General
-
Target
96e66719028bcc98ba86fef16ce7acd4a056c5143af9748a02a268380aedb29b
-
Size
2.1MB
-
Sample
221127-kxwrxadh57
-
MD5
459c65a890bd3c0f52be76b859ede9b9
-
SHA1
b451cd2a3f1dfcc6cf54cb7d70d77026a7e657cc
-
SHA256
96e66719028bcc98ba86fef16ce7acd4a056c5143af9748a02a268380aedb29b
-
SHA512
6e02c8950c464df02b180206def791e4a95a1029a355125fdde0dbde6345efad8ef6ae03a24a5fd93a465c538f3d4d49df09599d91ee299f4caebaf0d891e151
-
SSDEEP
49152:xnI+3haRPkfiaYeSqVKGPzReJ6xXxaEcT9Y:p3haRU7VL9eUkv
Static task
static1
Behavioral task
behavioral1
Sample
96e66719028bcc98ba86fef16ce7acd4a056c5143af9748a02a268380aedb29b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
96e66719028bcc98ba86fef16ce7acd4a056c5143af9748a02a268380aedb29b.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
96e66719028bcc98ba86fef16ce7acd4a056c5143af9748a02a268380aedb29b
-
Size
2.1MB
-
MD5
459c65a890bd3c0f52be76b859ede9b9
-
SHA1
b451cd2a3f1dfcc6cf54cb7d70d77026a7e657cc
-
SHA256
96e66719028bcc98ba86fef16ce7acd4a056c5143af9748a02a268380aedb29b
-
SHA512
6e02c8950c464df02b180206def791e4a95a1029a355125fdde0dbde6345efad8ef6ae03a24a5fd93a465c538f3d4d49df09599d91ee299f4caebaf0d891e151
-
SSDEEP
49152:xnI+3haRPkfiaYeSqVKGPzReJ6xXxaEcT9Y:p3haRU7VL9eUkv
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-