ca3ef6aa3d48739458f3446ac188ff1dc7f3ce6ff8816eb73ddfa6f2d305d3d3 | Triage

Sharing

General

Target

ca3ef6aa3d48739458f3446ac188ff1dc7f3ce6ff8816eb73ddfa6f2d305d3d3
Size

5.0MB
Sample

240906-zbry6axama
MD5

ddc993fe772d6df1656c22b6c0ea2df7
SHA1

489599ffda5275896dfd4347ee68087bb54c13a1
SHA256

ca3ef6aa3d48739458f3446ac188ff1dc7f3ce6ff8816eb73ddfa6f2d305d3d3
SHA512

5bfbd095eeb8616b05628863acb4f7e58ccf7f24f75e749e4f03206c1c1eb8df794da6f5dbf658f64e5860f15849bae9a5c43386d11595687e8da002f9dc8804
SSDEEP

98304:xc00zuLKe+anb7LVsmSas1+YRg74gxoD88kFCHyDcb3:xc00zuLKC7SasBS74D8pCHyg7

Score

10^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  ca3ef6aa3d48739458f3446ac188ff1dc7f3ce6ff8816eb73ddfa6f2d305d3d3
- Size
  
  5.0MB
- MD5
  
  ddc993fe772d6df1656c22b6c0ea2df7
- SHA1
  
  489599ffda5275896dfd4347ee68087bb54c13a1
- SHA256
  
  ca3ef6aa3d48739458f3446ac188ff1dc7f3ce6ff8816eb73ddfa6f2d305d3d3
- SHA512
  
  5bfbd095eeb8616b05628863acb4f7e58ccf7f24f75e749e4f03206c1c1eb8df794da6f5dbf658f64e5860f15849bae9a5c43386d11595687e8da002f9dc8804
- SSDEEP
  
  98304:xc00zuLKe+anb7LVsmSas1+YRg74gxoD88kFCHyDcb3:xc00zuLKC7SasBS74D8pCHyg7
Score

10^/10

discovery evasion persistence privilege_escalation trojan
- UAC bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalationtrojan