91b6e416c42ba1cddb2c40d0672f6a0c86abdbcd13decbe38458e70bdee326c4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

91b6e416c42ba1cddb2c40d0672f6a0c86abdbcd13decbe38458e70bdee326c4
Size

189KB
Sample

221203-g7ygpsca66
MD5

712dda139c579465b25649e1f8e4f320
SHA1

f29886d6c6923ee8d35c5b98befcb373e1904c08
SHA256

91b6e416c42ba1cddb2c40d0672f6a0c86abdbcd13decbe38458e70bdee326c4
SHA512

cc2c58cd18a574a2a73c08aeadf0d6517017ce5d33f812e3ef7394fd885ad8b5e1be8e80cf7c3063cf669f5400bf0bef69fd5e13d6327f1963bfbeb84272f67c
SSDEEP

3072:JY9RxpZAD8xMLyen2RhuRtzd67Ur5XZFgrL1p2KXaCBuObo0z6hXu1EQE:ijpK8WLHnmunIIWL1Ee4OHdI

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  91b6e416c42ba1cddb2c40d0672f6a0c86abdbcd13decbe38458e70bdee326c4
- Size
  
  189KB
- MD5
  
  712dda139c579465b25649e1f8e4f320
- SHA1
  
  f29886d6c6923ee8d35c5b98befcb373e1904c08
- SHA256
  
  91b6e416c42ba1cddb2c40d0672f6a0c86abdbcd13decbe38458e70bdee326c4
- SHA512
  
  cc2c58cd18a574a2a73c08aeadf0d6517017ce5d33f812e3ef7394fd885ad8b5e1be8e80cf7c3063cf669f5400bf0bef69fd5e13d6327f1963bfbeb84272f67c
- SSDEEP
  
  3072:JY9RxpZAD8xMLyen2RhuRtzd67Ur5XZFgrL1p2KXaCBuObo0z6hXu1EQE:ijpK8WLHnmunIIWL1Ee4OHdI
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Creates new service(s)
  persistence
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

New Service

Registry Run Keys / Startup Folder

Privilege Escalation

New Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence