General
-
Target
IRMT.-.Installer.exe
-
Size
4.2MB
-
Sample
230322-qgqhvagh93
-
MD5
9cbc140590014ce28be3f5d8902254d8
-
SHA1
f2379eb6f3805b86bec34cb028ff6241d9f91301
-
SHA256
72a338c0522fa2a6895514bbd917ac2111f4f88c1d0cc4a3d2c265a488063806
-
SHA512
fc857319b1232383eb42fa4eca49b6ccc181000d37ab36de0f66faffb3ed8ebecba8ddef1bf8ad9b638d3c7cbf867b726cbf82f64337ca877ebadf6ac4fdeb44
-
SSDEEP
98304:d0dXZBh+denJha/4FJ5fwHUB9R9QdKXL9Ki23ST+:d+ZBh5nJkaJ5oHS9YivJ+
Static task
static1
Malware Config
Targets
-
-
Target
IRMT.-.Installer.exe
-
Size
4.2MB
-
MD5
9cbc140590014ce28be3f5d8902254d8
-
SHA1
f2379eb6f3805b86bec34cb028ff6241d9f91301
-
SHA256
72a338c0522fa2a6895514bbd917ac2111f4f88c1d0cc4a3d2c265a488063806
-
SHA512
fc857319b1232383eb42fa4eca49b6ccc181000d37ab36de0f66faffb3ed8ebecba8ddef1bf8ad9b638d3c7cbf867b726cbf82f64337ca877ebadf6ac4fdeb44
-
SSDEEP
98304:d0dXZBh+denJha/4FJ5fwHUB9R9QdKXL9Ki23ST+:d+ZBh5nJkaJ5oHS9YivJ+
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-