a323acd0f0ab73ef66b807a7de3c8e9f097b0f1f013c6afa8be219279e59c3f3 | Triage

Sharing

General

Target

a323acd0f0ab73ef66b807a7de3c8e9f097b0f1f013c6afa8be219279e59c3f3
Size

136KB
Sample

221129-vxdanshh83
MD5

199f40acfc4799b32937e6be767ddcf8
SHA1

bc6145339b039a1ef9c14f330d740b27249ee27d
SHA256

a323acd0f0ab73ef66b807a7de3c8e9f097b0f1f013c6afa8be219279e59c3f3
SHA512

d43052117aa073c9895da23f626208386b9cdfbca0541933620c05f675ef8b50d65ea4c400a332b67248f837321b0192f9cd57a3c66d2d38288028beada8d586
SSDEEP

1536:YHJkaBeBVL5nPn5QaTNUbaxaZ65gX4Pv9u2y0aZAbs/nLziow28fz+DliO3MxsaA:Da4VIkUbaxHg+g/nvif7hsAMWgd

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  a323acd0f0ab73ef66b807a7de3c8e9f097b0f1f013c6afa8be219279e59c3f3
- Size
  
  136KB
- MD5
  
  199f40acfc4799b32937e6be767ddcf8
- SHA1
  
  bc6145339b039a1ef9c14f330d740b27249ee27d
- SHA256
  
  a323acd0f0ab73ef66b807a7de3c8e9f097b0f1f013c6afa8be219279e59c3f3
- SHA512
  
  d43052117aa073c9895da23f626208386b9cdfbca0541933620c05f675ef8b50d65ea4c400a332b67248f837321b0192f9cd57a3c66d2d38288028beada8d586
- SSDEEP
  
  1536:YHJkaBeBVL5nPn5QaTNUbaxaZ65gX4Pv9u2y0aZAbs/nLziow28fz+DliO3MxsaA:Da4VIkUbaxHg+g/nvif7hsAMWgd
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence