be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477 | Triage

Sharing

General

Target

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
Size

288KB
Sample

241120-zrmpdatjby
MD5

124d87cc3f2c7e27222bf8c13e94b884
SHA1

3043b032c75ec153dd015155e09ea7c54bd8c006
SHA256

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477
SHA512

09a4f6e8ed62d2debabc9e964440589276d708f34152f037f201f6dd516b68db2c09ae740b8911a5d21a249fe42b7fd4998a0f2695233e23004ad4907628d426
SSDEEP

1536:fopUMphvcBESxGFVYguSXq/fiTvlATmeX4Z4R4H4i4/o9FKs0z2xoetEPnyexeyC:IPc98+guucz9/tBH3H3+n

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
- Size
  
  288KB
- MD5
  
  124d87cc3f2c7e27222bf8c13e94b884
- SHA1
  
  3043b032c75ec153dd015155e09ea7c54bd8c006
- SHA256
  
  be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477
- SHA512
  
  09a4f6e8ed62d2debabc9e964440589276d708f34152f037f201f6dd516b68db2c09ae740b8911a5d21a249fe42b7fd4998a0f2695233e23004ad4907628d426
- SSDEEP
  
  1536:fopUMphvcBESxGFVYguSXq/fiTvlATmeX4Z4R4H4i4/o9FKs0z2xoetEPnyexeyC:IPc98+guucz9/tBH3H3+n
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence