c3d05355acc0e5713ee0b8ea17d7807118a49317f435ace618cd4dc21389e10a | Triage

Sharing

General

Target

c3d05355acc0e5713ee0b8ea17d7807118a49317f435ace618cd4dc21389e10a
Size

304KB
Sample

240425-dhj18seb54
MD5

32b50657767403b251746d6831ec99ca
SHA1

23e488a0d7b36ceeeeee725374833836c7ff707d
SHA256

c3d05355acc0e5713ee0b8ea17d7807118a49317f435ace618cd4dc21389e10a
SHA512

7215101a68236e2fa66f78d92598566964eaa8b69ba55e39cb6e2dfc1ae434f29f0509fb2f22b09f5009fa9634c88b4c9350ca4292a20272ffc8810aed30ffc9
SSDEEP

3072:Hif1i2Dwhe6YIRnbXtcU7wizKqc+uL21op2aEaDFHT+7pvPxvso:LxE5Z2xla8x

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c3d05355acc0e5713ee0b8ea17d7807118a49317f435ace618cd4dc21389e10a
- Size
  
  304KB
- MD5
  
  32b50657767403b251746d6831ec99ca
- SHA1
  
  23e488a0d7b36ceeeeee725374833836c7ff707d
- SHA256
  
  c3d05355acc0e5713ee0b8ea17d7807118a49317f435ace618cd4dc21389e10a
- SHA512
  
  7215101a68236e2fa66f78d92598566964eaa8b69ba55e39cb6e2dfc1ae434f29f0509fb2f22b09f5009fa9634c88b4c9350ca4292a20272ffc8810aed30ffc9
- SSDEEP
  
  3072:Hif1i2Dwhe6YIRnbXtcU7wizKqc+uL21op2aEaDFHT+7pvPxvso:LxE5Z2xla8x
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence