b37550c48c6ecdc00d4961383fe3a5bdf154372f4aa7f1197f5ef4f413cce6e4 | Triage

Sharing

General

Target

b37550c48c6ecdc00d4961383fe3a5bdf154372f4aa7f1197f5ef4f413cce6e4
Size

172KB
Sample

221129-dt46jsag26
MD5

b701923a0ba7c320677d156ab8ae5997
SHA1

d632752a435d204415bf3bded8da30ae874d9474
SHA256

b37550c48c6ecdc00d4961383fe3a5bdf154372f4aa7f1197f5ef4f413cce6e4
SHA512

ff09e3695e78f47a5a3f73a2f33682967f71aec71dc9b93655f13bfd381ff95370b1187f2cdefadc51b6071c837523a2c41abf20ab45dc1c98735f2d5a4ea577
SSDEEP

1536:ydSNkv6uTeKHCa0SfHB2QmB8itdmcZYfO+1UOWlNLeYZrLf+1u3df/jT6pxZJWtr:OLv6KHJdkvY2+ydeYMvnWtmpzaVmS1/

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  b37550c48c6ecdc00d4961383fe3a5bdf154372f4aa7f1197f5ef4f413cce6e4
- Size
  
  172KB
- MD5
  
  b701923a0ba7c320677d156ab8ae5997
- SHA1
  
  d632752a435d204415bf3bded8da30ae874d9474
- SHA256
  
  b37550c48c6ecdc00d4961383fe3a5bdf154372f4aa7f1197f5ef4f413cce6e4
- SHA512
  
  ff09e3695e78f47a5a3f73a2f33682967f71aec71dc9b93655f13bfd381ff95370b1187f2cdefadc51b6071c837523a2c41abf20ab45dc1c98735f2d5a4ea577
- SSDEEP
  
  1536:ydSNkv6uTeKHCa0SfHB2QmB8itdmcZYfO+1UOWlNLeYZrLf+1u3df/jT6pxZJWtr:OLv6KHJdkvY2+ydeYMvnWtmpzaVmS1/
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence