General
-
Target
2b30c78da77cb01371ef3e1fe61d70608227a5c1784ffe4366cb77461d4323e7
-
Size
4.2MB
-
Sample
230701-3tde9saa45
-
MD5
ea191512e6ed56aa661ecb2deed1623e
-
SHA1
a2198ccd7d00ab727618ca2368f9f8c54b01c5d3
-
SHA256
2b30c78da77cb01371ef3e1fe61d70608227a5c1784ffe4366cb77461d4323e7
-
SHA512
7658e27038f60aa13df49bf48ac90a13cf77ef7e88e16453964b44e1cf9669ad3d06884692288a67a1dd3ffee89ce35e55750227e913bd3193dcc666f8bb8419
-
SSDEEP
98304:sHejdaMKBnK2t4x+GwYIb4jYfCmAcZmPcxkk9cRj5MQL:sHGdaTBnK2tHG2UMdWGLcRWE
Static task
static1
Behavioral task
behavioral1
Sample
2b30c78da77cb01371ef3e1fe61d70608227a5c1784ffe4366cb77461d4323e7.exe
Resource
win7-20230621-en
Malware Config
Extracted
amadey
3.83
5.42.65.80/8bmeVwqx/index.php
Targets
-
-
Target
2b30c78da77cb01371ef3e1fe61d70608227a5c1784ffe4366cb77461d4323e7
-
Size
4.2MB
-
MD5
ea191512e6ed56aa661ecb2deed1623e
-
SHA1
a2198ccd7d00ab727618ca2368f9f8c54b01c5d3
-
SHA256
2b30c78da77cb01371ef3e1fe61d70608227a5c1784ffe4366cb77461d4323e7
-
SHA512
7658e27038f60aa13df49bf48ac90a13cf77ef7e88e16453964b44e1cf9669ad3d06884692288a67a1dd3ffee89ce35e55750227e913bd3193dcc666f8bb8419
-
SSDEEP
98304:sHejdaMKBnK2t4x+GwYIb4jYfCmAcZmPcxkk9cRj5MQL:sHGdaTBnK2tHG2UMdWGLcRWE
-
Modifies security service
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
XMRig Miner payload
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-