7eb867f042e18a305f56ceaeccbfabf268d37e7bf5bed16949dd327ed677455a

Sharing

Copy URL Twitter E-mail

General

Target
bIQtS34.exe
Size 1.4MB
Sample250609-l4vnvsdn9v
SHA256 7eb867f042e18a305f56ceaeccbfabf268d37e7bf5bed16949dd327ed677455a
MD5 095622c26093b479898908fbed410c08
SHA1 a2bbaafb9c4d8bc5eeae9e65635894613d57603a
SHA512 aee0f00e9a0b60b57af9c16a8ebcab9aec295a57833849c18c7e1fa9b2827b523c7a26848d2c5987f8d5aa4652e9e9f569da4db8f60088febab2c15edd19ec76
SSDEEP 24576:90aJNw46Cp0n8ir8h9wjEGAYB5ND9tEPGg4ImXRMv/dNpN+kHTjYP5R7AVB4a8qJ:9fb6CtA8Mjb5nEPGg4TRMvFNpNHTsP5g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery

Malware Config

Targets

- Target
  bIQtS34.exe
- Size 1.4MB
- SHA256 7eb867f042e18a305f56ceaeccbfabf268d37e7bf5bed16949dd327ed677455a
- MD5 095622c26093b479898908fbed410c08
- SHA1 a2bbaafb9c4d8bc5eeae9e65635894613d57603a
- SHA512 aee0f00e9a0b60b57af9c16a8ebcab9aec295a57833849c18c7e1fa9b2827b523c7a26848d2c5987f8d5aa4652e9e9f569da4db8f60088febab2c15edd19ec76
- SSDEEP 24576:90aJNw46Cp0n8ir8h9wjEGAYB5ND9tEPGg4ImXRMv/dNpN+kHTjYP5R7AVB4a8qJ:9fb6CtA8Mjb5nEPGg4TRMvFNpNHTsP5g
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  $TEMP/Cement.potx
- Size 73KB
- SHA256 585a0f9cbe7f698ad2a32785e728e0a200aa82e9eb75e1f77879cb430b7c1138
- MD5 39cb16bbf842806216dc3ef1fb245103
- SHA1 3c5df8b91116981ce96456d76d759b8da88eb8b5
- SHA512 f8ff844deac04abb099ef81bbbb91d4d7a4368de46142bc99284a8aaae7f6bdf37e8b7a846250eb1018ae6b5a10bd1ed11b042b980f7879a68ff3f8a0a426f44
- SSDEEP 1536:SXvTpQruB556vaqsGxtLOuK+ipY1hxCUIpW1cgTugKxxWqy0BcXWb:cH58v9kC17n1cnC0t
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  $TEMP/Cotton.potx
- Size 90KB
- SHA256 8004c218895b7af3dcbcdce4212a0c49c2873d0835ce68b36d683a068e645076
- MD5 d64638e49a9ca7d53a91397740944b3d
- SHA1 c7fb20916df7e32605006b7f60f0aea23758e3ae
- SHA512 f9c70158b932045f75b76f476f6508821ae9c4b499927220e037720b8306d46d295125e7823526e15ffcde555f94ab658b0e801bd285e1f0bec118ff0a6eb395
- SSDEEP 1536:EKRDhRnbfJS+9kNyLJ3O6s0pY6aPM/QIu3N8ypSXw1iSWGjyd49cpM80V:ZN9ieO67pY6lQ5B1l5jyOepSV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3
- Target
  $TEMP/Field.potx
- Size 95KB
- SHA256 7c45786ba35a17a7d3b9cac9f45ad64af1f313b6eb96d910a8b28f88c3c2cb51
- MD5 734a1552372b11182cbfb499fe103717
- SHA1 611d26ce6bb9e4a3ba7633bc37e0c6cfa8ca28a6
- SHA512 6e614b0e30a193ce6b2e54660d48d0e333aeb280cbab1cf0161b18de003edc2e12b956445e260af8ccc86afe19dba74e40dee245813079065dd91bcdcfa9b6d3
- SSDEEP 1536:/g4IrodpgA99hmuDStXPtXXncaOfthcVz0ceAxLT9ecoZD/oGrc+C8ZFCpU9I9W5:/WsMA9nKXPtXXncau6z03u1exwbQUd9+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  $TEMP/Fwd.potx
- Size 96KB
- SHA256 cf0fa557ca5a7d3818ad5559dcf07e7c9553e29bb67b39c8aa1aeecc6741cd1e
- MD5 db37c2c8956bbf81dc30e2df4e805c56
- SHA1 285257e839968b35f7d2c8b34a5d8fd3e137133b
- SHA512 be9e9315e97b88682395f8fe91b577d625cdcb8d454b3a0fd8a5d8ae9955600150a6e002c9a8904b1e1d81802c411637fecc182adc63113d1d9fe3e9211367e9
- SSDEEP 1536:+SQQ30np5DAKi5r0CWjAOKdwej409q5xENzssyISZTySwDLYHoLf+YhXYHSJ43/U:inrg5QCGA3RV93NztYySwXYH8WYxP4vU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  $TEMP/Jose.potx
- Size 58KB
- SHA256 a8c1087dbfd742ba82d0b141f1c1ba1ed539ed3dd7db7d8cd4edaab3ac63a3fb
- MD5 a65089fbe6a338a41493d12912c87535
