e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33 | Triage

Sharing

General

Target

e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33
Size

96KB
Sample

240811-dxvfhssgmr
MD5

c67590148f71fb3a1127f0814351e7ca
SHA1

5ab2161846b204c1861ba4ae4cca90ebcd69de15
SHA256

e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33
SHA512

462fe1828b283d09e6108d7f7121a423fcb01ad206db65c7d4849dfeb1d01bcfe84d104dd38ccade30189d8feef5b2f6a6a4dd29a8c22e83f2187be3ee117d1f
SSDEEP

384:56eHIAx0pqNgHvRl4/UCC8VcAaYRiUiiV7fhqc45u8gNrLRnkYpZ7E:56eHIMgPRlUUC151Npquv3Rnk+E

Score

7^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33
- Size
  
  96KB
- MD5
  
  c67590148f71fb3a1127f0814351e7ca
- SHA1
  
  5ab2161846b204c1861ba4ae4cca90ebcd69de15
- SHA256
  
  e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33
- SHA512
  
  462fe1828b283d09e6108d7f7121a423fcb01ad206db65c7d4849dfeb1d01bcfe84d104dd38ccade30189d8feef5b2f6a6a4dd29a8c22e83f2187be3ee117d1f
- SSDEEP
  
  384:56eHIAx0pqNgHvRl4/UCC8VcAaYRiUiiV7fhqc45u8gNrLRnkYpZ7E:56eHIMgPRlUUC151Npquv3Rnk+E
Score

7^/10

discovery evasion persistence trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoverypersistence