70cf8f8ade8b5abc7b4a64563a1216a8bb29e9e693c9b366dd8b5c12f95d337d | Triage

Sharing

General

Target

70cf8f8ade8b5abc7b4a64563a1216a8bb29e9e693c9b366dd8b5c12f95d337d
Size

232KB
Sample

221124-qkhbmsfd52
MD5

cb007bbdb815f10748d675b305c7015a
SHA1

e358d4d092eba36e1688f4db030b726f9ec9a50a
SHA256

70cf8f8ade8b5abc7b4a64563a1216a8bb29e9e693c9b366dd8b5c12f95d337d
SHA512

12dbcae3e0ade19c41a1412e74675454bd42432673064e6178ef5e3ef59c29dfff7ed1e6b493dc43ed2688c1f4a48f6bb13eb5d73a525551dc72974f32acf6c1
SSDEEP

1536:GtzmGomoDo0omoEo4A5AVzotokoXoOoioVo2oEogoFoPoeoWooo7oxozoZoMoZHU:SmJA5AVap/B

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  70cf8f8ade8b5abc7b4a64563a1216a8bb29e9e693c9b366dd8b5c12f95d337d
- Size
  
  232KB
- MD5
  
  cb007bbdb815f10748d675b305c7015a
- SHA1
  
  e358d4d092eba36e1688f4db030b726f9ec9a50a
- SHA256
  
  70cf8f8ade8b5abc7b4a64563a1216a8bb29e9e693c9b366dd8b5c12f95d337d
- SHA512
  
  12dbcae3e0ade19c41a1412e74675454bd42432673064e6178ef5e3ef59c29dfff7ed1e6b493dc43ed2688c1f4a48f6bb13eb5d73a525551dc72974f32acf6c1
- SSDEEP
  
  1536:GtzmGomoDo0omoEo4A5AVzotokoXoOoioVo2oEogoFoPoeoWooo7oxozoZoMoZHU:SmJA5AVap/B
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence