General
-
Target
U3wiR5s9Rw.exe
-
Size
3.0MB
-
Sample
240223-npjn6afg96
-
MD5
95fa0324e5c4fb381d26dae7c0b9fbd5
-
SHA1
f8557d98c6f7fd1111aab7a71c74bec9395e9fbb
-
SHA256
52fe9f423aa1e4a763fb5b012095bcd6a91819038803ab35e9b26ec676304821
-
SHA512
7596a24c786ba54aa89078f9668116b5d9b9af3a0cb2c35d96bcb9fe2724564c76020c512a3d1df830887e751a61a05df5c6799e3fd53f06800f242cf239fc7c
-
SSDEEP
49152:RcEeTCc/TqjAtennuhRVCuvxVgfId7/jwl5phlJAq3pXtMyFqeDNerQfWQAo:WEWN4uvXgm/W5pP37MheMLQl
Static task
static1
Behavioral task
behavioral1
Sample
U3wiR5s9Rw.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
U3wiR5s9Rw.exe
Resource
win10v2004-20240221-en
Malware Config
Targets
-
-
Target
U3wiR5s9Rw.exe
-
Size
3.0MB
-
MD5
95fa0324e5c4fb381d26dae7c0b9fbd5
-
SHA1
f8557d98c6f7fd1111aab7a71c74bec9395e9fbb
-
SHA256
52fe9f423aa1e4a763fb5b012095bcd6a91819038803ab35e9b26ec676304821
-
SHA512
7596a24c786ba54aa89078f9668116b5d9b9af3a0cb2c35d96bcb9fe2724564c76020c512a3d1df830887e751a61a05df5c6799e3fd53f06800f242cf239fc7c
-
SSDEEP
49152:RcEeTCc/TqjAtennuhRVCuvxVgfId7/jwl5phlJAq3pXtMyFqeDNerQfWQAo:WEWN4uvXgm/W5pP37MheMLQl
Score8/10-
Downloads MZ/PE file
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-