0131d6f1350e2fc548993890d0a1919d8c795d5012f2ca9174549aa4bbdb8f5b | Triage

Sharing

General

Target

0131d6f1350e2fc548993890d0a1919d8c795d5012f2ca9174549aa4bbdb8f5b
Size

43KB
Sample

221126-kndvqsab9s
MD5

42ff99b3b9e89ecd45860fee6375eaac
SHA1

b2468b712562525078a9b00b1caeafbd8f4f1762
SHA256

0131d6f1350e2fc548993890d0a1919d8c795d5012f2ca9174549aa4bbdb8f5b
SHA512

cc75e3f2df8219cb6e94069f079f69c68c4c2c4177b5e5f7500122393f082e1401b7fc65264f68d798193a062e43f16be1d2614f18552956667ed3b33a1c36cf
SSDEEP

768:QTe7nd8qhYz3S228PmrW96Te2+p581R6HijH+EqvtK1EXoB1T1kNtuPmHCCjPkaH:Xm6Hh0KQWvhkZHCCrk

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  0131d6f1350e2fc548993890d0a1919d8c795d5012f2ca9174549aa4bbdb8f5b
- Size
  
  43KB
- MD5
  
  42ff99b3b9e89ecd45860fee6375eaac
- SHA1
  
  b2468b712562525078a9b00b1caeafbd8f4f1762
- SHA256
  
  0131d6f1350e2fc548993890d0a1919d8c795d5012f2ca9174549aa4bbdb8f5b
- SHA512
  
  cc75e3f2df8219cb6e94069f079f69c68c4c2c4177b5e5f7500122393f082e1401b7fc65264f68d798193a062e43f16be1d2614f18552956667ed3b33a1c36cf
- SSDEEP
  
  768:QTe7nd8qhYz3S228PmrW96Te2+p581R6HijH+EqvtK1EXoB1T1kNtuPmHCCjPkaH:Xm6Hh0KQWvhkZHCCrk
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence