General
-
Target
2d1c098777f4ab2d1ffea0bc5e647bd0470782f31133e5bbc89edf5875605566
-
Size
2.0MB
-
Sample
221128-pnymcsch46
-
MD5
a3efe19d04e31877782d18e253b1cb12
-
SHA1
219555a28860f8cc477e63a14f06a549fd104e49
-
SHA256
2d1c098777f4ab2d1ffea0bc5e647bd0470782f31133e5bbc89edf5875605566
-
SHA512
1c246968a8890b7a8a11f7d9137603e8c2ee4542c3762c219515814fe5fa0caf9c30aa2d5292f9340446d0e4e824eac5e28771ec0c299ca7e494fa7654bc0a2d
-
SSDEEP
24576:k2O/GlojR3l+4Cct6kBr/iiIw8S+1ZJdh52uuvX2zy8BQZFwxFmr7g6zwzRQegxG:QrhvBr/iDwVEfuvWVBxUr5k1t8A
Static task
static1
Behavioral task
behavioral1
Sample
2d1c098777f4ab2d1ffea0bc5e647bd0470782f31133e5bbc89edf5875605566.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2d1c098777f4ab2d1ffea0bc5e647bd0470782f31133e5bbc89edf5875605566.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
2d1c098777f4ab2d1ffea0bc5e647bd0470782f31133e5bbc89edf5875605566
-
Size
2.0MB
-
MD5
a3efe19d04e31877782d18e253b1cb12
-
SHA1
219555a28860f8cc477e63a14f06a549fd104e49
-
SHA256
2d1c098777f4ab2d1ffea0bc5e647bd0470782f31133e5bbc89edf5875605566
-
SHA512
1c246968a8890b7a8a11f7d9137603e8c2ee4542c3762c219515814fe5fa0caf9c30aa2d5292f9340446d0e4e824eac5e28771ec0c299ca7e494fa7654bc0a2d
-
SSDEEP
24576:k2O/GlojR3l+4Cct6kBr/iiIw8S+1ZJdh52uuvX2zy8BQZFwxFmr7g6zwzRQegxG:QrhvBr/iDwVEfuvWVBxUr5k1t8A
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-