General
-
Target
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2
-
Size
67KB
-
Sample
221125-1jlmsabh2w
-
MD5
c075bcd452d7ff56968ed7a213459bdc
-
SHA1
dc54cdce93f54e1f4089000edfdc4e08428395dd
-
SHA256
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2
-
SHA512
ce7802282e7f000fdd07be60e6442b1099db12a48fd62d6968546a9f0fe7295c56ee047217f944cbb3850e549d5cc9be2d593208897a0c440c927255aae58fc0
-
SSDEEP
768:EPYyLPOo7UDgHdHTtQxzs9yKrGlj0+UKkj0ieAfYRpmeZtp:Eeuhtgs9Xkie8Y3H
Behavioral task
behavioral1
Sample
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2.doc
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2.doc
Resource
win10v2004-20220901-en
Malware Config
Extracted
http://gmedsport.com/plugins/xmlrpc/file.exe
Targets
-
-
Target
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2
-
Size
67KB
-
MD5
c075bcd452d7ff56968ed7a213459bdc
-
SHA1
dc54cdce93f54e1f4089000edfdc4e08428395dd
-
SHA256
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2
-
SHA512
ce7802282e7f000fdd07be60e6442b1099db12a48fd62d6968546a9f0fe7295c56ee047217f944cbb3850e549d5cc9be2d593208897a0c440c927255aae58fc0
-
SSDEEP
768:EPYyLPOo7UDgHdHTtQxzs9yKrGlj0+UKkj0ieAfYRpmeZtp:Eeuhtgs9Xkie8Y3H
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-