67005569927952ef66ba77bd1a50dfc6f55677d37e2cd22f56a0de84c2e89105 | Triage

Sharing

General

Target

6fe61c04c885bafd5b1db3d8baff76a0
Size

181KB
Sample

240122-v551nabcek
MD5

6fe61c04c885bafd5b1db3d8baff76a0
SHA1

7bf9624081db706b75e56f1fa35155b7277b25f7
SHA256

67005569927952ef66ba77bd1a50dfc6f55677d37e2cd22f56a0de84c2e89105
SHA512

b0c7193a16e6716d911465f7a0dd76ded07522c95b2b9a35b22e27ca0248f9a7cdecf7136c00647e45b7133320868e6c93556dae8438bcc4722ba4b9e98cbdd6
SSDEEP

3072:5jEmLFtjR7iWj9XrTBsoe7De/sqe8ThcUE0LQPWE8Hanargoee:ZEmLHRmWj96oe7ykScU/LQP0HaJ

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  6fe61c04c885bafd5b1db3d8baff76a0
- Size
  
  181KB
- MD5
  
  6fe61c04c885bafd5b1db3d8baff76a0
- SHA1
  
  7bf9624081db706b75e56f1fa35155b7277b25f7
- SHA256
  
  67005569927952ef66ba77bd1a50dfc6f55677d37e2cd22f56a0de84c2e89105
- SHA512
  
  b0c7193a16e6716d911465f7a0dd76ded07522c95b2b9a35b22e27ca0248f9a7cdecf7136c00647e45b7133320868e6c93556dae8438bcc4722ba4b9e98cbdd6
- SSDEEP
  
  3072:5jEmLFtjR7iWj9XrTBsoe7De/sqe8ThcUE0LQPWE8Hanargoee:ZEmLHRmWj96oe7ykScU/LQP0HaJ
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2