General
-
Target
1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487
-
Size
770KB
-
Sample
221124-n253xsca24
-
MD5
5fb5607b0f61bb044ff17e28388df490
-
SHA1
a5e0e097746b63d8ee36701dd040e16784df5da2
-
SHA256
1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487
-
SHA512
37fa97795ae202377263b62dce420acad9397c17aefe1ac8ea35be43bd386bdb1aa0a0ef4a0ad659359269a29180bb0036d2c7310e8b511a1136df4ac4afa25d
-
SSDEEP
12288:+MzEoDzA1NLzZJncwAVDZI2r1xZyLA6y3TlWW+X+a3qml9nkDRTXj69mfx:t7wnLzZ0Dr1xP6y3t+Z3Vl9nATzGGx
Static task
static1
Behavioral task
behavioral1
Sample
1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\Decrypt All Files nrlhicl.txt
http://q4vyrzddq25a4jhf.onion
Targets
-
-
Target
1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487
-
Size
770KB
-
MD5
5fb5607b0f61bb044ff17e28388df490
-
SHA1
a5e0e097746b63d8ee36701dd040e16784df5da2
-
SHA256
1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487
-
SHA512
37fa97795ae202377263b62dce420acad9397c17aefe1ac8ea35be43bd386bdb1aa0a0ef4a0ad659359269a29180bb0036d2c7310e8b511a1136df4ac4afa25d
-
SSDEEP
12288:+MzEoDzA1NLzZJncwAVDZI2r1xZyLA6y3TlWW+X+a3qml9nkDRTXj69mfx:t7wnLzZ0Dr1xP6y3t+Z3Vl9nATzGGx
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-