7dfb45daa56d996ea22ef9c1dd0e28f9c0a3ff0bac79dc0884dca107783c7317 | Triage

Sharing

General

Target

c6bce06ca20ec135b6d5eda27a112cd9
Size

510KB
Sample

240313-yrjr2seh5s
MD5

c6bce06ca20ec135b6d5eda27a112cd9
SHA1

1e5d32158b075ac11d4d4d8f3bd472f3db026068
SHA256

7dfb45daa56d996ea22ef9c1dd0e28f9c0a3ff0bac79dc0884dca107783c7317
SHA512

7cb5086743c4d9dc528a0566b0abe2e563470de39fa9d434389fceb7ea6e602e88f41ad83d168b9e1f9fd4dfd0d3a835ed6edd844e9bdeaeed2056140ce576a2
SSDEEP

12288:Uky+d3utrzh9xOXkWl9ufWG7txDtQ4UeoD+UzgusnDw+JLkJ/HN:Ug3utr5OUWzuN7tltzNoaUtE+j

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  c6bce06ca20ec135b6d5eda27a112cd9
- Size
  
  510KB
- MD5
  
  c6bce06ca20ec135b6d5eda27a112cd9
- SHA1
  
  1e5d32158b075ac11d4d4d8f3bd472f3db026068
- SHA256
  
  7dfb45daa56d996ea22ef9c1dd0e28f9c0a3ff0bac79dc0884dca107783c7317
- SHA512
  
  7cb5086743c4d9dc528a0566b0abe2e563470de39fa9d434389fceb7ea6e602e88f41ad83d168b9e1f9fd4dfd0d3a835ed6edd844e9bdeaeed2056140ce576a2
- SSDEEP
  
  12288:Uky+d3utrzh9xOXkWl9ufWG7txDtQ4UeoD+UzgusnDw+JLkJ/HN:Ug3utr5OUWzuN7tltzNoaUtE+j
Score

8^/10

evasion persistence
- Creates new service(s)
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence