General
-
Target
be9412060a9d41f496e907a637096255fa848a8ecb4bb4b35043f2e71ca871f6.exe
-
Size
560KB
-
Sample
241107-rnfgwstfld
-
MD5
8d67009d0a7a4b5feb69b4d1e14df73c
-
SHA1
e7e25fc3c7816bee6b094525a894e8a7c0b18848
-
SHA256
be9412060a9d41f496e907a637096255fa848a8ecb4bb4b35043f2e71ca871f6
-
SHA512
987bf51639d9602c51ced91356f6f73e122c1693335c4c0b36608705008cd490a3d845560a14d39d2e3f2ce67fbf0870d226d5a32030fb258b8f2b455a1861c6
-
SSDEEP
12288:SCfiaVM5GHMoVZYL0VCFQYAAA22zQ5I/slShaMZucL7kp:SYiJ5kVZglAB22zQ56Lja
Static task
static1
Behavioral task
behavioral1
Sample
be9412060a9d41f496e907a637096255fa848a8ecb4bb4b35043f2e71ca871f6.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
be9412060a9d41f496e907a637096255fa848a8ecb4bb4b35043f2e71ca871f6.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
be9412060a9d41f496e907a637096255fa848a8ecb4bb4b35043f2e71ca871f6.exe
-
Size
560KB
-
MD5
8d67009d0a7a4b5feb69b4d1e14df73c
-
SHA1
e7e25fc3c7816bee6b094525a894e8a7c0b18848
-
SHA256
be9412060a9d41f496e907a637096255fa848a8ecb4bb4b35043f2e71ca871f6
-
SHA512
987bf51639d9602c51ced91356f6f73e122c1693335c4c0b36608705008cd490a3d845560a14d39d2e3f2ce67fbf0870d226d5a32030fb258b8f2b455a1861c6
-
SSDEEP
12288:SCfiaVM5GHMoVZYL0VCFQYAAA22zQ5I/slShaMZucL7kp:SYiJ5kVZglAB22zQ56Lja
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2