General

  • Target

    b8b792ab4a5676ee232d98a0b5778893679c10d53c066e94780e3a4ceab53271

  • Size

    88KB

  • Sample

    241113-j6swyaxmh1

  • MD5

    b47e95ab49ef7192f067c401bc67fc08

  • SHA1

    3f1e54cfa2ff8154538d002a62b38ddcbb08b63b

  • SHA256

    b8b792ab4a5676ee232d98a0b5778893679c10d53c066e94780e3a4ceab53271

  • SHA512

    ab60e962d680ca1a99e21dc3be4b5336c179278002310a48c6a6c66e76f6781d0f218c2c7a46c2108be5113d7f40fa4d9d286fb45a5adac7bd0d44bb7cd03e28

  • SSDEEP

    1536:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAFkWvgrPE4nWHPNc2AZ:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dR

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/

exe.dropper

https://1566xueshe.com/wp-includes/z92ZVqHH8/

exe.dropper

http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/

exe.dropper

http://o2omart.co.in/infructuose/m4mgt2MeU/

exe.dropper

http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/

exe.dropper

http://www.ama.cu/jpr/VVP/

exe.dropper

http://actividades.laforetlanguages.com/wp-admin/dU8Ds/

exe.dropper

https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/

exe.dropper

https://edu-media.cn/wp-admin/0JAE/

exe.dropper

https://iacademygroup.cl/office/G42LJPLkl/

exe.dropper

https://znzhou.top/mode/0Qb/

Targets

    • Target

      b8b792ab4a5676ee232d98a0b5778893679c10d53c066e94780e3a4ceab53271

    • Size

      88KB

    • MD5

      b47e95ab49ef7192f067c401bc67fc08

    • SHA1

      3f1e54cfa2ff8154538d002a62b38ddcbb08b63b

    • SHA256

      b8b792ab4a5676ee232d98a0b5778893679c10d53c066e94780e3a4ceab53271

    • SHA512

      ab60e962d680ca1a99e21dc3be4b5336c179278002310a48c6a6c66e76f6781d0f218c2c7a46c2108be5113d7f40fa4d9d286fb45a5adac7bd0d44bb7cd03e28

    • SSDEEP

      1536:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAFkWvgrPE4nWHPNc2AZ:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dR

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks