98fd1ee8d748bc48004d5eea57842e0a78ec8b19ae0fc934451a97293ebcb72a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

98fd1ee8d748bc48004d5eea57842e0a78ec8b19ae0fc934451a97293ebcb72a
Size

116KB
Sample

221202-x4wrpsag7z
MD5

52bf1ea0c4232e3de7f14dfed7122599
SHA1

4a7f2ff38c6a6713ac44ad7c8e9ed3ecde8b122d
SHA256

98fd1ee8d748bc48004d5eea57842e0a78ec8b19ae0fc934451a97293ebcb72a
SHA512

29d5d328a337d3687b2ec9b86dfe0841542c08ab0d3a97b3d9d7e33cadeca028e04639c1a91ad7f8195a9e236d124272857934e36452acb05320152967d71795
SSDEEP

1536:14pxoB++PL8Kw6KBOIW4Z8HO1Zwt0f4HeDUEdMOPy9sbgNWwo7JaSU:6pj+PLfIr1ZNDUEdvwQG

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  98fd1ee8d748bc48004d5eea57842e0a78ec8b19ae0fc934451a97293ebcb72a
- Size
  
  116KB
- MD5
  
  52bf1ea0c4232e3de7f14dfed7122599
- SHA1
  
  4a7f2ff38c6a6713ac44ad7c8e9ed3ecde8b122d
- SHA256
  
  98fd1ee8d748bc48004d5eea57842e0a78ec8b19ae0fc934451a97293ebcb72a
- SHA512
  
  29d5d328a337d3687b2ec9b86dfe0841542c08ab0d3a97b3d9d7e33cadeca028e04639c1a91ad7f8195a9e236d124272857934e36452acb05320152967d71795
- SSDEEP
  
  1536:14pxoB++PL8Kw6KBOIW4Z8HO1Zwt0f4HeDUEdMOPy9sbgNWwo7JaSU:6pj+PLfIr1ZNDUEdvwQG
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence