d6a53bebed53a8cd777eb74dfa83ccc1d9245a64bb94bb33fe89683ea13a48d9 | Triage

Sharing

General

Target

NEAS.d95b1f4b81b920263521f4488ff25e60.exe
Size

336KB
Sample

231103-nbxzmabd22
MD5

d95b1f4b81b920263521f4488ff25e60
SHA1

f1454eb520ec9d8adfbb0ce3b2dbc4a0bbf6ceba
SHA256

d6a53bebed53a8cd777eb74dfa83ccc1d9245a64bb94bb33fe89683ea13a48d9
SHA512

274bfef0144ad8facb0ee8fa2eec6fb7221378ee2b04d81e2e4d97e4f2e94823271a7110cf0f912ea52e7a9b580e51b0e48786b30c24a46271ee0dc87357f2a7
SSDEEP

6144:JwsqVuSBprODt4G0cYCZRolJlpmBpzwsqVu8:H/0cYCZRolJloe

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  NEAS.d95b1f4b81b920263521f4488ff25e60.exe
- Size
  
  336KB
- MD5
  
  d95b1f4b81b920263521f4488ff25e60
- SHA1
  
  f1454eb520ec9d8adfbb0ce3b2dbc4a0bbf6ceba
- SHA256
  
  d6a53bebed53a8cd777eb74dfa83ccc1d9245a64bb94bb33fe89683ea13a48d9
- SHA512
  
  274bfef0144ad8facb0ee8fa2eec6fb7221378ee2b04d81e2e4d97e4f2e94823271a7110cf0f912ea52e7a9b580e51b0e48786b30c24a46271ee0dc87357f2a7
- SSDEEP
  
  6144:JwsqVuSBprODt4G0cYCZRolJlpmBpzwsqVu8:H/0cYCZRolJloe
Score

10^/10

evasion persistence trojan
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan