1cb524a4e2cc6396fcd67920805b78758272d02dd9a2a1cd853288924b9eeef6 | Triage

Sharing

General

Target

1cb524a4e2cc6396fcd67920805b78758272d02dd9a2a1cd853288924b9eeef6N
Size

216KB
Sample

240919-gv9n7sthqa
MD5

31957181795221f96292f1ae0ff759b0
SHA1

f4cbc141f271eb16765425fb979fd22b95c48f72
SHA256

1cb524a4e2cc6396fcd67920805b78758272d02dd9a2a1cd853288924b9eeef6
SHA512

de30ed01dc5be20688a1a505f3cc65ab2ab6079547ae7f78e83b3ca969bd8a858dd11d86b4edbbf9c9e441502e5acd73899159bc88a4f7e42c2e0981b6e1702c
SSDEEP

3072:PY9aaMKWYz6cBewR7sEVSdJplM2IlNGzBkl9s4R:A9yCJBe2pV2M2CWs9

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  1cb524a4e2cc6396fcd67920805b78758272d02dd9a2a1cd853288924b9eeef6N
- Size
  
  216KB
- MD5
  
  31957181795221f96292f1ae0ff759b0
- SHA1
  
  f4cbc141f271eb16765425fb979fd22b95c48f72
- SHA256
  
  1cb524a4e2cc6396fcd67920805b78758272d02dd9a2a1cd853288924b9eeef6
- SHA512
  
  de30ed01dc5be20688a1a505f3cc65ab2ab6079547ae7f78e83b3ca969bd8a858dd11d86b4edbbf9c9e441502e5acd73899159bc88a4f7e42c2e0981b6e1702c
- SSDEEP
  
  3072:PY9aaMKWYz6cBewR7sEVSdJplM2IlNGzBkl9s4R:A9yCJBe2pV2M2CWs9
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence