General

  • Target

    c785c51f323591a10e971d341779125b40936b2efd5141628146e881a5836b02

  • Size

    88KB

  • Sample

    241115-swj1qawgpk

  • MD5

    92c1ba4a964d971806a5f1e157fa5240

  • SHA1

    65b860262867d8ea2d4a7515af9d19fb4e6a96aa

  • SHA256

    c785c51f323591a10e971d341779125b40936b2efd5141628146e881a5836b02

  • SHA512

    d967726238f856aa79c7c1a5464b4938883544b349004e2fd8b4ccb8a976a75ef34ac2e221866ae5ea2fba46af799903e4075fca8db96f5e3d954d63cdfdefd2

  • SSDEEP

    1536:+yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQspkWvgrPE4nWHPNc2AJ:+yehv7q2Pjx45uoDGTj+5xtekEvi8/d5

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/

exe.dropper

https://1566xueshe.com/wp-includes/z92ZVqHH8/

exe.dropper

http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/

exe.dropper

http://o2omart.co.in/infructuose/m4mgt2MeU/

exe.dropper

http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/

exe.dropper

http://www.ama.cu/jpr/VVP/

exe.dropper

http://actividades.laforetlanguages.com/wp-admin/dU8Ds/

exe.dropper

https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/

exe.dropper

https://edu-media.cn/wp-admin/0JAE/

exe.dropper

https://iacademygroup.cl/office/G42LJPLkl/

exe.dropper

https://znzhou.top/mode/0Qb/

Targets

    • Target

      c785c51f323591a10e971d341779125b40936b2efd5141628146e881a5836b02

    • Size

      88KB

    • MD5

      92c1ba4a964d971806a5f1e157fa5240

    • SHA1

      65b860262867d8ea2d4a7515af9d19fb4e6a96aa

    • SHA256

      c785c51f323591a10e971d341779125b40936b2efd5141628146e881a5836b02

    • SHA512

      d967726238f856aa79c7c1a5464b4938883544b349004e2fd8b4ccb8a976a75ef34ac2e221866ae5ea2fba46af799903e4075fca8db96f5e3d954d63cdfdefd2

    • SSDEEP

      1536:+yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQspkWvgrPE4nWHPNc2AJ:+yehv7q2Pjx45uoDGTj+5xtekEvi8/d5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks