General
- Target onlyazra.exe
- Size 29.5MB
- Sample260426-pgldfscw2j
- SHA256 75e5aff3fdb870c62b4ad035ab50e7ba435d9d2875253574989268ca257fe148
- MD5 b110491f84866336c282ce6d184512a2
- SHA1 92b651953c7813dee82eab5e7a52e78bcba25d03
- SHA512 576b62c6af3a89471d3c0ec7f6467a0a230ee1a1e0c44da2551ef908a1c2314b0f665522bdde29c29deb5111bf4bf5427c4d5f79a7e26e5ec410ae7aff03e168
- SSDEEP 786432:ovjIECWceP1jAU50Cwg1+zpZ6ncMQFJd3:o0ECpe1jB0G+FZ6cMQFJR
- TLSH T1526733D816A156B3E8ABF3344567D2BFB2367D905B51884B57E83E933E330A01D3A781
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
onlyazra.exe
Resource
win10ltsc2021-20260130-en
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
onlyazra.exe
Resource
win11-20260130-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target onlyazra.exe
- Size 29.5MB
- SHA256 75e5aff3fdb870c62b4ad035ab50e7ba435d9d2875253574989268ca257fe148
- MD5 b110491f84866336c282ce6d184512a2
- SHA1 92b651953c7813dee82eab5e7a52e78bcba25d03
- SHA512 576b62c6af3a89471d3c0ec7f6467a0a230ee1a1e0c44da2551ef908a1c2314b0f665522bdde29c29deb5111bf4bf5427c4d5f79a7e26e5ec410ae7aff03e168
- SSDEEP 786432:ovjIECWceP1jAU50Cwg1+zpZ6ncMQFJd3:o0ECpe1jB0G+FZ6cMQFJR
- TLSH T1526733D816A156B3E8ABF3344567D2BFB2367D905B51884B57E83E933E330A01D3A781
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
4Remote System Discovery
1System Information Discovery
5System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1