Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98d5b16f16749f0050b5ff64c3b611f460abe079e9c895861e98770894da0442

  • Size

    12KB

  • Sample

    240523-crj7xsae35

  • MD5

    9ec6f0c4cecd543da8b08e13da2eadc5

  • SHA1

    0e598c70ae358ada7970de5bb2d30422264f494a

  • SHA256

    98d5b16f16749f0050b5ff64c3b611f460abe079e9c895861e98770894da0442

  • SHA512

    d5561578af4901be129fbb95a4e180acfd3c4bebc09a939a507c0c5f3767bfa21190a08ba6d1bd3a59d4d181a6db424dd96d04e9de8fa95bf78b5fe6e301d8e7

  • SSDEEP

    192:qL29RBzDzeobchBj8JONNONrrucrEPEjr7Aha:U29jnbcvYJOKNucvr7Ca

Score
10/10
execution

Malware Config

Extracted

Language
xlm4.0
Source

Targets

    • Target

      98d5b16f16749f0050b5ff64c3b611f460abe079e9c895861e98770894da0442

    • Size

      12KB

    • MD5

      9ec6f0c4cecd543da8b08e13da2eadc5

    • SHA1

      0e598c70ae358ada7970de5bb2d30422264f494a

    • SHA256

      98d5b16f16749f0050b5ff64c3b611f460abe079e9c895861e98770894da0442

    • SHA512

      d5561578af4901be129fbb95a4e180acfd3c4bebc09a939a507c0c5f3767bfa21190a08ba6d1bd3a59d4d181a6db424dd96d04e9de8fa95bf78b5fe6e301d8e7

    • SSDEEP

      192:qL29RBzDzeobchBj8JONNONrrucrEPEjr7Aha:U29jnbcvYJOKNucvr7Ca

    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks