bc5ea26a9f27f990b992b1c28591fa2143d0beede9d40be953399841685045a9 | Triage

Sharing

General

Target

bc5ea26a9f27f990b992b1c28591fa2143d0beede9d40be953399841685045a9
Size

252KB
Sample

221205-3j3meabe4x
MD5

7817e9916ec1220c8fe5a50694e3b12f
SHA1

646a5df1fb51a56c097221ed9064a5209cf0890f
SHA256

bc5ea26a9f27f990b992b1c28591fa2143d0beede9d40be953399841685045a9
SHA512

4f6d107b174fd563b4049c6eb66a8afdfd204d7d162ee7212cdad451e2c5b132e4d192b4ba5a869e1073c9934556b97c90549409287109d1e893f670a52f6e6a
SSDEEP

3072:VrAcbx7La0sWvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKtjtv:VrfFx/ZLA4PmG6dR

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  bc5ea26a9f27f990b992b1c28591fa2143d0beede9d40be953399841685045a9
- Size
  
  252KB
- MD5
  
  7817e9916ec1220c8fe5a50694e3b12f
- SHA1
  
  646a5df1fb51a56c097221ed9064a5209cf0890f
- SHA256
  
  bc5ea26a9f27f990b992b1c28591fa2143d0beede9d40be953399841685045a9
- SHA512
  
  4f6d107b174fd563b4049c6eb66a8afdfd204d7d162ee7212cdad451e2c5b132e4d192b4ba5a869e1073c9934556b97c90549409287109d1e893f670a52f6e6a
- SSDEEP
  
  3072:VrAcbx7La0sWvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKtjtv:VrfFx/ZLA4PmG6dR
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence