3838f56feb6c0017af4bab738549977d6e38082653a7c0c0c272fb5e9dbca818 | Triage

Sharing

General

Target

3838f56feb6c0017af4bab738549977d6e38082653a7c0c0c272fb5e9dbca818N
Size

53KB
Sample

240921-bl9d7aybjg
MD5

31b09709f9e97ee930c7ea3dbf627950
SHA1

2db47e622cf4bfc352e36fd7e794e6160e864a48
SHA256

3838f56feb6c0017af4bab738549977d6e38082653a7c0c0c272fb5e9dbca818
SHA512

c451bdceab3c87b190c4899f6646a1d4805643c636b4b9b745b68c952704de1bcedd5540ce7dcc564217675ac6a7f3d78ca6f6e3ec5d2888a92cde6ae8afff62
SSDEEP

1536:vNbg8r8QUxWsqpuV7Kp3StjEMjmLM3ztDJWZsXy4JzxPME:aWTQJJjmLM3zRJWZsXy4Jt

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  3838f56feb6c0017af4bab738549977d6e38082653a7c0c0c272fb5e9dbca818N
- Size
  
  53KB
- MD5
  
  31b09709f9e97ee930c7ea3dbf627950
- SHA1
  
  2db47e622cf4bfc352e36fd7e794e6160e864a48
- SHA256
  
  3838f56feb6c0017af4bab738549977d6e38082653a7c0c0c272fb5e9dbca818
- SHA512
  
  c451bdceab3c87b190c4899f6646a1d4805643c636b4b9b745b68c952704de1bcedd5540ce7dcc564217675ac6a7f3d78ca6f6e3ec5d2888a92cde6ae8afff62
- SSDEEP
  
  1536:vNbg8r8QUxWsqpuV7Kp3StjEMjmLM3ztDJWZsXy4JzxPME:aWTQJJjmLM3zRJWZsXy4Jt
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence