89abee95372353987f575f47caec6131e6d0496aad3548139c0df5ed6338596e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

89abee95372353987f575f47caec6131e6d0496aad3548139c0df5ed6338596e
Size

140KB
Sample

221205-mxdx7sfg9z
MD5

57fc3aefef9c34abc18b73028923b3d2
SHA1

4dcb8cd5d9c27d4c8006fb5ada95f8f358338fbf
SHA256

89abee95372353987f575f47caec6131e6d0496aad3548139c0df5ed6338596e
SHA512

f4a00c08b6fee94ea3e4fa6af47277a7cc28064b11703dc643239c8b495de089dd9ece39b9f4c8e2cc93dc18d009505febcaa73bd5370429ac3ec32a0003e83c
SSDEEP

768:z0tgxryt4pd04q0zik+vhy7g0EM/LinbQO2MGGmcBZ:oWeEn3+pCg0EUGQOfN

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  89abee95372353987f575f47caec6131e6d0496aad3548139c0df5ed6338596e
- Size
  
  140KB
- MD5
  
  57fc3aefef9c34abc18b73028923b3d2
- SHA1
  
  4dcb8cd5d9c27d4c8006fb5ada95f8f358338fbf
- SHA256
  
  89abee95372353987f575f47caec6131e6d0496aad3548139c0df5ed6338596e
- SHA512
  
  f4a00c08b6fee94ea3e4fa6af47277a7cc28064b11703dc643239c8b495de089dd9ece39b9f4c8e2cc93dc18d009505febcaa73bd5370429ac3ec32a0003e83c
- SSDEEP
  
  768:z0tgxryt4pd04q0zik+vhy7g0EM/LinbQO2MGGmcBZ:oWeEn3+pCg0EUGQOfN
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence