General
-
Target
KXCBDS21.exe
-
Size
6KB
-
Sample
221206-h28wxshe7z
-
MD5
6645e5ca45fe6a10f0b8074e6eb9446d
-
SHA1
55f764b18942e6ec6ae6c8b98cf2cf465cec3d28
-
SHA256
c4a7879913019bb57160451e088ea2cd02386406204af973201ce7ac507c186c
-
SHA512
75310173106c1be9adbd374de49408d96dd024fd7c853195f35bfe8bbf4cf12c0b2be2af3c388dfe35c1f083140a1716b1221772911a2af69cc7166be19163d0
-
SSDEEP
96:MmvzgD79ClVCFjoYD9uJLNjNTyAYxsNvk+W+jD1TIoDcW33jJWw3d3ojXrl:MmU9CKFrDsNjNLYuvkkeW33jJWed8
Static task
static1
Behavioral task
behavioral1
Sample
KXCBDS21.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
KXCBDS21.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
KXCBDS21.exe
-
Size
6KB
-
MD5
6645e5ca45fe6a10f0b8074e6eb9446d
-
SHA1
55f764b18942e6ec6ae6c8b98cf2cf465cec3d28
-
SHA256
c4a7879913019bb57160451e088ea2cd02386406204af973201ce7ac507c186c
-
SHA512
75310173106c1be9adbd374de49408d96dd024fd7c853195f35bfe8bbf4cf12c0b2be2af3c388dfe35c1f083140a1716b1221772911a2af69cc7166be19163d0
-
SSDEEP
96:MmvzgD79ClVCFjoYD9uJLNjNTyAYxsNvk+W+jD1TIoDcW33jJWw3d3ojXrl:MmU9CKFrDsNjNLYuvkkeW33jJWed8
Score10/10-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-