General
-
Target
e16a1636178f7578ec3a8c2e01d5673d
-
Size
13.9MB
-
Sample
240327-l54cdshh23
-
MD5
e16a1636178f7578ec3a8c2e01d5673d
-
SHA1
97b042f50e387a3b0d2ee85d5eb2aae0acfe95d8
-
SHA256
3c4eaac9677eb1914de497e824c3f384d2dcb6de8f95cfa4df5759e2c7f6549a
-
SHA512
412ae1c96bcd02af7f8b8badf2fc30b8ac25cb41524d45ccd7902733d0684773cf506cf434ec7fa5037ee8895c360d7157ce3ef3a11dadf3bef94d53a8ea45b7
-
SSDEEP
12288:Gl5qOcvT9o+egMU+HoWfprc0sssssssssssssssssssssssssssssssssssssssI:ScvT9ofeqrc
Static task
static1
Behavioral task
behavioral1
Sample
e16a1636178f7578ec3a8c2e01d5673d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e16a1636178f7578ec3a8c2e01d5673d.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Targets
-
-
Target
e16a1636178f7578ec3a8c2e01d5673d
-
Size
13.9MB
-
MD5
e16a1636178f7578ec3a8c2e01d5673d
-
SHA1
97b042f50e387a3b0d2ee85d5eb2aae0acfe95d8
-
SHA256
3c4eaac9677eb1914de497e824c3f384d2dcb6de8f95cfa4df5759e2c7f6549a
-
SHA512
412ae1c96bcd02af7f8b8badf2fc30b8ac25cb41524d45ccd7902733d0684773cf506cf434ec7fa5037ee8895c360d7157ce3ef3a11dadf3bef94d53a8ea45b7
-
SSDEEP
12288:Gl5qOcvT9o+egMU+HoWfprc0sssssssssssssssssssssssssssssssssssssssI:ScvT9ofeqrc
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2