6b2ea8b2adedbc5d7eccbd9d0d8e0e6bca1350e6aaf5cf9351ffb65e8f547a2d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6c076123a16528436f39f76fce108111
Size

26KB
Sample

231226-nytkqafbdr
MD5

6c076123a16528436f39f76fce108111
SHA1

e273ab2de0e8dc06585e9a8f5ddcdedcc85bd351
SHA256

6b2ea8b2adedbc5d7eccbd9d0d8e0e6bca1350e6aaf5cf9351ffb65e8f547a2d
SHA512

159362163d1bbe59cf73b43490073dff64b6f75cbc2e481768912c2bc8bfd960879fa951339155cc4e371cabe60e78d1c4db10c174ff4fb481631c91b261e66c
SSDEEP

384:cwd1MYNzRbt0SUbk5ZKdaxudvA3unrN2W8HXVEu59uLS5U/ANpp4DkP5ez7mKq7b:cwtzRT7KwAA3Wd8HXVEu5TWY2E/vOa

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  6c076123a16528436f39f76fce108111
- Size
  
  26KB
- MD5
  
  6c076123a16528436f39f76fce108111
- SHA1
  
  e273ab2de0e8dc06585e9a8f5ddcdedcc85bd351
- SHA256
  
  6b2ea8b2adedbc5d7eccbd9d0d8e0e6bca1350e6aaf5cf9351ffb65e8f547a2d
- SHA512
  
  159362163d1bbe59cf73b43490073dff64b6f75cbc2e481768912c2bc8bfd960879fa951339155cc4e371cabe60e78d1c4db10c174ff4fb481631c91b261e66c
- SSDEEP
  
  384:cwd1MYNzRbt0SUbk5ZKdaxudvA3unrN2W8HXVEu59uLS5U/ANpp4DkP5ez7mKq7b:cwtzRT7KwAA3Wd8HXVEu5TWY2E/vOa
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence