General
-
Target
AltiumWare.exe
-
Size
62KB
-
Sample
230609-wzcycsch87
-
MD5
1b86683ebd369bc586d28a2daf80c079
-
SHA1
4d1f3b39d8d167b8acc6d5062e4412428625b037
-
SHA256
ceba60f00ec9b0f5ebbd3cdddec92f1786fb8452500b0e638d89fdf58b42043e
-
SHA512
67ea72d1c6768a42c21523449ee166595defb25ee51cc67541928efb649b37f861ed2cc743f9b6f819ba4c16a5ac87810703c7c80fe04e6b1e76f8ee7ff758fe
-
SSDEEP
1536:A9O/WhPWyAD6DyGsZCwGaveWAbd3DJilUrIiv4:A9RXAOaZUA4bd3DJi
Static task
static1
Behavioral task
behavioral1
Sample
AltiumWare.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
https://pastebin.com/raw/ptzF3i2f
Targets
-
-
Target
AltiumWare.exe
-
Size
62KB
-
MD5
1b86683ebd369bc586d28a2daf80c079
-
SHA1
4d1f3b39d8d167b8acc6d5062e4412428625b037
-
SHA256
ceba60f00ec9b0f5ebbd3cdddec92f1786fb8452500b0e638d89fdf58b42043e
-
SHA512
67ea72d1c6768a42c21523449ee166595defb25ee51cc67541928efb649b37f861ed2cc743f9b6f819ba4c16a5ac87810703c7c80fe04e6b1e76f8ee7ff758fe
-
SSDEEP
1536:A9O/WhPWyAD6DyGsZCwGaveWAbd3DJilUrIiv4:A9RXAOaZUA4bd3DJi
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-