General
-
Target
7c9d12576bf9af2cca6ca1f1f10dd31f
-
Size
186KB
-
Sample
240128-j54l2sgegj
-
MD5
7c9d12576bf9af2cca6ca1f1f10dd31f
-
SHA1
097caf6e02458f15d108989763bde85a2070203c
-
SHA256
115b82cee172aa8e3f830b03f9af5d905751e8df10bba2dc3e54b54bb57bcfb5
-
SHA512
bc4916053804243463abc9fea6200181443c3dfb1c9458e1bde9723db175826807d733f79cbf32865bcf823b5e9bdf393e4f3e837fe7742bb8339951f4f7eb6a
-
SSDEEP
3072:YjbZjtO5rhRgXrktWBrS36xYCuN8XL/vkY9SDPcChewq0Fr8H9aT9:YjbZpO5ng7ktWlS3AYCFTMY9GPvAo
Behavioral task
behavioral1
Sample
7c9d12576bf9af2cca6ca1f1f10dd31f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7c9d12576bf9af2cca6ca1f1f10dd31f.exe
Resource
win10v2004-20231222-en
Malware Config
Targets
-
-
Target
7c9d12576bf9af2cca6ca1f1f10dd31f
-
Size
186KB
-
MD5
7c9d12576bf9af2cca6ca1f1f10dd31f
-
SHA1
097caf6e02458f15d108989763bde85a2070203c
-
SHA256
115b82cee172aa8e3f830b03f9af5d905751e8df10bba2dc3e54b54bb57bcfb5
-
SHA512
bc4916053804243463abc9fea6200181443c3dfb1c9458e1bde9723db175826807d733f79cbf32865bcf823b5e9bdf393e4f3e837fe7742bb8339951f4f7eb6a
-
SSDEEP
3072:YjbZjtO5rhRgXrktWBrS36xYCuN8XL/vkY9SDPcChewq0Fr8H9aT9:YjbZpO5ng7ktWlS3AYCFTMY9GPvAo
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-