96e8ff32d455ed10198542332391f8cfd91bd403086045cfdafc6ce9bc6252aa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

96e8ff32d455ed10198542332391f8cfd91bd403086045cfdafc6ce9bc6252aa
Size

679KB
Sample

221201-lk6xsaeg47
MD5

3a8a0d65fa3e52f73978210ab2ba487c
SHA1

8046b982bb15a898b765f4f16b952cb7846da8e0
SHA256

96e8ff32d455ed10198542332391f8cfd91bd403086045cfdafc6ce9bc6252aa
SHA512

01778f1ee17cafafdaa950ee27bb7a9c966275ebd948353679393b85df7ac446f8cf82bc5c83ff2970aa72cc2119b1ab2ab66b418ac3d7968aff625e2293921a
SSDEEP

12288:r5ZjyGV5Icn3xiHb3P335dwYh5e/3xeKwRyEJg+AQGztLcLhH2REmQ5+GDWFnStj:1ZjyBc38LfIYTkxeKKycXLoppGDWlSuO

Score

8^/10

evasion

Malware Config

Targets

- Target
  
  96e8ff32d455ed10198542332391f8cfd91bd403086045cfdafc6ce9bc6252aa
- Size
  
  679KB
- MD5
  
  3a8a0d65fa3e52f73978210ab2ba487c
- SHA1
  
  8046b982bb15a898b765f4f16b952cb7846da8e0
- SHA256
  
  96e8ff32d455ed10198542332391f8cfd91bd403086045cfdafc6ce9bc6252aa
- SHA512
  
  01778f1ee17cafafdaa950ee27bb7a9c966275ebd948353679393b85df7ac446f8cf82bc5c83ff2970aa72cc2119b1ab2ab66b418ac3d7968aff625e2293921a
- SSDEEP
  
  12288:r5ZjyGV5Icn3xiHb3P335dwYh5e/3xeKwRyEJg+AQGztLcLhH2REmQ5+GDWFnStj:1ZjyBc38LfIYTkxeKKycXLoppGDWlSuO
Score

8^/10

evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2