c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad | Triage

Sharing

General

Target

c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad
Size

140KB
Sample

221124-as3dsaae3t
MD5

271b8920e3ec5ade31bef4126c0791e2
SHA1

929fcb36787fcfd962714dcd4af5b034accb782c
SHA256

c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad
SHA512

e439e78e4543c8c512f52d09a92c5a8d97fd37154b72850be23a8ed9b5ca699f02dfc2e359f76b87fab9b91ff4ccbc8652c2ebb7414e3327cae3034c72e57b05
SSDEEP

768:zHMwyVyt4pd04q0zik+vhy7g0EM/LinbQ+d1:roeEn3+pCg0EUGQ+d1

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad
- Size
  
  140KB
- MD5
  
  271b8920e3ec5ade31bef4126c0791e2
- SHA1
  
  929fcb36787fcfd962714dcd4af5b034accb782c
- SHA256
  
  c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad
- SHA512
  
  e439e78e4543c8c512f52d09a92c5a8d97fd37154b72850be23a8ed9b5ca699f02dfc2e359f76b87fab9b91ff4ccbc8652c2ebb7414e3327cae3034c72e57b05
- SSDEEP
  
  768:zHMwyVyt4pd04q0zik+vhy7g0EM/LinbQ+d1:roeEn3+pCg0EUGQ+d1
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence