f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14 | Triage

Sharing

General

Target

f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14
Size

44KB
Sample

221124-asmckafc22
MD5

260a26a815aaddabce59cb132c9211e0
SHA1

33a8b938d75c2219171864588effb777a046c0e9
SHA256

f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14
SHA512

17d8c5399e7139e77328d60a5e59bcbe926a728a3d1d405097db821df251905d03be8ee3d506415f471a4378928851a599b24878c50f3dcdaf15457cdeede194
SSDEEP

768:bh/Hd29JLlNAXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:bEhNpHyj6S3T77

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14
- Size
  
  44KB
- MD5
  
  260a26a815aaddabce59cb132c9211e0
- SHA1
  
  33a8b938d75c2219171864588effb777a046c0e9
- SHA256
  
  f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14
- SHA512
  
  17d8c5399e7139e77328d60a5e59bcbe926a728a3d1d405097db821df251905d03be8ee3d506415f471a4378928851a599b24878c50f3dcdaf15457cdeede194
- SSDEEP
  
  768:bh/Hd29JLlNAXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:bEhNpHyj6S3T77
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence