e3f5c9e568f9d6def4089a4f4b7a8984843620386d76ef7324a5d7b241ffba97 | Triage

Sharing

General

Target

e3f5c9e568f9d6def4089a4f4b7a8984843620386d76ef7324a5d7b241ffba97
Size

240KB
Sample

221129-vel5vsgc42
MD5

e1ad7b0743a02f8260f66bac0ee97ae4
SHA1

3340a103d0d700572e4c7833cb9155c974cecaf3
SHA256

e3f5c9e568f9d6def4089a4f4b7a8984843620386d76ef7324a5d7b241ffba97
SHA512

6a803aece84f741fc7618662ee18ea8a93cfcf7cc2d9565fce211456ddc2f18fc3f4a466d36815179d67a6c88a9bb53c035e010d83dba34f8adb8539cd99e69e
SSDEEP

6144:zUT3dwqsNwemAB0EqxF6snji81RUinKchhyLSQ:ydQQJsG

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  e3f5c9e568f9d6def4089a4f4b7a8984843620386d76ef7324a5d7b241ffba97
- Size
  
  240KB
- MD5
  
  e1ad7b0743a02f8260f66bac0ee97ae4
- SHA1
  
  3340a103d0d700572e4c7833cb9155c974cecaf3
- SHA256
  
  e3f5c9e568f9d6def4089a4f4b7a8984843620386d76ef7324a5d7b241ffba97
- SHA512
  
  6a803aece84f741fc7618662ee18ea8a93cfcf7cc2d9565fce211456ddc2f18fc3f4a466d36815179d67a6c88a9bb53c035e010d83dba34f8adb8539cd99e69e
- SSDEEP
  
  6144:zUT3dwqsNwemAB0EqxF6snji81RUinKchhyLSQ:ydQQJsG
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence