a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48 | Triage

Sharing

General

Target

036de6e9928865caeced1bae00bdb55d
Size

96KB
Sample

221125-dznezscb8s
MD5

036de6e9928865caeced1bae00bdb55d
SHA1

27b92bbc3cb16d06e645438079f24787975d520f
SHA256

a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48
SHA512

9bd1d4624d2fcda393c69b1e6dac21071ccdf3ea24c22e8b94a475a56131008f14acba099256fd59ceacd81e87c3d43d2e5f2d4966f7d9021b641b6c47af5adf
SSDEEP

1536:xfw6ygq47NGW9CgD4Vw8w28Dxv5s3wOXGpx/9l/7RyVcTIuGeNjcfgfu6ls5hfLu:xfw6Pq47NGW9lD4Vw8w28Dxv5s1XM+cN

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  036de6e9928865caeced1bae00bdb55d
- Size
  
  96KB
- MD5
  
  036de6e9928865caeced1bae00bdb55d
- SHA1
  
  27b92bbc3cb16d06e645438079f24787975d520f
- SHA256
  
  a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48
- SHA512
  
  9bd1d4624d2fcda393c69b1e6dac21071ccdf3ea24c22e8b94a475a56131008f14acba099256fd59ceacd81e87c3d43d2e5f2d4966f7d9021b641b6c47af5adf
- SSDEEP
  
  1536:xfw6ygq47NGW9CgD4Vw8w28Dxv5s3wOXGpx/9l/7RyVcTIuGeNjcfgfu6ls5hfLu:xfw6Pq47NGW9lD4Vw8w28Dxv5s1XM+cN
Score

10^/10

evasion persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence