General

  • Target

    508be46ec5246b1d5ce1aaa4593c43c8

  • Size

    438KB

  • Sample

    230125-j2f2ksha8v

  • MD5

    508be46ec5246b1d5ce1aaa4593c43c8

  • SHA1

    f597d8e1b22a35c77e296c95187e974a2ce3ba20

  • SHA256

    11ed21044757efeacdfb3e2b08f35c7ea473f0698b8455655dc115bf30be11db

  • SHA512

    af9768b260914561dcc9150ae1d14cd5c4ed6f09e85d21f3224a90cec802d9689f55ee0461564f5fda37ab564867dbd06c89214327cebba49c3c6f0f7eeb6e1a

  • SSDEEP

    12288:q947a/JjsLZjXYc7X0/aXCKli04OaZ1XAYThF0:gurYc7E/i004OS1ThF0

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://wildmanwildfood.com/wp-admin/wxyadXKXFe/

exe.dropper

https://ashven.co.uk/wp-includes/UwBairqGXVb11tCu/

exe.dropper

https://aigenix.comartstudios.com/cgi-bin/ZZ8HCNr40H/

exe.dropper

https://fastonlineearn.com/wp-content/L/

exe.dropper

https://mbmscaffolding.co.uk/test/3j/

exe.dropper

https://ineslebuhan.com/wp-includes/7dLR8UB3RFfSHd4cZN/

exe.dropper

https://mccoygloballinks.com/cgi-bin/HvZWLrLljiRj2ck/

exe.dropper

http://lonaomer.com/wp-content/6G/

exe.dropper

https://tainformado.com.br/wp-content/0Ysot/

exe.dropper

https://nifdtb.in/wp-content/9uHo3GBgyIQ/

exe.dropper

https://sdn3sajen.stormapp.in/wp-admin/Xc6Z/

exe.dropper

https://narsanat.com/banner/TnIhz/

exe.dropper

https://vanessanascimento.com.br/auren-xbox/cDD2dfW/

exe.dropper

https://medvital.com.br/arquivos/q6ZjbPPoR7l/

exe.dropper

https://mcjalandhar.in/1950-kill/BMoLHJM4g/

exe.dropper

https://nuranabd.com/wp-content/BhYOZ2pJV5q/

exe.dropper

https://sdigitaltv.online/wp-admin/rpRCArrXjpoUXo/

exe.dropper

http://news.leta.com.vn/-/NQOY80o/

Targets

    • Target

      508be46ec5246b1d5ce1aaa4593c43c8

    • Size

      438KB

    • MD5

      508be46ec5246b1d5ce1aaa4593c43c8

    • SHA1

      f597d8e1b22a35c77e296c95187e974a2ce3ba20

    • SHA256

      11ed21044757efeacdfb3e2b08f35c7ea473f0698b8455655dc115bf30be11db

    • SHA512

      af9768b260914561dcc9150ae1d14cd5c4ed6f09e85d21f3224a90cec802d9689f55ee0461564f5fda37ab564867dbd06c89214327cebba49c3c6f0f7eeb6e1a

    • SSDEEP

      12288:q947a/JjsLZjXYc7X0/aXCKli04OaZ1XAYThF0:gurYc7E/i004OS1ThF0

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Tasks