0e818c90559237778a3ca9856b4cb67b973af59caf027bb801658bab79879175 | Triage

Sharing

General

Target

0e818c90559237778a3ca9856b4cb67b973af59caf027bb801658bab79879175
Size

107KB
Sample

241119-x7hn9a1bkg
MD5

88bc89ab98e89837bf13a0256671e6da
SHA1

d9a2e91647e217168d3b570f2d247e4e62fb0981
SHA256

0e818c90559237778a3ca9856b4cb67b973af59caf027bb801658bab79879175
SHA512

3c88c79ff351275ddfb2c274504eced993a21bfd60d9cee323f34d99f35ee8a5b6d192566fe1bd09f419f62ac662b6970f0fac34e7cdee70cde010bf8121b7b6
SSDEEP

1536:2zfXIsxrhzk2nfsW3ou3yWW2dvcW6eHcBwUi6vWE0Dl27b58XBdqaMGxzl4UQ:yfjxrhzk2nfsWhP7dvavi6vWEbh8X9O

Score

7^/10

defense_evasion discovery

Malware Config

Targets

- Target
  
  0e818c90559237778a3ca9856b4cb67b973af59caf027bb801658bab79879175
- Size
  
  107KB
- MD5
  
  88bc89ab98e89837bf13a0256671e6da
- SHA1
  
  d9a2e91647e217168d3b570f2d247e4e62fb0981
- SHA256
  
  0e818c90559237778a3ca9856b4cb67b973af59caf027bb801658bab79879175
- SHA512
  
  3c88c79ff351275ddfb2c274504eced993a21bfd60d9cee323f34d99f35ee8a5b6d192566fe1bd09f419f62ac662b6970f0fac34e7cdee70cde010bf8121b7b6
- SSDEEP
  
  1536:2zfXIsxrhzk2nfsW3ou3yWW2dvcW6eHcBwUi6vWE0Dl27b58XBdqaMGxzl4UQ:yfjxrhzk2nfsWhP7dvavi6vWEbh8X9O
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery

behavioral2

defense_evasiondiscovery