General
-
Target
d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c
-
Size
159KB
-
Sample
221204-hhrhjaad7v
-
MD5
1b28fc597bf19d9c96be3ecd8424de63
-
SHA1
66bcfe8638912a0991911aab7cb2f95fe9245df7
-
SHA256
d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c
-
SHA512
a128c6b3243c9bce2aefd85b57650f4e7dcfee574860902daa1d1a7832d8e964d3d32c1446d68c737eaa9d6ba734e26592af174fae5c2917c47432928b077cf0
-
SSDEEP
3072:EZ4++394Pf3xI2fmFxaQOjCr33x0hB1ARNUYzdpQMJrly:EZ4++3y30FxLZHyhBKRiUVrl
Static task
static1
Behavioral task
behavioral1
Sample
d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c
-
Size
159KB
-
MD5
1b28fc597bf19d9c96be3ecd8424de63
-
SHA1
66bcfe8638912a0991911aab7cb2f95fe9245df7
-
SHA256
d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c
-
SHA512
a128c6b3243c9bce2aefd85b57650f4e7dcfee574860902daa1d1a7832d8e964d3d32c1446d68c737eaa9d6ba734e26592af174fae5c2917c47432928b077cf0
-
SSDEEP
3072:EZ4++394Pf3xI2fmFxaQOjCr33x0hB1ARNUYzdpQMJrly:EZ4++3y30FxLZHyhBKRiUVrl
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-