210f98b944421ed95d192ff591c5eb4992760bd7112674c78851f6ae286f20ab | Triage

Sharing

Copy URL Twitter E-mail

General

Target

58cbe9a20b53d89afaf40c0ef190b033
Size

527KB
Sample

240113-nggvlaaaa3
MD5

58cbe9a20b53d89afaf40c0ef190b033
SHA1

4f9fbde2fc0c8b414507f5c564f609890f3b1716
SHA256

210f98b944421ed95d192ff591c5eb4992760bd7112674c78851f6ae286f20ab
SHA512

97363820fb6adffe9046cd36689d65be2065afedd7178e0b3acf4d059e080b4c0592f6ceb08749eeb82e88fb07ba6a7f8ef6bcc134d204c2094d12d2759c7143
SSDEEP

6144:6ZOYqQOHwd4Z6aeUT75+niG7sPFpWmU0rLHKQMNbuHy6BEXb3zXBJXtPP5kU4n3U:6ZGQKZ7r1y7kr2xNBtfftPmUEs+zC

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  58cbe9a20b53d89afaf40c0ef190b033
- Size
  
  527KB
- MD5
  
  58cbe9a20b53d89afaf40c0ef190b033
- SHA1
  
  4f9fbde2fc0c8b414507f5c564f609890f3b1716
- SHA256
  
  210f98b944421ed95d192ff591c5eb4992760bd7112674c78851f6ae286f20ab
- SHA512
  
  97363820fb6adffe9046cd36689d65be2065afedd7178e0b3acf4d059e080b4c0592f6ceb08749eeb82e88fb07ba6a7f8ef6bcc134d204c2094d12d2759c7143
- SSDEEP
  
  6144:6ZOYqQOHwd4Z6aeUT75+niG7sPFpWmU0rLHKQMNbuHy6BEXb3zXBJXtPP5kU4n3U:6ZGQKZ7r1y7kr2xNBtfftPmUEs+zC
Score

8^/10

evasion persistence
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence