d12586c68ec1f37bad5eb40c6de009533fa442d64480adcc4927aef0bdf5e774 | Triage

Sharing

General

Target

d12586c68ec1f37bad5eb40c6de009533fa442d64480adcc4927aef0bdf5e774
Size

140KB
Sample

221205-3dyfhagc67
MD5

325b031a3838f67b41750bc370a9d4ad
SHA1

0f549752c79680c0a170912f9957bd973f4ff2f4
SHA256

d12586c68ec1f37bad5eb40c6de009533fa442d64480adcc4927aef0bdf5e774
SHA512

b1d01fcbcdde47edac15afefa90a7553a41595a79ef2e9da6e33fa5da3551d6a9e1b58271ac894e5011e871cf279d245d5565fdffbac81cf742d7880f4365631
SSDEEP

3072:Pl2rgluJmkD73mQtFDPB1P85XvbM7h8bdaqmRIxqeHHNMxijYQ:Psr6uJ/72QtFDPB1P85Xvw7h8boqfqeN

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  d12586c68ec1f37bad5eb40c6de009533fa442d64480adcc4927aef0bdf5e774
- Size
  
  140KB
- MD5
  
  325b031a3838f67b41750bc370a9d4ad
- SHA1
  
  0f549752c79680c0a170912f9957bd973f4ff2f4
- SHA256
  
  d12586c68ec1f37bad5eb40c6de009533fa442d64480adcc4927aef0bdf5e774
- SHA512
  
  b1d01fcbcdde47edac15afefa90a7553a41595a79ef2e9da6e33fa5da3551d6a9e1b58271ac894e5011e871cf279d245d5565fdffbac81cf742d7880f4365631
- SSDEEP
  
  3072:Pl2rgluJmkD73mQtFDPB1P85XvbM7h8bdaqmRIxqeHHNMxijYQ:Psr6uJ/72QtFDPB1P85Xvw7h8boqfqeN
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence