9c4c6cb7b00277f25a7bac783e7cf06813e78d99dad35e6d6781a158fa9af8df | Triage

Sharing

General

Target

9c4c6cb7b00277f25a7bac783e7cf06813e78d99dad35e6d6781a158fa9af8df.exe
Size

52KB
Sample

241120-wc362azema
MD5

7a9da66a18df388a3dc53f0fc32fb3a6
SHA1

9fecba5d4f76cf95a827040bb6b31d59faf1a105
SHA256

9c4c6cb7b00277f25a7bac783e7cf06813e78d99dad35e6d6781a158fa9af8df
SHA512

95a9e8f0c2842f57fb8f7be7e4cee994d67361a96ff296145631366023794a5152e37988260810c681bbb7fc05a3fc001a9d4fa9cdac9fa484a57583687b673c
SSDEEP

768:mLj3dfkZYcuF81a/DVWl8zHPHXyXHCzcHHvzQBdi9vcIVSEFFoHa0ZKr:mLuYYgVWl4vUv4WvcsFFoHxIr

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  9c4c6cb7b00277f25a7bac783e7cf06813e78d99dad35e6d6781a158fa9af8df.exe
- Size
  
  52KB
- MD5
  
  7a9da66a18df388a3dc53f0fc32fb3a6
- SHA1
  
  9fecba5d4f76cf95a827040bb6b31d59faf1a105
- SHA256
  
  9c4c6cb7b00277f25a7bac783e7cf06813e78d99dad35e6d6781a158fa9af8df
- SHA512
  
  95a9e8f0c2842f57fb8f7be7e4cee994d67361a96ff296145631366023794a5152e37988260810c681bbb7fc05a3fc001a9d4fa9cdac9fa484a57583687b673c
- SSDEEP
  
  768:mLj3dfkZYcuF81a/DVWl8zHPHXyXHCzcHHvzQBdi9vcIVSEFFoHa0ZKr:mLuYYgVWl4vUv4WvcsFFoHxIr
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence