General
-
Target
4b9cc0ee2d9c9a88d789249ecb86b1ba
-
Size
10.7MB
-
Sample
231226-ck1lbsgdf6
-
MD5
4b9cc0ee2d9c9a88d789249ecb86b1ba
-
SHA1
64710b02f796d02403901b8cdf1a5ca331f2b037
-
SHA256
7da7a2f8b2d06754ee5f6e4caf7a21528704ed80a08f0cedf25894d84d3dfb88
-
SHA512
781b520f96df3f99e5f92a65e4512603b55ab23359c816c453f2200916fff5fdd2d778c3db158ce603166192207b04058313e52a33ed7bf52b688567209e6248
-
SSDEEP
24576:UjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBX:Unh
Static task
static1
Behavioral task
behavioral1
Sample
4b9cc0ee2d9c9a88d789249ecb86b1ba.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b9cc0ee2d9c9a88d789249ecb86b1ba.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Targets
-
-
Target
4b9cc0ee2d9c9a88d789249ecb86b1ba
-
Size
10.7MB
-
MD5
4b9cc0ee2d9c9a88d789249ecb86b1ba
-
SHA1
64710b02f796d02403901b8cdf1a5ca331f2b037
-
SHA256
7da7a2f8b2d06754ee5f6e4caf7a21528704ed80a08f0cedf25894d84d3dfb88
-
SHA512
781b520f96df3f99e5f92a65e4512603b55ab23359c816c453f2200916fff5fdd2d778c3db158ce603166192207b04058313e52a33ed7bf52b688567209e6248
-
SSDEEP
24576:UjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBX:Unh
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2