General
-
Target
afc2e82908e33ed18369797088e118c93880c07ed785946f6a351aa8bef739fc
-
Size
312KB
-
Sample
221229-wqpkssgh8t
-
MD5
88e84db01e522fe947af3f5359fa7fa4
-
SHA1
90b859b5f355d9c5fa8500a403d16fd38f53a79f
-
SHA256
afc2e82908e33ed18369797088e118c93880c07ed785946f6a351aa8bef739fc
-
SHA512
0a7452621387c5e4009de2a78e531f1c2fd3f0a1964dc2f97066fb70af3ef30f19bd53def44cf0c41658f6faa81663153652886d497ae1aa0670218e14c376c5
-
SSDEEP
6144:DLt0OQU1eXjJQX1G9AEsLbMSmLDsxyIxZ1WqqdS09R:Dh0OQU4XjJQX1VV/dYX
Static task
static1
Behavioral task
behavioral1
Sample
afc2e82908e33ed18369797088e118c93880c07ed785946f6a351aa8bef739fc.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
afc2e82908e33ed18369797088e118c93880c07ed785946f6a351aa8bef739fc
-
Size
312KB
-
MD5
88e84db01e522fe947af3f5359fa7fa4
-
SHA1
90b859b5f355d9c5fa8500a403d16fd38f53a79f
-
SHA256
afc2e82908e33ed18369797088e118c93880c07ed785946f6a351aa8bef739fc
-
SHA512
0a7452621387c5e4009de2a78e531f1c2fd3f0a1964dc2f97066fb70af3ef30f19bd53def44cf0c41658f6faa81663153652886d497ae1aa0670218e14c376c5
-
SSDEEP
6144:DLt0OQU1eXjJQX1G9AEsLbMSmLDsxyIxZ1WqqdS09R:Dh0OQU4XjJQX1VV/dYX
-
Detects Smokeloader packer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-