a0dcedb74bab740eb05a6e7c6e9a31481d5480c2d7c039a8fac0f3f2311bb879 | Triage

Sharing

General

Target

a0dcedb74bab740eb05a6e7c6e9a31481d5480c2d7c039a8fac0f3f2311bb879
Size

153KB
Sample

221203-tx6rjsba8z
MD5

5b1931b78644abc16bbd7e8b6269b3ff
SHA1

fb7447b14920670f579ff42fb69d4f2fc29ec757
SHA256

a0dcedb74bab740eb05a6e7c6e9a31481d5480c2d7c039a8fac0f3f2311bb879
SHA512

84ad29c54448fb372114b635b92e9c3f04d8970807492589ed5991917ff1b061655ddbe795807691e55ca5cd406060adb50df6e43fb1d963b1d38c31523221ce
SSDEEP

3072:oLv3G9oX0gJNHHHHHLXXXXXX7rXXXSsnBSpFuFqkD6gZemy1ndT5ml:8GrgJNHHHHHLXXXXXX7rXXXSsnk4qcy3

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  a0dcedb74bab740eb05a6e7c6e9a31481d5480c2d7c039a8fac0f3f2311bb879
- Size
  
  153KB
- MD5
  
  5b1931b78644abc16bbd7e8b6269b3ff
- SHA1
  
  fb7447b14920670f579ff42fb69d4f2fc29ec757
- SHA256
  
  a0dcedb74bab740eb05a6e7c6e9a31481d5480c2d7c039a8fac0f3f2311bb879
- SHA512
  
  84ad29c54448fb372114b635b92e9c3f04d8970807492589ed5991917ff1b061655ddbe795807691e55ca5cd406060adb50df6e43fb1d963b1d38c31523221ce
- SSDEEP
  
  3072:oLv3G9oX0gJNHHHHHLXXXXXX7rXXXSsnBSpFuFqkD6gZemy1ndT5ml:8GrgJNHHHHHLXXXXXX7rXXXSsnk4qcy3
Score

8^/10

persistence
- Modifies AppInit DLL entries
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2