b6ca5a799b331ba4879f94abae4a2ce31c26f4c910909f617562d4f5173bfd59 | Triage

Sharing

General

Target

b6ca5a799b331ba4879f94abae4a2ce31c26f4c910909f617562d4f5173bfd59N
Size

108KB
Sample

240920-dld96awcnj
MD5

a1c5a2efb078304bdc827fa6aa5323a0
SHA1

14f10a498748f2c0a97a4416a360c1984c45a3fa
SHA256

b6ca5a799b331ba4879f94abae4a2ce31c26f4c910909f617562d4f5173bfd59
SHA512

c54c09333561c4190038807b8ae8bfdd5c4ad64acadda7ab94987f46abf81f5b84544bc5cb69329e2958952c720a9d78b0f469265e0888575f407343540a12da
SSDEEP

1536:vmujKiB6oQ7Lh5+sXmNP0ttJPXLq0zTrkC:O2moIeZPEXTzToC

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  b6ca5a799b331ba4879f94abae4a2ce31c26f4c910909f617562d4f5173bfd59N
- Size
  
  108KB
- MD5
  
  a1c5a2efb078304bdc827fa6aa5323a0
- SHA1
  
  14f10a498748f2c0a97a4416a360c1984c45a3fa
- SHA256
  
  b6ca5a799b331ba4879f94abae4a2ce31c26f4c910909f617562d4f5173bfd59
- SHA512
  
  c54c09333561c4190038807b8ae8bfdd5c4ad64acadda7ab94987f46abf81f5b84544bc5cb69329e2958952c720a9d78b0f469265e0888575f407343540a12da
- SSDEEP
  
  1536:vmujKiB6oQ7Lh5+sXmNP0ttJPXLq0zTrkC:O2moIeZPEXTzToC
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence