c29e4bf305addd574b25c21f80fcb9d6fae712f219b5699eec0fe7bb59d584f2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c29e4bf305addd574b25c21f80fcb9d6fae712f219b5699eec0fe7bb59d584f2
Size

240KB
Sample

240803-c5hk9azhml
MD5

6ae87c19d072715d16b90780b4365d8b
SHA1

499b39bfff930cf1d547da00333573f9b39d4bc2
SHA256

c29e4bf305addd574b25c21f80fcb9d6fae712f219b5699eec0fe7bb59d584f2
SHA512

ea7e9d8a598f99734d10e07104a872227f979c6e346c9d41a3920a6a512c6163025068207eb5188df137eb3d03d16c3bde7fc3626384d8cde2d6256631562530
SSDEEP

3072:JyJAt+0tQ9nLHbB9WJvA7DejJuKvEhfm:O4QxL7B9WSvejJuB

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  c29e4bf305addd574b25c21f80fcb9d6fae712f219b5699eec0fe7bb59d584f2
- Size
  
  240KB
- MD5
  
  6ae87c19d072715d16b90780b4365d8b
- SHA1
  
  499b39bfff930cf1d547da00333573f9b39d4bc2
- SHA256
  
  c29e4bf305addd574b25c21f80fcb9d6fae712f219b5699eec0fe7bb59d584f2
- SHA512
  
  ea7e9d8a598f99734d10e07104a872227f979c6e346c9d41a3920a6a512c6163025068207eb5188df137eb3d03d16c3bde7fc3626384d8cde2d6256631562530
- SSDEEP
  
  3072:JyJAt+0tQ9nLHbB9WJvA7DejJuKvEhfm:O4QxL7B9WSvejJuB
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence