a3b7b9444253e5061fcf3f8cfe8a518709ec3344f6a340a173a7ab82ada049bf | Triage

Sharing

General

Target

a3b7b9444253e5061fcf3f8cfe8a518709ec3344f6a340a173a7ab82ada049bf
Size

877KB
Sample

221123-s9166age5x
MD5

42e8e00e061e2e22a76f52bce13abe30
SHA1

f89fe9249972b7523159d1c5e1163c57769d6a6c
SHA256

a3b7b9444253e5061fcf3f8cfe8a518709ec3344f6a340a173a7ab82ada049bf
SHA512

f051af7b31bb2aed32b62720b041325be59182c8cf03e242e7b1986fc4c13b6d08ad56163cad4428ae0acbdf36c7adeff70bbe6607ed7bb94b88f724528027a8
SSDEEP

24576:h1OYdaOLNBIcGBAU29/k9PNuOJySHgLJVt+mR9j:h1Os+Lqf9yNuOVgLnt+mR9

Score

8^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  a3b7b9444253e5061fcf3f8cfe8a518709ec3344f6a340a173a7ab82ada049bf
- Size
  
  877KB
- MD5
  
  42e8e00e061e2e22a76f52bce13abe30
- SHA1
  
  f89fe9249972b7523159d1c5e1163c57769d6a6c
- SHA256
  
  a3b7b9444253e5061fcf3f8cfe8a518709ec3344f6a340a173a7ab82ada049bf
- SHA512
  
  f051af7b31bb2aed32b62720b041325be59182c8cf03e242e7b1986fc4c13b6d08ad56163cad4428ae0acbdf36c7adeff70bbe6607ed7bb94b88f724528027a8
- SSDEEP
  
  24576:h1OYdaOLNBIcGBAU29/k9PNuOJySHgLJVt+mR9j:h1Os+Lqf9yNuOVgLnt+mR9
Score

8^/10

discovery evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence