e0d2d9f20f52439359260206fac381a4475cf311d1a7f688531198a90d1db4f9 | Triage

Sharing

General

Target

e0d2d9f20f52439359260206fac381a4475cf311d1a7f688531198a90d1db4f9
Size

68KB
Sample

221124-p8qr9aef42
MD5

95f09326345b552a5d2430ff0fb8d88a
SHA1

23726288e522ce67060c2a941e7cc4fc789cd969
SHA256

e0d2d9f20f52439359260206fac381a4475cf311d1a7f688531198a90d1db4f9
SHA512

44ec9938ee00675b5d57cc76430e304593d00387cdcd1f25f77890df64924511f90262fc91c79daeb6d049a1e6e7e4f4d970f13d6921edd5f12bf6374ecc279d
SSDEEP

768:PcrliTduMAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:krIxzAcqOK3qowgnt1d

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  e0d2d9f20f52439359260206fac381a4475cf311d1a7f688531198a90d1db4f9
- Size
  
  68KB
- MD5
  
  95f09326345b552a5d2430ff0fb8d88a
- SHA1
  
  23726288e522ce67060c2a941e7cc4fc789cd969
- SHA256
  
  e0d2d9f20f52439359260206fac381a4475cf311d1a7f688531198a90d1db4f9
- SHA512
  
  44ec9938ee00675b5d57cc76430e304593d00387cdcd1f25f77890df64924511f90262fc91c79daeb6d049a1e6e7e4f4d970f13d6921edd5f12bf6374ecc279d
- SSDEEP
  
  768:PcrliTduMAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:krIxzAcqOK3qowgnt1d
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence