General
- Target Копия трудовой.docx.rar
- Size 1.6MB
- Sample240625-pre97ashqk
- SHA256 fb28ec498a67d1cf4ebcbb358d1cad0ab86eada614198bdd5dfe3c61e464c1e7
Score
10/10
Malware Config
Targets
-
- Target Копия трудовой.docx.rar
- Size 1.6MB
- SHA256 fb28ec498a67d1cf4ebcbb358d1cad0ab86eada614198bdd5dfe3c61e464c1e7
Score3/10 -
- Target Копия трудовой.docx.exe
- Size 1.8MB
- SHA256 60414e88a21df60b0caccdf498b41aa7c75c10d880ab61a620f5b13ba2faebd1
Score8/10Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
-
- Target $TEMP/Copy_trydovoj.docx
- Size 1.5MB
- SHA256 8646226f4b2b2b96d5e31d4daae0ac5484edc2a7759297e0f63a06358ea61a38
Score4/10 -
- Target $TEMP/putin_hyilo.exe
- Size 176KB
- SHA256 6e9d23e7b4a677651ccb362fa6833ca13deef184a45a801cb1d7d1f542210809
Score10/10DarkTrack
DarkTrack is a remote administration tool written in delphi.
DarkTrack payload
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Suspicious use of SetThreadContext