43f40a78d3e447655b12c956bcbd64540d19f774216858dfb0791cdbb492ea07

General

Target
MT_26009786_45342023_TXT.vbs
Size 396KB
Sample230201-slrmtaac74
SHA256 43f40a78d3e447655b12c956bcbd64540d19f774216858dfb0791cdbb492ea07
MD5 3d0a93057793efef0c46b3548092097c
SHA1 5f794fc15e991c2e5935c47b9eb069400ebf2054
SHA512 fadad465d14088868548d3c7d50a27fd333da044cb2c18163aab649a4190a163d4971a20e69d0088097c2a47110521771e485da20cef421f5f109934c8d290f5
SSDEEP 192:fQIov4+++++TI+++++S+++++u+C+++++B+++++oRUAzHN+++++o+++++o+++++oG:fM26UjH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
http://172.174.176.153/dll/NoStartUp.ppam

Targets

- Target
  MT_26009786_45342023_TXT.vbs
- Size 396KB
- SHA256 43f40a78d3e447655b12c956bcbd64540d19f774216858dfb0791cdbb492ea07
- MD5 3d0a93057793efef0c46b3548092097c
- SHA1 5f794fc15e991c2e5935c47b9eb069400ebf2054
- SHA512 fadad465d14088868548d3c7d50a27fd333da044cb2c18163aab649a4190a163d4971a20e69d0088097c2a47110521771e485da20cef421f5f109934c8d290f5
- SSDEEP 192:fQIov4+++++TI+++++S+++++u+C+++++B+++++oRUAzHN+++++o+++++o+++++oG:fM26UjH
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2