db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1 | Triage

Sharing

General

Target

db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1
Size

156KB
Sample

221123-vdmp1abf7y
MD5

577ad57f6b38672e14dd70236b6241e5
SHA1

97643ba574dd7de03b270a52b76cbfd4f6414d8e
SHA256

db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1
SHA512

34cf0dc109692c531fb9e9a1a844ca1dda96caee38f83c938e50202c37253647e0021f90bc8c1b72c765d454a9d278c18839f665b427fd7b9aae2e4d37979104
SSDEEP

3072:ECbO/tonrGwkAjpWn1KG912QXXU+EnHsRPaVW+E5j4oQAO+:E3GiwkGG9ggkMRPacdpO+

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1
- Size
  
  156KB
- MD5
  
  577ad57f6b38672e14dd70236b6241e5
- SHA1
  
  97643ba574dd7de03b270a52b76cbfd4f6414d8e
- SHA256
  
  db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1
- SHA512
  
  34cf0dc109692c531fb9e9a1a844ca1dda96caee38f83c938e50202c37253647e0021f90bc8c1b72c765d454a9d278c18839f665b427fd7b9aae2e4d37979104
- SSDEEP
  
  3072:ECbO/tonrGwkAjpWn1KG912QXXU+EnHsRPaVW+E5j4oQAO+:E3GiwkGG9ggkMRPacdpO+
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence