34bcc817efe2ceca776207259976a03782f81983612015c3202a6555e462e64b | Triage

Sharing

General

Target

34bcc817efe2ceca776207259976a03782f81983612015c3202a6555e462e64b
Size

456KB
Sample

221123-rza2jscg91
MD5

82f974dbe64b7d0354516ec88e510bc9
SHA1

b0a0f436b9b5cf50f385cdfdc6a38ae40826181b
SHA256

34bcc817efe2ceca776207259976a03782f81983612015c3202a6555e462e64b
SHA512

70fae5176730ee40c818e3a39ed5a6e9e36786ee9f0a7453dc02ee4d46bb27e277f725707a290b73dcb68941384337ee1e4d902e52405bf3766bf03dcbf31ee8
SSDEEP

12288:C8R1G+2A6l450cw5dSvEQulVi9MQwTDMfzyGEbqY4:VPFNYrTBGEbqf

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  34bcc817efe2ceca776207259976a03782f81983612015c3202a6555e462e64b
- Size
  
  456KB
- MD5
  
  82f974dbe64b7d0354516ec88e510bc9
- SHA1
  
  b0a0f436b9b5cf50f385cdfdc6a38ae40826181b
- SHA256
  
  34bcc817efe2ceca776207259976a03782f81983612015c3202a6555e462e64b
- SHA512
  
  70fae5176730ee40c818e3a39ed5a6e9e36786ee9f0a7453dc02ee4d46bb27e277f725707a290b73dcb68941384337ee1e4d902e52405bf3766bf03dcbf31ee8
- SSDEEP
  
  12288:C8R1G+2A6l450cw5dSvEQulVi9MQwTDMfzyGEbqY4:VPFNYrTBGEbqf
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence