6db6749f03c5b956eac56d9dde946fecee0f32b72cb7fed0ab6c35b644496bb6 | Triage

Sharing

General

Target

6db6749f03c5b956eac56d9dde946fecee0f32b72cb7fed0ab6c35b644496bb6
Size

227KB
Sample

221127-s9943add4s
MD5

e3a88776e473d8108087c5ceeba8acf3
SHA1

e7eb682ea163c5a4f326609018df5c6429966a7d
SHA256

6db6749f03c5b956eac56d9dde946fecee0f32b72cb7fed0ab6c35b644496bb6
SHA512

4606f8cdab78f2e6de5f7d166cbc4477bd57a05f063597c4f6b41d7136f896b393d846caf169b5decad94c723821749c0f18da4ce101a28a6bc0cbea7c28059d
SSDEEP

3072:sREEC2Oi8NXC797F8TBfFvj4bq57uiGf/BKTgTgKo2FHC9qSEHn4F/ob:sxC2F8NXC796TB9vj48UJTTg7HOb

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  6db6749f03c5b956eac56d9dde946fecee0f32b72cb7fed0ab6c35b644496bb6
- Size
  
  227KB
- MD5
  
  e3a88776e473d8108087c5ceeba8acf3
- SHA1
  
  e7eb682ea163c5a4f326609018df5c6429966a7d
- SHA256
  
  6db6749f03c5b956eac56d9dde946fecee0f32b72cb7fed0ab6c35b644496bb6
- SHA512
  
  4606f8cdab78f2e6de5f7d166cbc4477bd57a05f063597c4f6b41d7136f896b393d846caf169b5decad94c723821749c0f18da4ce101a28a6bc0cbea7c28059d
- SSDEEP
  
  3072:sREEC2Oi8NXC797F8TBfFvj4bq57uiGf/BKTgTgKo2FHC9qSEHn4F/ob:sxC2F8NXC796TB9vj48UJTTg7HOb
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence