10dfc4bf9f572e1db3b4a3c8fe0bb4c69ee23831ec4feb182f0f9545031f66dd | Triage

Sharing

General

Target

10dfc4bf9f572e1db3b4a3c8fe0bb4c69ee23831ec4feb182f0f9545031f66dd
Size

43KB
Sample

221123-lnyqksfc5x
MD5

c23c2b06287e06246c2744a1a730c6ef
SHA1

05456cdb47a734cbd079081f0cc543388db8b0a4
SHA256

10dfc4bf9f572e1db3b4a3c8fe0bb4c69ee23831ec4feb182f0f9545031f66dd
SHA512

a1da3c5ff57fe0fdc8ee13b4f8f51c0177c6e67208809871b548bd31b44fc08475b991b67326d237acfe9194a8bdfd6cafbc838327727bd322adb6ee3122016a
SSDEEP

768:Lshpv8eDKxNS0cGbQrq9OSiT532YdD581k46HDxjHmOqvtu1SBs91wyR2N/zAL1y:QqulG9ktD96KrwU2jHCCrk

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  10dfc4bf9f572e1db3b4a3c8fe0bb4c69ee23831ec4feb182f0f9545031f66dd
- Size
  
  43KB
- MD5
  
  c23c2b06287e06246c2744a1a730c6ef
- SHA1
  
  05456cdb47a734cbd079081f0cc543388db8b0a4
- SHA256
  
  10dfc4bf9f572e1db3b4a3c8fe0bb4c69ee23831ec4feb182f0f9545031f66dd
- SHA512
  
  a1da3c5ff57fe0fdc8ee13b4f8f51c0177c6e67208809871b548bd31b44fc08475b991b67326d237acfe9194a8bdfd6cafbc838327727bd322adb6ee3122016a
- SSDEEP
  
  768:Lshpv8eDKxNS0cGbQrq9OSiT532YdD581k46HDxjHmOqvtu1SBs91wyR2N/zAL1y:QqulG9ktD96KrwU2jHCCrk
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence