General
-
Target
d182c08bed51b78f1dace83a6aa4bdb26954e7c89c9e7c8f8ae0992d6a315934
-
Size
756KB
-
Sample
230222-ta4nnscd83
-
MD5
a9926757f1a1882142e369cc4617d356
-
SHA1
07ef28c5842a5068619a6b30356e46cddbb4fda6
-
SHA256
d182c08bed51b78f1dace83a6aa4bdb26954e7c89c9e7c8f8ae0992d6a315934
-
SHA512
61ec6b4216dd6f9015825f71aa3f9decbde30e90a2bddac3cff5840573e36db62f7689f094c5aab196a8e52e41ec0f4e8c8b4ee20cafa80339284a72daa590b6
-
SSDEEP
12288:VQi3dMjv6m6URA3Phdp1hf39Wkv8xwJZ3Ep:VQiWjChhdpdUMZ0p
Static task
static1
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Extracted
socelars
https://hdbywe.s3.us-west-2.amazonaws.com/sfasue20/
Targets
-
-
Target
d182c08bed51b78f1dace83a6aa4bdb26954e7c89c9e7c8f8ae0992d6a315934
-
Size
756KB
-
MD5
a9926757f1a1882142e369cc4617d356
-
SHA1
07ef28c5842a5068619a6b30356e46cddbb4fda6
-
SHA256
d182c08bed51b78f1dace83a6aa4bdb26954e7c89c9e7c8f8ae0992d6a315934
-
SHA512
61ec6b4216dd6f9015825f71aa3f9decbde30e90a2bddac3cff5840573e36db62f7689f094c5aab196a8e52e41ec0f4e8c8b4ee20cafa80339284a72daa590b6
-
SSDEEP
12288:VQi3dMjv6m6URA3Phdp1hf39Wkv8xwJZ3Ep:VQiWjChhdpdUMZ0p
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Socelars payload
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-