General
-
Target
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81
-
Size
172KB
-
Sample
221128-e36w6sag3v
-
MD5
c517194ef951573907186b800ea321c0
-
SHA1
1feb029d3c69d69958b317f8763fdb65d9b2df4d
-
SHA256
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81
-
SHA512
e8925698d7e32fac5b55fe98d7929a40be08b5cb31dac065cdfa8b65016f64eaef4aa6aa774b9ca733f1c72eabac4b6c87e6cd00c063a51d7e78d7a1651d3057
-
SSDEEP
3072:vwHteez3OtcHeZePIv9FTAxd8uGEnIB6P7K0Q0cNVB81VYrc0t1PbvN8KgCLn2J:/ez3OkkBVFTehI87d0WkBbv12J
Static task
static1
Behavioral task
behavioral1
Sample
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81
-
Size
172KB
-
MD5
c517194ef951573907186b800ea321c0
-
SHA1
1feb029d3c69d69958b317f8763fdb65d9b2df4d
-
SHA256
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81
-
SHA512
e8925698d7e32fac5b55fe98d7929a40be08b5cb31dac065cdfa8b65016f64eaef4aa6aa774b9ca733f1c72eabac4b6c87e6cd00c063a51d7e78d7a1651d3057
-
SSDEEP
3072:vwHteez3OtcHeZePIv9FTAxd8uGEnIB6P7K0Q0cNVB81VYrc0t1PbvN8KgCLn2J:/ez3OkkBVFTehI87d0WkBbv12J
Score9/10-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-