General
-
Target
42da9414a2faba94899ebaa84cd32841ac30db80d655c5be4d32ef568cc35014
-
Size
6.6MB
-
Sample
221130-p9z3bacd66
-
MD5
b4d453087720b8fbf93147c039f4f8fb
-
SHA1
cfc9c30a92a61d0009bc4e21a1a808180d278218
-
SHA256
42da9414a2faba94899ebaa84cd32841ac30db80d655c5be4d32ef568cc35014
-
SHA512
1d498db675a631d91821786ef657d94814eadc8fc6062ad8256692bd5cf3e35632fce94e96d4672993b0fa36ed424cd7815d3ba81862ce0a75df4feebe9e9c51
-
SSDEEP
98304:9Xz+/uvg6x/emUKoJV5ElkmPNJgpEdneZi+H02YqAQcmJ3Q/mUfBA9qcu1ccH6i1:FK21H5WV5ElzMpYXY0fBQcb7BA2hHf
Static task
static1
Behavioral task
behavioral1
Sample
42da9414a2faba94899ebaa84cd32841ac30db80d655c5be4d32ef568cc35014.exe
Resource
win7-20221111-en
Malware Config
Targets
-
-
Target
42da9414a2faba94899ebaa84cd32841ac30db80d655c5be4d32ef568cc35014
-
Size
6.6MB
-
MD5
b4d453087720b8fbf93147c039f4f8fb
-
SHA1
cfc9c30a92a61d0009bc4e21a1a808180d278218
-
SHA256
42da9414a2faba94899ebaa84cd32841ac30db80d655c5be4d32ef568cc35014
-
SHA512
1d498db675a631d91821786ef657d94814eadc8fc6062ad8256692bd5cf3e35632fce94e96d4672993b0fa36ed424cd7815d3ba81862ce0a75df4feebe9e9c51
-
SSDEEP
98304:9Xz+/uvg6x/emUKoJV5ElkmPNJgpEdneZi+H02YqAQcmJ3Q/mUfBA9qcu1ccH6i1:FK21H5WV5ElzMpYXY0fBQcb7BA2hHf
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets DLL path for service in the registry
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Modifies WinLogon
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Registry Run Keys / Startup Folder
1Hidden Files and Directories
2Winlogon Helper DLL
1