General
-
Target
setup.exe
-
Size
4.5MB
-
Sample
230327-a2bx7aag32
-
MD5
369e7a430bab9b7a043b5ea1bd1496b2
-
SHA1
23eb3090bc77349f079ef516024bac184c9afdcf
-
SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3
-
SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3
-
SSDEEP
98304:RS8Xb8gXnHsttAjzt9p207rzQHZpAF7wIBECqHto:JXnMIB2IUpLIBEvHt
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Malware Config
Extracted
amadey
3.65
77.73.134.27/8bmdh3Slb2/index.php
Targets
-
-
Target
setup.exe
-
Size
4.5MB
-
MD5
369e7a430bab9b7a043b5ea1bd1496b2
-
SHA1
23eb3090bc77349f079ef516024bac184c9afdcf
-
SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3
-
SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3
-
SSDEEP
98304:RS8Xb8gXnHsttAjzt9p207rzQHZpAF7wIBECqHto:JXnMIB2IUpLIBEvHt
-
Modifies security service
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
XMRig Miner payload
-
Downloads MZ/PE file
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-