General
-
Target
bbd3d30501e1e00fc7093e0f50a2b91242d0498d494dc4d248b7b8e6be0b67b2
-
Size
1.2MB
-
Sample
221128-w3bvgabd9x
-
MD5
c9c87d62029541b578d66b23583d2b40
-
SHA1
6d13307010382ae18b2eaf3af68194b0420d5e12
-
SHA256
bbd3d30501e1e00fc7093e0f50a2b91242d0498d494dc4d248b7b8e6be0b67b2
-
SHA512
045cef9085734e9ad713b8707f4d9e12f70df72d0f6aa85c33451a4664d1a3f090c30ad640f21a9d4ee68afcac1b3043a721843d5645d91837bcd257404c484f
-
SSDEEP
24576:924mwJoNyJx5XkOtwBVHyz0t0evNOi6JVRhwCUaxxJ4PWb5+Q2QnLJ2:hT5UOKzsV05a775ys2
Static task
static1
Behavioral task
behavioral1
Sample
bbd3d30501e1e00fc7093e0f50a2b91242d0498d494dc4d248b7b8e6be0b67b2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bbd3d30501e1e00fc7093e0f50a2b91242d0498d494dc4d248b7b8e6be0b67b2.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
bbd3d30501e1e00fc7093e0f50a2b91242d0498d494dc4d248b7b8e6be0b67b2
-
Size
1.2MB
-
MD5
c9c87d62029541b578d66b23583d2b40
-
SHA1
6d13307010382ae18b2eaf3af68194b0420d5e12
-
SHA256
bbd3d30501e1e00fc7093e0f50a2b91242d0498d494dc4d248b7b8e6be0b67b2
-
SHA512
045cef9085734e9ad713b8707f4d9e12f70df72d0f6aa85c33451a4664d1a3f090c30ad640f21a9d4ee68afcac1b3043a721843d5645d91837bcd257404c484f
-
SSDEEP
24576:924mwJoNyJx5XkOtwBVHyz0t0evNOi6JVRhwCUaxxJ4PWb5+Q2QnLJ2:hT5UOKzsV05a775ys2
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-