- SHA1 f3b04244af853793195310b2be01bf87eb8ca895
- SHA512 82fd20c6d07d52234f4e87b84fd54f195bf7d2b477c10293485225973270eaec164dcf6fbd7bc70cb9d5f1d4dfe5d8861fe645fae58411bc288dd19c3ec84d1d
- SSDEEP 1536:qUZI5qtyGtV6spkwAhVXVHw7hKhMCo4qAE+55FZM7:qWI5qkYxkwAhVXlKhKW4X/PFO7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  $TEMP/Mail.potx
- Size 78KB
- SHA256 8cb46088b3d36d775037f0ed9370e350d3d923cbdcd293e2d893771518de4b4a
- MD5 5a5bda61a3366a0c2918d989abd3aaf3
- SHA1 ab5f1670a8053d3621d57a965e9a4320e46cf24c
- SHA512 2bdb296b30bcb60d34b336c117e6866d544039a4e4080a8287174a0bb64920c9ec89906b7e925ee98188bb0670a5126608b574b56dd93b48945e799bfc0a689e
- SSDEEP 1536:h6DN42t3dfBGjTKi0XhVE0ssWmYS6ffU+F592PhPoehJ7z:QB464KfXA0cmYSgFy5FfP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  $TEMP/Mattress.potx
- Size 73KB
- SHA256 b8b8b5537167857a86311489f450bb184eafc00e8cc879bc55a38d8f1fcf86fb
- MD5 7991b0a6feead44c844648492953ac5d
- SHA1 6cc55245e83aeeaf7d02582ae46cee9c6f5e75bf
- SHA512 c1e0f80ccbadd328a0c91cbb95efb06c82656c7994a3c2452947925365612c82d1287d5fd399138cd20734021b272b5c24f6066988224b7a0d708d465f5cd911
- SSDEEP 1536:09DhyDXxnLaVdIUBHG3HqW5GWMY0YUeX0z93EJUeC9:09D4zZaVCUlg17MY0YUBmJD4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  $TEMP/Miniature.potx
- Size 28KB
- SHA256 b6b4d9dcc820dbf25e01da28794038b5b81aa616dadc6a18b809923a8acbc94d
- MD5 57ac0a953ab36905e99508f7bef222e1
- SHA1 d93786a4458a679c0d97bee09123f7ecfe9fd25b
- SHA512 e7750ce38e55c42068fac2a070b967b4f9b36f5aa4c1715bbadfd24b72b4f666422948509cd4fbf2c83f7ee0c2de59f7742d7c354caeef6e31d0c967d431a4ad
- SSDEEP 768:GFEWORBytk4/FCdj13xYgGy1K9hTFXt9QW:GeTByK4euc1MZFXt9/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  $TEMP/Populations.potx
- Size 81KB
- SHA256 47fca0505e315fe82cdfd36f3d640dc042b965088df59c0d6d185347e5e7de2a
- MD5 96716fce3b6757da17f4c62940aff604
- SHA1 c039c03af7872fe15540ea962baec15bf2e4e8bc
- SHA512 9e773ef6aa54fc59462e1e0075ef499c97dda1ddc55858c1955560c14fe48fca6509719c37d915c76edb959e402ed814e7e2c703302b5e839bbce2515e298869
- SSDEEP 1536:+YK0jQ+a2p9KabkFwlHA2+VtB/tTAxIBzMLzdMOMzzmzxpRCxp:Q0jQ+a26awwC2+7vCIBKzOzG0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  $TEMP/Slideshow.potx
- Size 10KB
- SHA256 45875f9787517db7fbe85e71aa0aae61f2062fb04217f8c697681a1e77a29474
- MD5 39636a884c21d632c9c8a30a2139cf11
- SHA1 08b20dd8f3d0aac92f9cd28ef357bdb5f8a3db0c
- SHA512 47975000cb3645db4541ee6fe2de13dd769d093604de53193768a920f9275d89a04f36e4938b462e4a61148fba4419e7cb4d4a6e031237cbe700c2a58d8632f8
- SSDEEP 192:mVLa5F/bJ1ZJ+PWGop6y+zI8u+56yAbB3CJAEAo6SVx3PIjrvvSJJI9aaseVkv7d:iLGRlJ+PwCSEyjRkjwuwy4Y1uwoM9tHF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  $TEMP/Symphony.potx
- Size 83KB
- SHA256 26cadc57f533307bb199af590e81ed7679fbc6aae789853c2b7c0c58ac8a2c87
- MD5 196d35464ba36c8ae872d99a37b71425
- SHA1 4341ccbdbe4008bfc20504ce7620d927a271370e
- SHA512 22fe164b166f66c51322dfa2e522a38d43c0332b889a2cc0f4b7e1d3050fe607aa9b70ee1c4410511956b0fa8e6866328a74aa1159cb2ec1b827b7db95e4bdde
- SSDEEP 1536:mvY5vGcE2Y6UeMOypjAqeLX/e5UGTQ0b27cY6PLtQtASmd:mvYa2YLXryqe7eeGT9b+craK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Checks computer location settings

Executes dropped EXE

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12