General
-
Target
tmp
-
Size
2.1MB
-
Sample
221007-fw9j6abhbr
-
MD5
6d87f123772612929da682d8097938be
-
SHA1
563fa72a6b4b2084db8a54f3fc9076b9b744e8cb
-
SHA256
d8ccf0d00dbf712744ba342e641ad6faf8d917254e7fd44cef4e0e4cb3ac99c7
-
SHA512
cd09c640eb2598b2a31c2aa9cbdf79920256a1d7e4fd7d5771fc4a837fd74a284532b14da397a380b8f363ed00130b5af40224242609a49c15c4955ac97925fe
-
SSDEEP
24576:ve3yAGxmrk7ugY2yDWAzBOFaeLWxtUPom69bX83RJV6VPzKZUvW32r0enf3ELps8:ve9Q7ugcrvtUXCbXwcT1QMUdLlbU5M9
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
tmp
-
Size
2.1MB
-
MD5
6d87f123772612929da682d8097938be
-
SHA1
563fa72a6b4b2084db8a54f3fc9076b9b744e8cb
-
SHA256
d8ccf0d00dbf712744ba342e641ad6faf8d917254e7fd44cef4e0e4cb3ac99c7
-
SHA512
cd09c640eb2598b2a31c2aa9cbdf79920256a1d7e4fd7d5771fc4a837fd74a284532b14da397a380b8f363ed00130b5af40224242609a49c15c4955ac97925fe
-
SSDEEP
24576:ve3yAGxmrk7ugY2yDWAzBOFaeLWxtUPom69bX83RJV6VPzKZUvW32r0enf3ELps8:ve9Q7ugcrvtUXCbXwcT1QMUdLlbU5M9
-
Detects Smokeloader packer
-
Modifies WinLogon for persistence
-
Async RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-