General
-
Target
14edaa591271e22259d33c1594b0fda3b15457ae50ad91bbe54db66d379b9d5a
-
Size
808KB
-
Sample
221120-mbrxyace5x
-
MD5
47805f3b2d274d049be40b9c5868d8e1
-
SHA1
2aeb89bcf89db246f3f04e45644910d18df6553f
-
SHA256
14edaa591271e22259d33c1594b0fda3b15457ae50ad91bbe54db66d379b9d5a
-
SHA512
1dcc521711f16bd66f9b517765f7e1ef244a89de002b7dfbeae74c8d701c9e73421fff1724bea1345d8ec4b3b4012fad823a9d6c9111b7a213f8d8ef20c20cfe
-
SSDEEP
12288:3cyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:3c2+ms5pavs+NpM9nXg79CU
Static task
static1
Behavioral task
behavioral1
Sample
14edaa591271e22259d33c1594b0fda3b15457ae50ad91bbe54db66d379b9d5a.exe
Resource
win7-20221111-en
Malware Config
Targets
-
-
Target
14edaa591271e22259d33c1594b0fda3b15457ae50ad91bbe54db66d379b9d5a
-
Size
808KB
-
MD5
47805f3b2d274d049be40b9c5868d8e1
-
SHA1
2aeb89bcf89db246f3f04e45644910d18df6553f
-
SHA256
14edaa591271e22259d33c1594b0fda3b15457ae50ad91bbe54db66d379b9d5a
-
SHA512
1dcc521711f16bd66f9b517765f7e1ef244a89de002b7dfbeae74c8d701c9e73421fff1724bea1345d8ec4b3b4012fad823a9d6c9111b7a213f8d8ef20c20cfe
-
SSDEEP
12288:3cyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:3c2+ms5pavs+NpM9nXg79CU
-
Modifies WinLogon for persistence
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-