b19cbfe8ad26d44bc346c3251430ae954db72c05ece59f67af4dc2a90142147a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b19cbfe8ad26d44bc346c3251430ae954db72c05ece59f67af4dc2a90142147a
Size

306KB
Sample

221205-tyg5ksfg22
MD5

efd8015de0470434ce85ba7276790bdc
SHA1

83ab94a198e3aa6a15601af181dc4aa4ec16ed28
SHA256

b19cbfe8ad26d44bc346c3251430ae954db72c05ece59f67af4dc2a90142147a
SHA512

d9c0c949b70824fadd599f5156fda721bf7b765452b6f8be6c8ad994ed8fb61c168a13043f93ef18305ede5f6b831ee21fa5a320ecd57ff4b929e5b38ba5e378
SSDEEP

6144:MW57hEh0jrC9D0mkFYKFc1eOOhszmzwn8429:M47scbLyHzzB84a

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  b19cbfe8ad26d44bc346c3251430ae954db72c05ece59f67af4dc2a90142147a
- Size
  
  306KB
- MD5
  
  efd8015de0470434ce85ba7276790bdc
- SHA1
  
  83ab94a198e3aa6a15601af181dc4aa4ec16ed28
- SHA256
  
  b19cbfe8ad26d44bc346c3251430ae954db72c05ece59f67af4dc2a90142147a
- SHA512
  
  d9c0c949b70824fadd599f5156fda721bf7b765452b6f8be6c8ad994ed8fb61c168a13043f93ef18305ede5f6b831ee21fa5a320ecd57ff4b929e5b38ba5e378
- SSDEEP
  
  6144:MW57hEh0jrC9D0mkFYKFc1eOOhszmzwn8429:M47scbLyHzzB84a
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence