03a004bdff50f0caca4081d5a4518e827811152be40a000eef7773d3b393c837 | Triage

Sharing

General

Target

03a004bdff50f0caca4081d5a4518e827811152be40a000eef7773d3b393c837
Size

548KB
Sample

221123-mm2araee45
MD5

a04c390f931408a87eea441f16eecd7f
SHA1

6acd3eb02cb7c3108b00467ad0fa11413887ab67
SHA256

03a004bdff50f0caca4081d5a4518e827811152be40a000eef7773d3b393c837
SHA512

583b5ded7999890e92f3812f18939875d066cd449374bcef459b7da0f242e09779c80efe5077be463eea06fc5e7d6ba959bf5209c9e64156a45dcfb17d58499c
SSDEEP

12288:YdqkUP8JMi+nQ44k4Lr/NnFMP6aFmVQjxK0trtnz+l:7kUkJQnQ44xrabA2UArtnz+l

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  03a004bdff50f0caca4081d5a4518e827811152be40a000eef7773d3b393c837
- Size
  
  548KB
- MD5
  
  a04c390f931408a87eea441f16eecd7f
- SHA1
  
  6acd3eb02cb7c3108b00467ad0fa11413887ab67
- SHA256
  
  03a004bdff50f0caca4081d5a4518e827811152be40a000eef7773d3b393c837
- SHA512
  
  583b5ded7999890e92f3812f18939875d066cd449374bcef459b7da0f242e09779c80efe5077be463eea06fc5e7d6ba959bf5209c9e64156a45dcfb17d58499c
- SSDEEP
  
  12288:YdqkUP8JMi+nQ44k4Lr/NnFMP6aFmVQjxK0trtnz+l:7kUkJQnQ44xrabA2UArtnz+l
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence