General
-
Target
dd51300809df5d583b25262f6bd85a490d78375a85bee027270c585da13c09e1
-
Size
285KB
-
Sample
221123-nvkhmsch3w
-
MD5
4c4b6cd307cd62ff89d28a5aa750d4c4
-
SHA1
46d2345b3d46b7561e48bae5fb229681dcff0c59
-
SHA256
dd51300809df5d583b25262f6bd85a490d78375a85bee027270c585da13c09e1
-
SHA512
f1c66bb92f0bd8891b0fd9f6189673580629316d5a289be93d1ecf4bc7751f9552bb5d7326aa27d75dbe3d38a883be2cbd2e143690611ecbd465f09ee16c7183
-
SSDEEP
6144:Tlb6SDOiIN4o2cOMayarS0IjX7n6wXmzbBFXPE:T0Siiu2cOMayaZerXXmhFXPE
Behavioral task
behavioral1
Sample
dd51300809df5d583b25262f6bd85a490d78375a85bee027270c585da13c09e1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dd51300809df5d583b25262f6bd85a490d78375a85bee027270c585da13c09e1.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
dd51300809df5d583b25262f6bd85a490d78375a85bee027270c585da13c09e1
-
Size
285KB
-
MD5
4c4b6cd307cd62ff89d28a5aa750d4c4
-
SHA1
46d2345b3d46b7561e48bae5fb229681dcff0c59
-
SHA256
dd51300809df5d583b25262f6bd85a490d78375a85bee027270c585da13c09e1
-
SHA512
f1c66bb92f0bd8891b0fd9f6189673580629316d5a289be93d1ecf4bc7751f9552bb5d7326aa27d75dbe3d38a883be2cbd2e143690611ecbd465f09ee16c7183
-
SSDEEP
6144:Tlb6SDOiIN4o2cOMayarS0IjX7n6wXmzbBFXPE:T0Siiu2cOMayaZerXXmhFXPE
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-