b292b62fe86dd9c3bd799c35b84a58ab58c439738f35c109547e1005bc9a8abc | Triage

Sharing

General

Target

b292b62fe86dd9c3bd799c35b84a58ab58c439738f35c109547e1005bc9a8abc
Size

77KB
Sample

221123-zqra6sde65
MD5

b4d5d82b3b40b044f447ed1ec3d3f89f
SHA1

16febcd3b8f972e01271d91d4a1676f15d6ad0ea
SHA256

b292b62fe86dd9c3bd799c35b84a58ab58c439738f35c109547e1005bc9a8abc
SHA512

7639a9a0e034abff038cc21c4cfa0195b135f85d80a97db52559b86ee628ce16d59559532f09becf85f207452bd2cedb72aa02bd6b84c8279038303339232ecd
SSDEEP

1536:0RfFwS4S15Bx8pEttgdO/mXpgWXOJgQmmogDcMH5fCVsJVafuegWXAi+oX9tWV0m:AfFwXS15Bx8pEttgdO/mXpgWXOJgQmmy

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  b292b62fe86dd9c3bd799c35b84a58ab58c439738f35c109547e1005bc9a8abc
- Size
  
  77KB
- MD5
  
  b4d5d82b3b40b044f447ed1ec3d3f89f
- SHA1
  
  16febcd3b8f972e01271d91d4a1676f15d6ad0ea
- SHA256
  
  b292b62fe86dd9c3bd799c35b84a58ab58c439738f35c109547e1005bc9a8abc
- SHA512
  
  7639a9a0e034abff038cc21c4cfa0195b135f85d80a97db52559b86ee628ce16d59559532f09becf85f207452bd2cedb72aa02bd6b84c8279038303339232ecd
- SSDEEP
  
  1536:0RfFwS4S15Bx8pEttgdO/mXpgWXOJgQmmogDcMH5fCVsJVafuegWXAi+oX9tWV0m:AfFwXS15Bx8pEttgdO/mXpgWXOJgQmmy
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence