ef6e73126215aa762d31060d8e32dad6b2b64e6234a2346a25fc7ded4db0ad95 | Triage

Sharing

General

Target

ef6e73126215aa762d31060d8e32dad6b2b64e6234a2346a25fc7ded4db0ad95
Size

252KB
Sample

221129-dla8haaa26
MD5

e2e6f9046f5dcf8def8dc67e55817396
SHA1

6ccd67be2c847889645f677624756850ec1c8e23
SHA256

ef6e73126215aa762d31060d8e32dad6b2b64e6234a2346a25fc7ded4db0ad95
SHA512

4d59c9c006eedc7dc013edd2fbea452ae28dfdc700b6ae1ff1c5046aeeebcd43b2803d00cc29cbd655d3f46692becf4b5d236da1820c20f6d0aba8fc7b2dac7e
SSDEEP

3072:VrAcYx7La/sWvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKGjv9:Vr3Fx/ZLA4PmG6dS

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  ef6e73126215aa762d31060d8e32dad6b2b64e6234a2346a25fc7ded4db0ad95
- Size
  
  252KB
- MD5
  
  e2e6f9046f5dcf8def8dc67e55817396
- SHA1
  
  6ccd67be2c847889645f677624756850ec1c8e23
- SHA256
  
  ef6e73126215aa762d31060d8e32dad6b2b64e6234a2346a25fc7ded4db0ad95
- SHA512
  
  4d59c9c006eedc7dc013edd2fbea452ae28dfdc700b6ae1ff1c5046aeeebcd43b2803d00cc29cbd655d3f46692becf4b5d236da1820c20f6d0aba8fc7b2dac7e
- SSDEEP
  
  3072:VrAcYx7La/sWvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKGjv9:Vr3Fx/ZLA4PmG6dS
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence