d2c59f11b94fcbf38199956299a981465304313fe84480275a1140afa8c1758d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2c59f11b94fcbf38199956299a981465304313fe84480275a1140afa8c1758d
Size

280KB
Sample

221203-zamytage9v
MD5

7521939b5fe634451f9841aabb7a6cd9
SHA1

4a5fd5613193aa83979be564b75a4ef33d928225
SHA256

d2c59f11b94fcbf38199956299a981465304313fe84480275a1140afa8c1758d
SHA512

22a80c656c6054d57be2cd1c8288150560d9fa3557aa8f30b9a532aa9cf9665c6679706a9e771c6edee98877e378652e420c7a7aafb0bc2fa6c3042aadece451
SSDEEP

6144:oEdU/8ACe0K/fObT/bGiWr4YNUeLXKr96Ikd/FwJFBizYu90k36Wi:HdU/t0K/fObT/bGiCOrUIkZFMizYu90J

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  d2c59f11b94fcbf38199956299a981465304313fe84480275a1140afa8c1758d
- Size
  
  280KB
- MD5
  
  7521939b5fe634451f9841aabb7a6cd9
- SHA1
  
  4a5fd5613193aa83979be564b75a4ef33d928225
- SHA256
  
  d2c59f11b94fcbf38199956299a981465304313fe84480275a1140afa8c1758d
- SHA512
  
  22a80c656c6054d57be2cd1c8288150560d9fa3557aa8f30b9a532aa9cf9665c6679706a9e771c6edee98877e378652e420c7a7aafb0bc2fa6c3042aadece451
- SSDEEP
  
  6144:oEdU/8ACe0K/fObT/bGiWr4YNUeLXKr96Ikd/FwJFBizYu90k36Wi:HdU/t0K/fObT/bGiCOrUIkZFMizYu90J
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence