General
-
Target
676c98f55682eadde239aee0e0ca80ce2165cdb2541fac3cb8ba13b509388372
-
Size
502KB
-
Sample
220707-alyr1schh5
-
MD5
e69ab8adbb3ee8c81842967e5ee7ab63
-
SHA1
438f02ca6365e3f7bb25d347f37940ce9a362c31
-
SHA256
676c98f55682eadde239aee0e0ca80ce2165cdb2541fac3cb8ba13b509388372
-
SHA512
148520fac8fd9bf003ba54f98b5809d86ab3689ce844340bc9ffcdce27626c1db243bab29bc6e85b59001bed35daf685652a4e55b2eb242b73c6595ffbcd2e63
Static task
static1
Behavioral task
behavioral1
Sample
676c98f55682eadde239aee0e0ca80ce2165cdb2541fac3cb8ba13b509388372.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
676c98f55682eadde239aee0e0ca80ce2165cdb2541fac3cb8ba13b509388372.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
676c98f55682eadde239aee0e0ca80ce2165cdb2541fac3cb8ba13b509388372
-
Size
502KB
-
MD5
e69ab8adbb3ee8c81842967e5ee7ab63
-
SHA1
438f02ca6365e3f7bb25d347f37940ce9a362c31
-
SHA256
676c98f55682eadde239aee0e0ca80ce2165cdb2541fac3cb8ba13b509388372
-
SHA512
148520fac8fd9bf003ba54f98b5809d86ab3689ce844340bc9ffcdce27626c1db243bab29bc6e85b59001bed35daf685652a4e55b2eb242b73c6595ffbcd2e63
Score10/10-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-