da092850a9b75888edd2cf5d7688d4bc9658d6e9d3e9320eeb64ee88715d69f8 | Triage

Sharing

General

Target

da092850a9b75888edd2cf5d7688d4bc9658d6e9d3e9320eeb64ee88715d69f8
Size

1.8MB
Sample

221124-ez5jyacb3z
MD5

7523786cf4d3cd9ee29e99b87999e9ac
SHA1

18031ff8a806128cd7ff56c8580aeddc1611e618
SHA256

da092850a9b75888edd2cf5d7688d4bc9658d6e9d3e9320eeb64ee88715d69f8
SHA512

ffca1e8364753ba0c93d0924e3f9df97c23114e94796569605c76cd051e155b5831439bde7433d6e695add9d9168a6c15f834747a72ffdcd5880b95cd302f57b
SSDEEP

49152:/pFFyhfbyOGkL7sfLWtkleG2tworeUZ2rcIEgS0:LQdGkLuLWNGoiUZ2rcIf

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  da092850a9b75888edd2cf5d7688d4bc9658d6e9d3e9320eeb64ee88715d69f8
- Size
  
  1.8MB
- MD5
  
  7523786cf4d3cd9ee29e99b87999e9ac
- SHA1
  
  18031ff8a806128cd7ff56c8580aeddc1611e618
- SHA256
  
  da092850a9b75888edd2cf5d7688d4bc9658d6e9d3e9320eeb64ee88715d69f8
- SHA512
  
  ffca1e8364753ba0c93d0924e3f9df97c23114e94796569605c76cd051e155b5831439bde7433d6e695add9d9168a6c15f834747a72ffdcd5880b95cd302f57b
- SSDEEP
  
  49152:/pFFyhfbyOGkL7sfLWtkleG2tworeUZ2rcIEgS0:LQdGkLuLWNGoiUZ2rcIf
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence