2dfb1c947f8b2e9a25a0d09810c6da46041023d5c82ffbb74a4e9b0d2d102c0e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2dfb1c947f8b2e9a25a0d09810c6da46041023d5c82ffbb74a4e9b0d2d102c0eN
Size

204KB
Sample

241001-drxzfsxfrl
MD5

f071dbd8e94d9dc260b996fd3a7cff90
SHA1

12d499bd4f5c2b4ce917ce05fd584267b802e39b
SHA256

2dfb1c947f8b2e9a25a0d09810c6da46041023d5c82ffbb74a4e9b0d2d102c0e
SHA512

d971ca1092a2334cc3c6778575977f19a4d3d65578338ac5c1845587874a7e0aad2772723c1dbf02251042cd77640bbe158a675313f71fedf903bfa7b83d96d9
SSDEEP

3072:MvqqelOFj3pZgBJ1onRL7iIda2ovoNkjPsni30BpCNVYrcLwcYieNRrkoJiyTfbP:Mvx2oDpZgPuRL7G2ikBptdIatu+7qT

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  2dfb1c947f8b2e9a25a0d09810c6da46041023d5c82ffbb74a4e9b0d2d102c0eN
- Size
  
  204KB
- MD5
  
  f071dbd8e94d9dc260b996fd3a7cff90
- SHA1
  
  12d499bd4f5c2b4ce917ce05fd584267b802e39b
- SHA256
  
  2dfb1c947f8b2e9a25a0d09810c6da46041023d5c82ffbb74a4e9b0d2d102c0e
- SHA512
  
  d971ca1092a2334cc3c6778575977f19a4d3d65578338ac5c1845587874a7e0aad2772723c1dbf02251042cd77640bbe158a675313f71fedf903bfa7b83d96d9
- SSDEEP
  
  3072:MvqqelOFj3pZgBJ1onRL7iIda2ovoNkjPsni30BpCNVYrcLwcYieNRrkoJiyTfbP:Mvx2oDpZgPuRL7G2ikBptdIatu+7qT
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence