1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9 | Triage

Sharing

General

Target

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9
Size

252KB
Sample

221124-al49ssaa3s
MD5

29b3352042d3cbf20bcb23361f771930
SHA1

fc8621ea3dffded92acf59165efb17a72f37735d
SHA256

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9
SHA512

c766b93ec62bf5a44609330f165bf631a76469b3b7a3b3b4efbce600d61b91fd4f96535d8a141afe30924ee0e48a2512eb8a4b3c7e074c3ac4ad07ad03093d3e
SSDEEP

6144:8X7CGWUsbNZeoq6AvFPpWlyfeWgdx1XxcNoX+poNd8m3RZWuAzgGk:8RWUsbbeoq6AFpWlyfeWgdx1Xxq4+pob

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9
- Size
  
  252KB
- MD5
  
  29b3352042d3cbf20bcb23361f771930
- SHA1
  
  fc8621ea3dffded92acf59165efb17a72f37735d
- SHA256
  
  1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9
- SHA512
  
  c766b93ec62bf5a44609330f165bf631a76469b3b7a3b3b4efbce600d61b91fd4f96535d8a141afe30924ee0e48a2512eb8a4b3c7e074c3ac4ad07ad03093d3e
- SSDEEP
  
  6144:8X7CGWUsbNZeoq6AvFPpWlyfeWgdx1XxcNoX+poNd8m3RZWuAzgGk:8RWUsbbeoq6AFpWlyfeWgdx1Xxq4+pob
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence