2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b | Triage

Sharing

General

Target

2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b
Size

260KB
Sample

221123-xhqnkafa93
MD5

5747e1a808e070a884a78b672f661b00
SHA1

29a67bb88034f42f5e35b4d5d1c6f40f69b36fd2
SHA256

2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b
SHA512

f312179f2439ad691f9b9bdfae89edece04a89412b2c90229d5df32fc7cc90d7e1820781abaa366e65deb8669755d3f77947b899a4d3969c81e2f972a8bb6e5e
SSDEEP

6144:nd7IgTSrMaIl/jcLijfHFEHWzXvjT85R:npNTSrMaIqLlI/H85R

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b
- Size
  
  260KB
- MD5
  
  5747e1a808e070a884a78b672f661b00
- SHA1
  
  29a67bb88034f42f5e35b4d5d1c6f40f69b36fd2
- SHA256
  
  2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b
- SHA512
  
  f312179f2439ad691f9b9bdfae89edece04a89412b2c90229d5df32fc7cc90d7e1820781abaa366e65deb8669755d3f77947b899a4d3969c81e2f972a8bb6e5e
- SSDEEP
  
  6144:nd7IgTSrMaIl/jcLijfHFEHWzXvjT85R:npNTSrMaIqLlI/H85R
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence