8d23b1649bb19dd0a7a5f3ffba401e177cded508385caa9d1f266d2628c3b311 | Triage

Sharing

General

Target

8d23b1649bb19dd0a7a5f3ffba401e177cded508385caa9d1f266d2628c3b311
Size

204KB
Sample

221205-lq1mysgb98
MD5

8f97132303b5bf9f71f5a31a5ef2cc51
SHA1

62bcf1040405e903decc4a913e0bcd4601f1917c
SHA256

8d23b1649bb19dd0a7a5f3ffba401e177cded508385caa9d1f266d2628c3b311
SHA512

6a41fc82e1d3b7d1c8b497680e8a3030d0eb64f66360e770fe272b163050de242d33b251c4963010d5a79e6c05ddd1af8c96bafbe3dcb43fe7aaffccbf3fde67
SSDEEP

1536:PO+OonHo1vzxHwx/kxNy3tQ9CW5EZWHakMwP9W6uXNh9h1AWa11GBPIdRONd+w6G:VHo1F0tQ9nLHbB9WTk9+Jgqmltri

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  8d23b1649bb19dd0a7a5f3ffba401e177cded508385caa9d1f266d2628c3b311
- Size
  
  204KB
- MD5
  
  8f97132303b5bf9f71f5a31a5ef2cc51
- SHA1
  
  62bcf1040405e903decc4a913e0bcd4601f1917c
- SHA256
  
  8d23b1649bb19dd0a7a5f3ffba401e177cded508385caa9d1f266d2628c3b311
- SHA512
  
  6a41fc82e1d3b7d1c8b497680e8a3030d0eb64f66360e770fe272b163050de242d33b251c4963010d5a79e6c05ddd1af8c96bafbe3dcb43fe7aaffccbf3fde67
- SSDEEP
  
  1536:PO+OonHo1vzxHwx/kxNy3tQ9CW5EZWHakMwP9W6uXNh9h1AWa11GBPIdRONd+w6G:VHo1F0tQ9nLHbB9WTk9+Jgqmltri
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence