1b6af48befb663a8e87b7aab01bacad2a088f51b825136bfaa3def268f925358 | Triage

Sharing

General

Target

1b6af48befb663a8e87b7aab01bacad2a088f51b825136bfaa3def268f925358
Size

348KB
Sample

221123-s1qztscg38
MD5

bbf1bd69844f4620fd24564c2d87b37b
SHA1

4c31462b2e603aaab1d31974bb88c13675a95906
SHA256

1b6af48befb663a8e87b7aab01bacad2a088f51b825136bfaa3def268f925358
SHA512

4ee6d3c0b1cedb14456a98c8407598aec2b2c827ff5632fb0c0d30113ff2d2182396446521497c19afed9489d4293f94e54f127802b13f273e7b09132450f69e
SSDEEP

3072:Qs2cEhmHKgLksCxnUmakgGgC+YdSnu+T9T1c/SzBRby1SO6MP58XQWApvoL7Pd0f:Qs2A0leQUu+5Zc/YSUaC2vG0UF

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  1b6af48befb663a8e87b7aab01bacad2a088f51b825136bfaa3def268f925358
- Size
  
  348KB
- MD5
  
  bbf1bd69844f4620fd24564c2d87b37b
- SHA1
  
  4c31462b2e603aaab1d31974bb88c13675a95906
- SHA256
  
  1b6af48befb663a8e87b7aab01bacad2a088f51b825136bfaa3def268f925358
- SHA512
  
  4ee6d3c0b1cedb14456a98c8407598aec2b2c827ff5632fb0c0d30113ff2d2182396446521497c19afed9489d4293f94e54f127802b13f273e7b09132450f69e
- SSDEEP
  
  3072:Qs2cEhmHKgLksCxnUmakgGgC+YdSnu+T9T1c/SzBRby1SO6MP58XQWApvoL7Pd0f:Qs2A0leQUu+5Zc/YSUaC2vG0UF
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2