67d76f5ef9aa578f2c32704e13be4da3ca0e620a717582723af39c2943e35760 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b8410b9bcf7881c9df780edb129ce232
Size

9.3MB
Sample

240306-1hx97aab95
MD5

b8410b9bcf7881c9df780edb129ce232
SHA1

f7a85b21b623dcd0a1095fb80bbfcf738659750b
SHA256

67d76f5ef9aa578f2c32704e13be4da3ca0e620a717582723af39c2943e35760
SHA512

f5b4141e1edc1c2c159d8758bd2e88f800892355779e7eaaedd39ebf321aadebd00c11e145652619e1c3e612cec93f85b34f70c61114a5bbbf59242aa471ab2c
SSDEEP

1536:lGdVGRvtt7MlSIXZGHs1m5Guv6jBEbyzpsaAAkeHQbhVuzX:lsVG+cs1y7iKbyzpFkeHaWT

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  b8410b9bcf7881c9df780edb129ce232
- Size
  
  9.3MB
- MD5
  
  b8410b9bcf7881c9df780edb129ce232
- SHA1
  
  f7a85b21b623dcd0a1095fb80bbfcf738659750b
- SHA256
  
  67d76f5ef9aa578f2c32704e13be4da3ca0e620a717582723af39c2943e35760
- SHA512
  
  f5b4141e1edc1c2c159d8758bd2e88f800892355779e7eaaedd39ebf321aadebd00c11e145652619e1c3e612cec93f85b34f70c61114a5bbbf59242aa471ab2c
- SSDEEP
  
  1536:lGdVGRvtt7MlSIXZGHs1m5Guv6jBEbyzpsaAAkeHQbhVuzX:lsVG+cs1y7iKbyzpFkeHaWT
Score

10^/10

evasion trojan
- Modifies firewall policy service
  evasion
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2