General
-
Target
de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7.exe
-
Size
708KB
-
Sample
241119-xj4a2szmds
-
MD5
e71cfdc85798bbb2a48f40aab4c2ba37
-
SHA1
3142df2e596805f913d03b215393c35286166162
-
SHA256
de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7
-
SHA512
d82cb9b42d7228a51c772f716e06c899b05200b99f49d82db8b7dec625cd898815a917076145517aee4550cda690c94807d17b92e614e2724296102feb251a0c
-
SSDEEP
12288:1S6E/s0yhD7tzPdEn7Nb+U2fljiBuRUVOScmGAltbkb:6U/R16lEiPOScJAi
Static task
static1
Behavioral task
behavioral1
Sample
de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7.exe
-
Size
708KB
-
MD5
e71cfdc85798bbb2a48f40aab4c2ba37
-
SHA1
3142df2e596805f913d03b215393c35286166162
-
SHA256
de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7
-
SHA512
d82cb9b42d7228a51c772f716e06c899b05200b99f49d82db8b7dec625cd898815a917076145517aee4550cda690c94807d17b92e614e2724296102feb251a0c
-
SSDEEP
12288:1S6E/s0yhD7tzPdEn7Nb+U2fljiBuRUVOScmGAltbkb:6U/R16lEiPOScJAi
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-