39578ea855532ce700133663f0d63cd2b758059c12e95aaf0ab915eefac89587 | Triage

Sharing

General

Target

39578ea855532ce700133663f0d63cd2b758059c12e95aaf0ab915eefac89587
Size

184KB
Sample

221124-amncnsaa5y
MD5

030b20510ece3ea94c4f7b346ba0fe21
SHA1

16ee6f910e457b28741f1395612bc284f5876232
SHA256

39578ea855532ce700133663f0d63cd2b758059c12e95aaf0ab915eefac89587
SHA512

f5998a1a37d69bc5eec6263fb65c1c35cec9f1d4569d4e3a86c64cae801b0e22ac23f695292ca155370aaa7b9a13cadd397819cfd775e3e460d3ee38aac260f0
SSDEEP

3072:uJmlg+HWoYTzCh46Knvmb7/D26ytQlw/Lg5q69srijEIS3A:DGrpz6LKnvmb7/D26yQlw/Lg5qosri/j

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  39578ea855532ce700133663f0d63cd2b758059c12e95aaf0ab915eefac89587
- Size
  
  184KB
- MD5
  
  030b20510ece3ea94c4f7b346ba0fe21
- SHA1
  
  16ee6f910e457b28741f1395612bc284f5876232
- SHA256
  
  39578ea855532ce700133663f0d63cd2b758059c12e95aaf0ab915eefac89587
- SHA512
  
  f5998a1a37d69bc5eec6263fb65c1c35cec9f1d4569d4e3a86c64cae801b0e22ac23f695292ca155370aaa7b9a13cadd397819cfd775e3e460d3ee38aac260f0
- SSDEEP
  
  3072:uJmlg+HWoYTzCh46Knvmb7/D26ytQlw/Lg5q69srijEIS3A:DGrpz6LKnvmb7/D26yQlw/Lg5qosri/j
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence