General
-
Target
9e503285b627ea4c741a091f08c9bd0a
-
Size
1003KB
-
Sample
240215-xle18sef35
-
MD5
9e503285b627ea4c741a091f08c9bd0a
-
SHA1
bc0580d85ecb1c1f164d61873f02c0b6806fae77
-
SHA256
5d92d079221cc27559e699db67b12bd0ecf9425c722340e1c8717644c5f1cf24
-
SHA512
164c8e3185d20a39335f8afaf47ef9955d57f46c856221096c185fd9cee3e18959c1e19057005b8b29675055167441d99142a108a707aa9d0351f8e7ff9f47c2
-
SSDEEP
24576:Fjo0HWLwdVWFkFIfP926yG0RL0ZzK1xdg6:FjoeWs+bd2IRK1xdg
Static task
static1
Behavioral task
behavioral1
Sample
9e503285b627ea4c741a091f08c9bd0a.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9e503285b627ea4c741a091f08c9bd0a.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
9e503285b627ea4c741a091f08c9bd0a
-
Size
1003KB
-
MD5
9e503285b627ea4c741a091f08c9bd0a
-
SHA1
bc0580d85ecb1c1f164d61873f02c0b6806fae77
-
SHA256
5d92d079221cc27559e699db67b12bd0ecf9425c722340e1c8717644c5f1cf24
-
SHA512
164c8e3185d20a39335f8afaf47ef9955d57f46c856221096c185fd9cee3e18959c1e19057005b8b29675055167441d99142a108a707aa9d0351f8e7ff9f47c2
-
SSDEEP
24576:Fjo0HWLwdVWFkFIfP926yG0RL0ZzK1xdg6:FjoeWs+bd2IRK1xdg
Score10/10-
Modifies WinLogon for persistence
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-