d862746f084183bb16765decc21f0eea62c48ac96eed0f9364a8a9af3248db6d | Triage

Sharing

General

Target

d862746f084183bb16765decc21f0eea62c48ac96eed0f9364a8a9af3248db6d.exe
Size

232KB
Sample

241122-nqkb3szlgs
MD5

460a381c320cf3cdb78be1dac853c5f8
SHA1

1fcc3c325983e71dcc7e5805cd2c98c5158ba645
SHA256

d862746f084183bb16765decc21f0eea62c48ac96eed0f9364a8a9af3248db6d
SHA512

61c42397ac0b82c40b721b7b381b3a79aaaec11faab91757111b68768a140670c2f17cde8887324a7aad2895d486d9f154e681ac92902370a9cee80d65b9fbee
SSDEEP

6144:dU3PFKs78g2KyEOaWEqxF6snji81RUinKdNOb6:8Ph+mF7

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  d862746f084183bb16765decc21f0eea62c48ac96eed0f9364a8a9af3248db6d.exe
- Size
  
  232KB
- MD5
  
  460a381c320cf3cdb78be1dac853c5f8
- SHA1
  
  1fcc3c325983e71dcc7e5805cd2c98c5158ba645
- SHA256
  
  d862746f084183bb16765decc21f0eea62c48ac96eed0f9364a8a9af3248db6d
- SHA512
  
  61c42397ac0b82c40b721b7b381b3a79aaaec11faab91757111b68768a140670c2f17cde8887324a7aad2895d486d9f154e681ac92902370a9cee80d65b9fbee
- SSDEEP
  
  6144:dU3PFKs78g2KyEOaWEqxF6snji81RUinKdNOb6:8Ph+mF7
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence