b521f9425981c08101c650cb31b707bfcf75c9d34abf963093f6e1f1067c090e | Triage

Sharing

General

Target

b521f9425981c08101c650cb31b707bfcf75c9d34abf963093f6e1f1067c090e
Size

312KB
Sample

240921-3lq2ds1amj
MD5

1076a1187d492b2f5c816d57c1e1cbae
SHA1

8fdd2d72988be05f422a58e7ba243101d5e70493
SHA256

b521f9425981c08101c650cb31b707bfcf75c9d34abf963093f6e1f1067c090e
SHA512

532d876f86980ab2af564242a32cfea944514c2623a187b45843cd8ab322e9b836d5d8f0d4fe626fdde80fef4960d2098e4705a736f8c0599d7e5a76445c5856
SSDEEP

6144:s/7mvTlIpr1f+XqO5aOmSGFDbeOjLPmUmgn:++TlIB1f+55SpNPmULn

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  b521f9425981c08101c650cb31b707bfcf75c9d34abf963093f6e1f1067c090e
- Size
  
  312KB
- MD5
  
  1076a1187d492b2f5c816d57c1e1cbae
- SHA1
  
  8fdd2d72988be05f422a58e7ba243101d5e70493
- SHA256
  
  b521f9425981c08101c650cb31b707bfcf75c9d34abf963093f6e1f1067c090e
- SHA512
  
  532d876f86980ab2af564242a32cfea944514c2623a187b45843cd8ab322e9b836d5d8f0d4fe626fdde80fef4960d2098e4705a736f8c0599d7e5a76445c5856
- SSDEEP
  
  6144:s/7mvTlIpr1f+XqO5aOmSGFDbeOjLPmUmgn:++TlIB1f+55SpNPmULn
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence