ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198 | Triage

Sharing

General

Target

ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198
Size

68KB
Sample

221127-151ntscf77
MD5

bd31cfeab12564dea424d85e8693efd7
SHA1

51cddee3c82490b0b142f80aeaf9c30e967d41c9
SHA256

ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198
SHA512

165d5cadac3bb17e46b91df9ed68354e20aad51697e2d3bda5599d58f5424db409c5104d696ece675e692c305913679a7897ee6438a436a4f508fe49746725b7
SSDEEP

768:FctliTd6CAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:itIx9AcqOK3qowgnt1d

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198
- Size
  
  68KB
- MD5
  
  bd31cfeab12564dea424d85e8693efd7
- SHA1
  
  51cddee3c82490b0b142f80aeaf9c30e967d41c9
- SHA256
  
  ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198
- SHA512
  
  165d5cadac3bb17e46b91df9ed68354e20aad51697e2d3bda5599d58f5424db409c5104d696ece675e692c305913679a7897ee6438a436a4f508fe49746725b7
- SSDEEP
  
  768:FctliTd6CAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:itIx9AcqOK3qowgnt1d
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence