General
-
Target
c24ce3306cb3ca0ed0b5ac7893aed9ec0cd69feed5a11dc421132428ca7b4205
-
Size
349KB
-
Sample
220521-cmmr9ahber
-
MD5
14f01de4f85f4822316fad7ea425cc9a
-
SHA1
0fd0097385c1ebaee73589c209675d1ea5ca5c8f
-
SHA256
c24ce3306cb3ca0ed0b5ac7893aed9ec0cd69feed5a11dc421132428ca7b4205
-
SHA512
4933ab8bcee5eae43c5fd1172af99d2bdb52ce8328dd5b69600a6cd65a0a2be62874095882cb9d5d6f8e17c09aef8b2230219600d7c8c99b9c8dde17a704d9e6
Static task
static1
Behavioral task
behavioral1
Sample
Order & Specification.exe
Resource
win7-20220414-en
Malware Config
Extracted
nanocore
1.2.2.0
ome2j3bw.3utilities.com:1907
bec896f1-592b-47d9-b6d7-441c6093682d
-
activate_away_mode
true
-
backup_connection_host
ome2j3bw.3utilities.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-02-13T02:35:20.505000936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
3997
-
connection_port
1907
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
29997
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
bec896f1-592b-47d9-b6d7-441c6093682d
-
mutex_timeout
4995
-
prevent_system_sleep
false
-
primary_connection_host
ome2j3bw.3utilities.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
4997
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
4934
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
Order & Specification.exe
-
Size
435KB
-
MD5
6ed8d16bcfa3fdb721ce6f75100a89fa
-
SHA1
3a13e7679803db6b5fa4082a10e9981301967f3d
-
SHA256
953b28fd61cb8eb78e1fca699aead009a12bb5a0a6a8d42b0447cbe2bf828143
-
SHA512
df4143a936ed0a6d8b9624c981c1a1e100995c82e1b7f05b0458940aaab2108a4e50504002cf5e69ef7721d241fe75cdb2eea0e9ad7f4103c44f7862d3b1d8c4
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-