5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729 | Triage

Sharing

General

Target

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729
Size

180KB
Sample

221123-xg2z7sfa53
MD5

2b602be7dea84758ed540f5c367cf9a3
SHA1

e1eb2ca034493f4bada29682e0998c8504a9dab3
SHA256

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729
SHA512

6d9d2b038c19e9291d7e45f1c94c923f7cc1d7ff6e051c80b95021f5f261d4a8c5332b5900e35e4eaf48e05596af749ceab320175f9298d11664afbf9e1a8bb5
SSDEEP

3072:6IN4GdYRLoeEdRos/eaqFnqWDb+uTyLDC6s5sSYqGlC6YViZj5HQXZmmJ0yCFiof:VNpcKPpm2lC6YViZj5HQXZmmJ0yCF9Bk

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729
- Size
  
  180KB
- MD5
  
  2b602be7dea84758ed540f5c367cf9a3
- SHA1
  
  e1eb2ca034493f4bada29682e0998c8504a9dab3
- SHA256
  
  5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729
- SHA512
  
  6d9d2b038c19e9291d7e45f1c94c923f7cc1d7ff6e051c80b95021f5f261d4a8c5332b5900e35e4eaf48e05596af749ceab320175f9298d11664afbf9e1a8bb5
- SSDEEP
  
  3072:6IN4GdYRLoeEdRos/eaqFnqWDb+uTyLDC6s5sSYqGlC6YViZj5HQXZmmJ0yCFiof:VNpcKPpm2lC6YViZj5HQXZmmJ0yCF9Bk
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence