b6345fbf16ff0492c1e6aed97ed3c3becb822994c7a39b6f6ef8377e91087393 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b6345fbf16ff0492c1e6aed97ed3c3becb822994c7a39b6f6ef8377e91087393
Size

80KB
Sample

221207-dfnlmshf83
MD5

7839de16f73b559df65a7167513fb117
SHA1

faf362449dd609e158285354755d497de6b775e8
SHA256

b6345fbf16ff0492c1e6aed97ed3c3becb822994c7a39b6f6ef8377e91087393
SHA512

43795853842db16e07a65c93f01f2e2e48bddc3558d4a0ce2d5fc4e37558421f3cd7642eabac798da4012238eda6016daa3e48ab42d4e0fc06f4c8f7e58ebc3e
SSDEEP

768:KJLCdnMWUvcJOb4abke1/B/uBJK0KVMfsRyRFBoytfDN/SBnGHbAEUDTb:KSUkJiIeZNbirbAVb

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  b6345fbf16ff0492c1e6aed97ed3c3becb822994c7a39b6f6ef8377e91087393
- Size
  
  80KB
- MD5
  
  7839de16f73b559df65a7167513fb117
- SHA1
  
  faf362449dd609e158285354755d497de6b775e8
- SHA256
  
  b6345fbf16ff0492c1e6aed97ed3c3becb822994c7a39b6f6ef8377e91087393
- SHA512
  
  43795853842db16e07a65c93f01f2e2e48bddc3558d4a0ce2d5fc4e37558421f3cd7642eabac798da4012238eda6016daa3e48ab42d4e0fc06f4c8f7e58ebc3e
- SSDEEP
  
  768:KJLCdnMWUvcJOb4abke1/B/uBJK0KVMfsRyRFBoytfDN/SBnGHbAEUDTb:KSUkJiIeZNbirbAVb
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence