b2f0e158b12a041a617b6287fafdeba7b91994db225b73a6002dc6b544d4c0ed | Triage

Sharing

General

Target

0bac6e23671f8f591d3329f527369d9b
Size

475KB
Sample

231225-g834ksfde6
MD5

0bac6e23671f8f591d3329f527369d9b
SHA1

adf0579b98b0bcb62e3e853ed260d0c8adb39969
SHA256

b2f0e158b12a041a617b6287fafdeba7b91994db225b73a6002dc6b544d4c0ed
SHA512

f85fa63e907d469475347bb3d665289a3e8666cf75733fe2483d0362a7e3619fc3a1894e5d5f3125a7a7ba5550eebb265f76f49606ac24c426311fb2f0976f82
SSDEEP

3072:+HXzNlUR5SeeL84Gezv7F36LvFBWFCfsiSim4XzPJm0:+DNi5qtLQ5BPsKm4Xv

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  0bac6e23671f8f591d3329f527369d9b
- Size
  
  475KB
- MD5
  
  0bac6e23671f8f591d3329f527369d9b
- SHA1
  
  adf0579b98b0bcb62e3e853ed260d0c8adb39969
- SHA256
  
  b2f0e158b12a041a617b6287fafdeba7b91994db225b73a6002dc6b544d4c0ed
- SHA512
  
  f85fa63e907d469475347bb3d665289a3e8666cf75733fe2483d0362a7e3619fc3a1894e5d5f3125a7a7ba5550eebb265f76f49606ac24c426311fb2f0976f82
- SSDEEP
  
  3072:+HXzNlUR5SeeL84Gezv7F36LvFBWFCfsiSim4XzPJm0:+DNi5qtLQ5BPsKm4Xv
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence