f5409128bde9c06dbd832bf833868d786ff46769e6f16971b579f735f2f910d4 | Triage

Sharing

General

Target

f5409128bde9c06dbd832bf833868d786ff46769e6f16971b579f735f2f910d4
Size

192KB
Sample

221205-k7c3jsec75
MD5

004918ec7b16999ede2e98283bc6ff57
SHA1

18d6a56675b8851fe1e96a169caa689ff5e653a8
SHA256

f5409128bde9c06dbd832bf833868d786ff46769e6f16971b579f735f2f910d4
SHA512

b10f3005fd9af68dac554436ea19336d12d9858174eaca8d4ae2b39bcdf17225f167b8de5e7b72381c7367752571faf0fd4528a77e6695017371f806553f4acd
SSDEEP

3072:PJ1ZuCWv2JQcFBKBJy6apbuD2VMbj1hlUywVbo9lk:PxBWvUFIJlapu2V21r/di

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  f5409128bde9c06dbd832bf833868d786ff46769e6f16971b579f735f2f910d4
- Size
  
  192KB
- MD5
  
  004918ec7b16999ede2e98283bc6ff57
- SHA1
  
  18d6a56675b8851fe1e96a169caa689ff5e653a8
- SHA256
  
  f5409128bde9c06dbd832bf833868d786ff46769e6f16971b579f735f2f910d4
- SHA512
  
  b10f3005fd9af68dac554436ea19336d12d9858174eaca8d4ae2b39bcdf17225f167b8de5e7b72381c7367752571faf0fd4528a77e6695017371f806553f4acd
- SSDEEP
  
  3072:PJ1ZuCWv2JQcFBKBJy6apbuD2VMbj1hlUywVbo9lk:PxBWvUFIJlapu2V21r/di
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence