2db21c7e81906174d262296c83b86c4dfc5f88f5584cecd9afaaee48141bb0d9 | Triage

Sharing

General

Target

2db21c7e81906174d262296c83b86c4dfc5f88f5584cecd9afaaee48141bb0d9N
Size

140KB
Sample

241009-mz6e8ssdpm
MD5

18412e3c5d3e6cbbf67442be6d4e23b0
SHA1

a949f28e984502e4362acf1b8d302cfbac8322e8
SHA256

2db21c7e81906174d262296c83b86c4dfc5f88f5584cecd9afaaee48141bb0d9
SHA512

85da72eca19ea3080f13aa668654a0feb9d1606532fe989140ccc7babc21c9809eac4e406b17e2fc0aa5809ebcfa507d3c10844410d659e1b7cf036ec19f5548
SSDEEP

3072:FbsAGHllwgRkWwuXdzDwWX0fTIZOaA481GkQr+drjOBgqEq7:Fol6WwuXdzDwWX0fTIZOaAYkQrGrjOBq

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  2db21c7e81906174d262296c83b86c4dfc5f88f5584cecd9afaaee48141bb0d9N
- Size
  
  140KB
- MD5
  
  18412e3c5d3e6cbbf67442be6d4e23b0
- SHA1
  
  a949f28e984502e4362acf1b8d302cfbac8322e8
- SHA256
  
  2db21c7e81906174d262296c83b86c4dfc5f88f5584cecd9afaaee48141bb0d9
- SHA512
  
  85da72eca19ea3080f13aa668654a0feb9d1606532fe989140ccc7babc21c9809eac4e406b17e2fc0aa5809ebcfa507d3c10844410d659e1b7cf036ec19f5548
- SSDEEP
  
  3072:FbsAGHllwgRkWwuXdzDwWX0fTIZOaA481GkQr+drjOBgqEq7:Fol6WwuXdzDwWX0fTIZOaAYkQrGrjOBq
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence