643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6
Size

224KB
Sample

221129-dh5ypsdc7z
MD5

3c2ef0d4fde81145e0fb5a7bc0bb3820
SHA1

f7e3a90b157068d27a188d12bcf21d8880792752
SHA256

643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6
SHA512

7f62f57731aa76b960b0f7761438808841871619e643e875e8124aa7f1ea40e96b61da24d3f4f2f6a86bcef2dbefa8b608e2a1fac3e9e981a8281e803f87d40b
SSDEEP

3072:eXyqNsMoBuvZVpl2mclbj4Uvx+8ysNOu+2eRcKksU61JkkX39RLrw4ySKUbax2+Q:BqN5Xp4LnbmlrZ48

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6
- Size
  
  224KB
- MD5
  
  3c2ef0d4fde81145e0fb5a7bc0bb3820
- SHA1
  
  f7e3a90b157068d27a188d12bcf21d8880792752
- SHA256
  
  643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6
- SHA512
  
  7f62f57731aa76b960b0f7761438808841871619e643e875e8124aa7f1ea40e96b61da24d3f4f2f6a86bcef2dbefa8b608e2a1fac3e9e981a8281e803f87d40b
- SSDEEP
  
  3072:eXyqNsMoBuvZVpl2mclbj4Uvx+8ysNOu+2eRcKksU61JkkX39RLrw4ySKUbax2+Q:BqN5Xp4LnbmlrZ48
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence