62239de63addc1dbbd4ebfb44432386fe84e81070d4dd838ef9325a1a8ae7f6d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

62239de63addc1dbbd4ebfb44432386fe84e81070d4dd838ef9325a1a8ae7f6d
Size

1.9MB
Sample

221125-znkevahb51
MD5

656ff6100f5064162e58d39e586449ec
SHA1

cdbc840ec9b424a4e5bdcab6ea38c561ac970aff
SHA256

62239de63addc1dbbd4ebfb44432386fe84e81070d4dd838ef9325a1a8ae7f6d
SHA512

7702f6b7ec6883afe02b69f8a3445521b8065afe43ac2e7d3674f2446b13c1167c98bae16e4c24816d8f8d09b36dac7c01d98e717e48096ba0402b194a27ccc7
SSDEEP

49152:yB5CvLdIotFENfIrox2aktyTvrdWTnzsFkkJEtP:yB5uIozoxxkaR8tk4

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  62239de63addc1dbbd4ebfb44432386fe84e81070d4dd838ef9325a1a8ae7f6d
- Size
  
  1.9MB
- MD5
  
  656ff6100f5064162e58d39e586449ec
- SHA1
  
  cdbc840ec9b424a4e5bdcab6ea38c561ac970aff
- SHA256
  
  62239de63addc1dbbd4ebfb44432386fe84e81070d4dd838ef9325a1a8ae7f6d
- SHA512
  
  7702f6b7ec6883afe02b69f8a3445521b8065afe43ac2e7d3674f2446b13c1167c98bae16e4c24816d8f8d09b36dac7c01d98e717e48096ba0402b194a27ccc7
- SSDEEP
  
  49152:yB5CvLdIotFENfIrox2aktyTvrdWTnzsFkkJEtP:yB5uIozoxxkaR8tk4
Score

8^/10

evasion persistence
- Blocklisted process makes network request
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence