a6665ef5ef8dff1e1fba2d0488b5994a05e5cffc2d806913afbd66267df47486 | Triage

Sharing

General

Target

a6665ef5ef8dff1e1fba2d0488b5994a05e5cffc2d806913afbd66267df47486
Size

104KB
Sample

221205-llff8abe7w
MD5

bcd3608e63b398383f4fedbc6d62bfa7
SHA1

35bf12d00552ae4254db2c958f3a611ef3883a2b
SHA256

a6665ef5ef8dff1e1fba2d0488b5994a05e5cffc2d806913afbd66267df47486
SHA512

34f70ef0099f8cc52927a3970ba0c0b952dc7eb597a34ac2145740b7da3ed775d868f622029b8ab08007ad796689f31e8458631eaabc97c65ae4f201fe080855
SSDEEP

1536:8uLRvx+uYGs+HBchhQKNIqpOcQv0sTEFSocRoXjLl0Ii:DK+eiKNZJQv0sT5o3mIi

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  a6665ef5ef8dff1e1fba2d0488b5994a05e5cffc2d806913afbd66267df47486
- Size
  
  104KB
- MD5
  
  bcd3608e63b398383f4fedbc6d62bfa7
- SHA1
  
  35bf12d00552ae4254db2c958f3a611ef3883a2b
- SHA256
  
  a6665ef5ef8dff1e1fba2d0488b5994a05e5cffc2d806913afbd66267df47486
- SHA512
  
  34f70ef0099f8cc52927a3970ba0c0b952dc7eb597a34ac2145740b7da3ed775d868f622029b8ab08007ad796689f31e8458631eaabc97c65ae4f201fe080855
- SSDEEP
  
  1536:8uLRvx+uYGs+HBchhQKNIqpOcQv0sTEFSocRoXjLl0Ii:DK+eiKNZJQv0sT5o3mIi
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence