7277fc173a65e84426217ea49d790b19b5b5d8a3f24be2acca4f4e6a1635858e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d39de5973189eb4d0c884dfaa103597a
Size

160KB
Sample

240318-qmlf3sad2s
MD5

d39de5973189eb4d0c884dfaa103597a
SHA1

625766dd30fb1e2a077ca7c15b0f74de1dc5556c
SHA256

7277fc173a65e84426217ea49d790b19b5b5d8a3f24be2acca4f4e6a1635858e
SHA512

e99b39ad04ef89c68e7692aa9bfc2a90364b6d7f3bb2e3fa35924158256d85cab2971706220f6263fd21c668ade39a7c82043ee33d445826fb1b161067e28a1e
SSDEEP

3072:Zghg8Sn4dnbla5eree+ELWqqdSTvC6HWYppiAKNWlpt7ryfrb0l3icB6Cb:Zwq4Rl+erlRLcd5626pDX3BOzIl3icVb

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  d39de5973189eb4d0c884dfaa103597a
- Size
  
  160KB
- MD5
  
  d39de5973189eb4d0c884dfaa103597a
- SHA1
  
  625766dd30fb1e2a077ca7c15b0f74de1dc5556c
- SHA256
  
  7277fc173a65e84426217ea49d790b19b5b5d8a3f24be2acca4f4e6a1635858e
- SHA512
  
  e99b39ad04ef89c68e7692aa9bfc2a90364b6d7f3bb2e3fa35924158256d85cab2971706220f6263fd21c668ade39a7c82043ee33d445826fb1b161067e28a1e
- SSDEEP
  
  3072:Zghg8Sn4dnbla5eree+ELWqqdSTvC6HWYppiAKNWlpt7ryfrb0l3icB6Cb:Zwq4Rl+erlRLcd5626pDX3BOzIl3icVb
Score

8^/10

evasion persistence
- Creates new service(s)
  persistence
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence