ab79436e9124e23de074759ba688af1faa920f984451b24d73fe55552e636e05 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c031b1ba9e85008952c1f01828a21d02
Size

17KB
Sample

240311-kzydhsgc2w
MD5

c031b1ba9e85008952c1f01828a21d02
SHA1

a3664031a624acdeb71063092e9339197cbac192
SHA256

ab79436e9124e23de074759ba688af1faa920f984451b24d73fe55552e636e05
SHA512

6d808bb608cf89f4dbfb140705024d3a249ac535a87628464f146d84545f01ed36b4eb73e1ff2e48a7a712e3601fc003436d8ca60336cb1aa26bb8f9cee33f10
SSDEEP

384:h5kAsWojnwgtfgXUMn3QtXP/U1SQuwWaNJawcudoD7U8xt:cWoDVYXUDXP82QnbcuyD7U8D

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  c031b1ba9e85008952c1f01828a21d02
- Size
  
  17KB
- MD5
  
  c031b1ba9e85008952c1f01828a21d02
- SHA1
  
  a3664031a624acdeb71063092e9339197cbac192
- SHA256
  
  ab79436e9124e23de074759ba688af1faa920f984451b24d73fe55552e636e05
- SHA512
  
  6d808bb608cf89f4dbfb140705024d3a249ac535a87628464f146d84545f01ed36b4eb73e1ff2e48a7a712e3601fc003436d8ca60336cb1aa26bb8f9cee33f10
- SSDEEP
  
  384:h5kAsWojnwgtfgXUMn3QtXP/U1SQuwWaNJawcudoD7U8xt:cWoDVYXUDXP82QnbcuyD7U8D
Score

8^/10

evasion persistence
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence