General
-
Target
6cb1d245920799a1cc2dd8ee69e052d8.exe
-
Size
7KB
-
Sample
221124-s1bvxagd2s
-
MD5
6cb1d245920799a1cc2dd8ee69e052d8
-
SHA1
29ff603adab927d52c4e9ec2746857ae26bdccc0
-
SHA256
22d33f1ffa8eb0c8b180c01fa01c71f5c2662bd4283eea6921c4c47772edd5b3
-
SHA512
3d71f7380502281fd05bb57098bddc506b000c41b1ff89572282709f0dbc2b508d2e75d2157c4562ea2f6b8e9eea42006c01d8002ba142387865856ac7c52d99
-
SSDEEP
192:B/wgnOh5hs9+w226iGrk3wi3OV5Yi3zMWu3Wg:B/wgnx9+wAKwi3OVGi3zMWu3W
Static task
static1
Behavioral task
behavioral1
Sample
6cb1d245920799a1cc2dd8ee69e052d8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6cb1d245920799a1cc2dd8ee69e052d8.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\FILE RECOVERY.txt
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Extracted
C:\FILE RECOVERY.txt
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Targets
-
-
Target
6cb1d245920799a1cc2dd8ee69e052d8.exe
-
Size
7KB
-
MD5
6cb1d245920799a1cc2dd8ee69e052d8
-
SHA1
29ff603adab927d52c4e9ec2746857ae26bdccc0
-
SHA256
22d33f1ffa8eb0c8b180c01fa01c71f5c2662bd4283eea6921c4c47772edd5b3
-
SHA512
3d71f7380502281fd05bb57098bddc506b000c41b1ff89572282709f0dbc2b508d2e75d2157c4562ea2f6b8e9eea42006c01d8002ba142387865856ac7c52d99
-
SSDEEP
192:B/wgnOh5hs9+w226iGrk3wi3OV5Yi3zMWu3Wg:B/wgnx9+wAKwi3OVGi3zMWu3W
Score10/10-
Clears Windows event logs
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Modifies file permissions
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Indicator Removal on Host
1File Deletion
2Impair Defenses
1File Permissions Modification
1Modify Registry
2