0b6434a0abdfd1abca891898b4dd233c1018fb691afb1bc28f8cf9f9831f1b74 | Triage

Sharing

General

Target

0b6434a0abdfd1abca891898b4dd233c1018fb691afb1bc28f8cf9f9831f1b74
Size

184KB
Sample

221124-anl61aeh73
MD5

3a2faae4ba8725f18d153ffee8960730
SHA1

7c07581c7b1e18dcc42a33843d3c90376509db60
SHA256

0b6434a0abdfd1abca891898b4dd233c1018fb691afb1bc28f8cf9f9831f1b74
SHA512

6fbadde4dfb5adfdef8fe3215bcda40f6d3d7014a25e9a89b258203ccd29ae55edb7ea5e110469b40c72efedbcea550dc0754aecba2993725786b3638f0e75d3
SSDEEP

3072:yrBQxg+CWoYTzCh46Knvmb7/D26ytQlw/Lg5q69srijEgS36:wGpz6LKnvmb7/D26yQlw/Lg5qosriHSK

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  0b6434a0abdfd1abca891898b4dd233c1018fb691afb1bc28f8cf9f9831f1b74
- Size
  
  184KB
- MD5
  
  3a2faae4ba8725f18d153ffee8960730
- SHA1
  
  7c07581c7b1e18dcc42a33843d3c90376509db60
- SHA256
  
  0b6434a0abdfd1abca891898b4dd233c1018fb691afb1bc28f8cf9f9831f1b74
- SHA512
  
  6fbadde4dfb5adfdef8fe3215bcda40f6d3d7014a25e9a89b258203ccd29ae55edb7ea5e110469b40c72efedbcea550dc0754aecba2993725786b3638f0e75d3
- SSDEEP
  
  3072:yrBQxg+CWoYTzCh46Knvmb7/D26ytQlw/Lg5q69srijEgS36:wGpz6LKnvmb7/D26yQlw/Lg5qosriHSK
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence