General
-
Target
879746e2b812857a8f9101eedf2ed86a66fb00c30d98254d4caf8bffe793a60f
-
Size
408KB
-
Sample
221202-1wwcrahb77
-
MD5
ba0010c7b17f06f067014eb32d17cdf6
-
SHA1
ce1cf47d74c7b3aba3647ce3c5c5c7720644d223
-
SHA256
879746e2b812857a8f9101eedf2ed86a66fb00c30d98254d4caf8bffe793a60f
-
SHA512
ef44a06184b00e9270aa4ff24e93781a16722be6f62de3b78ca716adc424d408358ea9c8e13c0ca5f2e24788baa40995f5f55274579cbc974f2d784a6fc638bd
-
SSDEEP
12288:jjxv2nebwy/Lzpc92s3mA0Imm1XSCT+rPK:jF+nuwy/e2s2A02RmK
Static task
static1
Behavioral task
behavioral1
Sample
879746e2b812857a8f9101eedf2ed86a66fb00c30d98254d4caf8bffe793a60f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
879746e2b812857a8f9101eedf2ed86a66fb00c30d98254d4caf8bffe793a60f.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
879746e2b812857a8f9101eedf2ed86a66fb00c30d98254d4caf8bffe793a60f
-
Size
408KB
-
MD5
ba0010c7b17f06f067014eb32d17cdf6
-
SHA1
ce1cf47d74c7b3aba3647ce3c5c5c7720644d223
-
SHA256
879746e2b812857a8f9101eedf2ed86a66fb00c30d98254d4caf8bffe793a60f
-
SHA512
ef44a06184b00e9270aa4ff24e93781a16722be6f62de3b78ca716adc424d408358ea9c8e13c0ca5f2e24788baa40995f5f55274579cbc974f2d784a6fc638bd
-
SSDEEP
12288:jjxv2nebwy/Lzpc92s3mA0Imm1XSCT+rPK:jF+nuwy/e2s2A02RmK
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-