8585b3773fc59d175694f0cc0e5c732fa6f53c996b575d2dfbeecd3864d95f8f | Triage

Sharing

General

Target

8585b3773fc59d175694f0cc0e5c732fa6f53c996b575d2dfbeecd3864d95f8f
Size

168KB
Sample

221204-npzelsab3y
MD5

149ffeb49d77a1b780c65f009e5a4130
SHA1

2a4abece8ffb60a710d241e9e18e0766063ee04e
SHA256

8585b3773fc59d175694f0cc0e5c732fa6f53c996b575d2dfbeecd3864d95f8f
SHA512

3101f4effcf12235b74d55c80bb667d080a0267dcbd46b96ea165e0e877ee04fdd0d1d7a19346c228f3bcf460edf333da0b27130a46ba742d47744845c5bd16a
SSDEEP

1536:He55LcmJPqPAecxazTGRVu+1niPRC7gIeTo8dzQhihZOy+AMnmE7UkAXJZvhICqK:GmiPqPRzTGRVuI7bkzrhT+nmEx+

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  8585b3773fc59d175694f0cc0e5c732fa6f53c996b575d2dfbeecd3864d95f8f
- Size
  
  168KB
- MD5
  
  149ffeb49d77a1b780c65f009e5a4130
- SHA1
  
  2a4abece8ffb60a710d241e9e18e0766063ee04e
- SHA256
  
  8585b3773fc59d175694f0cc0e5c732fa6f53c996b575d2dfbeecd3864d95f8f
- SHA512
  
  3101f4effcf12235b74d55c80bb667d080a0267dcbd46b96ea165e0e877ee04fdd0d1d7a19346c228f3bcf460edf333da0b27130a46ba742d47744845c5bd16a
- SSDEEP
  
  1536:He55LcmJPqPAecxazTGRVu+1niPRC7gIeTo8dzQhihZOy+AMnmE7UkAXJZvhICqK:GmiPqPRzTGRVuI7bkzrhT+nmEx+
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence