e2e6b35ca841539c8ff18ab908a1ecc1d13935be822966e0cdf663234f713c5b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e2e6b35ca841539c8ff18ab908a1ecc1d13935be822966e0cdf663234f713c5b
Size

124KB
Sample

221205-xj31aafd44
MD5

3283310dabd8218bc05c2e00a5a0db4e
SHA1

9e29595e7f88e23616085be45bcd014323c69de2
SHA256

e2e6b35ca841539c8ff18ab908a1ecc1d13935be822966e0cdf663234f713c5b
SHA512

ee0e9931eebc321c0f5e4df903cb5075dff35bf465770cf2d85f46aa179d9ef6ce2a95b3af53ea69c4b19f7b1808ab3af2ada6bfc206a84c40301bb5c20c845d
SSDEEP

1536:XMENhwRQuBxeDtMYHa27J14ltxporZ45i8NeG0h/l:8ENhwRQkeV6gJ1uCt45yt

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  e2e6b35ca841539c8ff18ab908a1ecc1d13935be822966e0cdf663234f713c5b
- Size
  
  124KB
- MD5
  
  3283310dabd8218bc05c2e00a5a0db4e
- SHA1
  
  9e29595e7f88e23616085be45bcd014323c69de2
- SHA256
  
  e2e6b35ca841539c8ff18ab908a1ecc1d13935be822966e0cdf663234f713c5b
- SHA512
  
  ee0e9931eebc321c0f5e4df903cb5075dff35bf465770cf2d85f46aa179d9ef6ce2a95b3af53ea69c4b19f7b1808ab3af2ada6bfc206a84c40301bb5c20c845d
- SSDEEP
  
  1536:XMENhwRQuBxeDtMYHa27J14ltxporZ45i8NeG0h/l:8ENhwRQkeV6gJ1uCt45yt
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence