f5
SHA512

42bc438c7607adaa4e0ba8a60d5e2c6e3fe8523a46d7f18f1bf0d5cc17636897750945e060b366f93b9643c2cd13027dcd97cfb6cafd6576835f765884d78197
SSDEEP

3072:bNJIxSC28g3Vgypib1Jf5PNRP9RZfeGEVbN:3IsC28gFgypiZvLZfeG4

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  0bcc9deee53c2f2ba6facf71ca96609d7ada6e7db9911b502d3660852dccb7f5
- Size
  
  220KB
- MD5
  
  0e4382d7dc2ef1c54d2e00cb0e3c5944
- SHA1
  
  5856c2b3a4da277a6ac2636b2e4720fdfaf6dcff
- SHA256
  
  0bcc9deee53c2f2ba6facf71ca96609d7ada6e7db9911b502d3660852dccb7f5
- SHA512
  
  42bc438c7607adaa4e0ba8a60d5e2c6e3fe8523a46d7f18f1bf0d5cc17636897750945e060b366f93b9643c2cd13027dcd97cfb6cafd6576835f765884d78197
- SSDEEP
  
  3072:bNJIxSC28g3Vgypib1Jf5PNRP9RZfeGEVbN:3IsC28gFgypiZvLZfeG4
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2