dad9a17f44500c0a637265976ff1fb7895d2dc8908ec69487a16b6c19953ab5f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dad9a17f44500c0a637265976ff1fb7895d2dc8908ec69487a16b6c19953ab5f
Size

168KB
Sample

221204-npn9msaa91
MD5

0dbbd90c548f2a9606012aef4ecb4700
SHA1

65d2a4866bcebbbd6b5841a17abb477c4af63468
SHA256

dad9a17f44500c0a637265976ff1fb7895d2dc8908ec69487a16b6c19953ab5f
SHA512

daa3edc2c0833cc6671e65df562278d77ca2aaa4404711d415a093dad055100d1ddab84385744ec4b5cf2c1e572bd0c9f2bbe9db1735f4b213bd22c1012cc4ab
SSDEEP

1536:HeR5LcmJPqPezTGRVu+1niPRC7gIeTo8dzQhihZOy+AMnmE7UkAXJZvhICqDojB:emiPqPezTGRVuI7bkzrhT+nmEx+

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  dad9a17f44500c0a637265976ff1fb7895d2dc8908ec69487a16b6c19953ab5f
- Size
  
  168KB
- MD5
  
  0dbbd90c548f2a9606012aef4ecb4700
- SHA1
  
  65d2a4866bcebbbd6b5841a17abb477c4af63468
- SHA256
  
  dad9a17f44500c0a637265976ff1fb7895d2dc8908ec69487a16b6c19953ab5f
- SHA512
  
  daa3edc2c0833cc6671e65df562278d77ca2aaa4404711d415a093dad055100d1ddab84385744ec4b5cf2c1e572bd0c9f2bbe9db1735f4b213bd22c1012cc4ab
- SSDEEP
  
  1536:HeR5LcmJPqPezTGRVu+1niPRC7gIeTo8dzQhihZOy+AMnmE7UkAXJZvhICqDojB:emiPqPezTGRVuI7bkzrhT+nmEx+
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence