0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4

Sharing

Copy URL Twitter E-mail

General

Target
0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4.exe
Size 62.6MB
Sample260522-fa1ecsev6r
SHA256 0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4
MD5 67c37850e3e6a5863d305206fc854326
SHA1 9c4301f8965250b5f3aedaef58aecd7d190d3ab4
SHA512 3800013bf3e32f995e462ad4241e7658b900b70b8357568b767a1cab0742c3effb328f81976ecae11ead568d870b26cbe8a26849e9a79f24f297e88624b4f93b
SSDEEP 1572864:Z3DswoerEAnqqF1RSH2azhe31EKpuNe9akxMOXDPM5M23GG:Z3oCdnzFrSHPd217T0M23GG
TLSH
T194E73397086B364FEAFDEABDE62210EB344E365686A56F1FE340029C45325D0523DFD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery revoked_codesign

Malware Config

Targets

- Target
  0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4.exe
- Size 62.6MB
- SHA256 0dc0e160c1898c94e4cbda8d2a6b4d8334a423894cb1e5838195b905f22fdda4
- MD5 67c37850e3e6a5863d305206fc854326
- SHA1 9c4301f8965250b5f3aedaef58aecd7d190d3ab4
- SHA512 3800013bf3e32f995e462ad4241e7658b900b70b8357568b767a1cab0742c3effb328f81976ecae11ead568d870b26cbe8a26849e9a79f24f297e88624b4f93b
- SSDEEP 1572864:Z3DswoerEAnqqF1RSH2azhe31EKpuNe9akxMOXDPM5M23GG:Z3oCdnzFrSHPd217T0M23GG
- TLSH
  T194E73397086B364FEAFDEABDE62210EB344E365686A56F1FE340029C45325D0523DFD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Docs/CLINOHEDRAL.DOCX
- Size 24KB
- SHA256 d9b68a10875e155dda410099444392f7576879069f002786d17a67c6021e696f
- MD5 54842f05de3888a689a39288633f847a
- SHA1 c3f7728a1dc280e969c87e9a54f17dadbdaf81e9
- SHA512 84d64d5c4af423463b3a39fcbec05f2cb9cc2191eee1ca91e3b8a417466d3e5874c5ac3adec8d7f19885cd2081b3445d6e87d131344642fbfc208a581abe4f89
- SSDEEP 384:6mfmRWL8SkiIH92rlXX3sdWK0ymLE996Q60O1XDLA6ntV3eoub2V0u5bAnz21RZm:Re082IdUsq9E9kZcEtVuo02V0u5c2ZWX
- TLSH
  T134B2D0E5E4820431DE13FB326659076BF5B1EC02F32ADD6B27086FDA8142BE9530ED48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Docs/DISASINATE.DOCX
- Size 30KB
- SHA256 3c3990b5dc99e30243937aceb7b74adaea8ecf92fa4f6763b0ecd84e1a8fabb9
- MD5 2c6767a360661591ea217521231f4f6a
- SHA1 b1ce59adf3cbaa6c90b77181ca8e65bb5e3af431
- SHA512 6831f57233db7c9969597a4e919c138146f02ce9645b1b61f0426ee24baa25f075cc7af70be99fa87a6aa17c4a0f180915d54b09d96d8006984bd21412da3089
- SSDEEP 768:uX+Irrh6zkLWPqt2V5zKSOuGnu6w8sbcJq5ENlVihcB2ZWB:uX+Irrh6zkL1whKuGnu6s1WNlVihcTB
- TLSH
  T18ED2C0D5B9886878E51AD371E9450833F8619902D07F59DEAD8C3E736843AF1D30F68E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Docs/FILLIPS.DOCX
- Size 29KB
- SHA256 231773e7e39f603c7c2e2210638f8e66d609f00c3f99d809727c7b2574173d81
- MD5 67190a66eecff6d3ba1b03b54907435b
- SHA1 7191fd71ba13421503c31d4bae80fed9f3bc7f46
- SHA512 1808917f2906f41addf93be83bdfc0fdf33031105407d959c790b9519f4af3527127476277177438eaff5d995ed95f8d4d0f21cbb2a77a8c621f0d656650dd8d
- SSDEEP 768:Wk6EMZold7W7Ig9vzbTpNaWsRntUbkmLKBVQ+d9pJ2ZWa:W2M6uMqfpLsRtUkVQ+d3ra
- TLSH
  T1B2D2E1ACE39E6F38DA214577E83C1247E66050CA57BA6B050B4167DACEC36FCA743B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Docs/FOLGERITE.DOCX
- Size 27KB
- SHA256 8a608036cb5422e80a85f617359a6138c320c79373f89ac2ea630c1e46bd7991
- MD5 8499aa8905716d43fbccc4c0535d8ef7
- SHA1 ce5ea2ccb877d173ad4d6c13fe5d63a03c2f1ffb
- SHA512 1f6007cbda12bfdb1f29f417c970c249bbce42b4b3726b4e41de61a8456115715e61ec54b2e288216a993eec7a361949185d6cfeb074d59ccc15c7c3a8f8ad65
- SSDEEP 768:rSAdZ9TUs1Y1kVrq0U4/q6sLtSQmXVsSxj2ZWCG:rTb9TFNqD4i5TUVsSxxCG
- TLSH
  T19FC2D090E0C60933E5208237D1980083B4A49B40D9FFCD5A655C77DEDA0BAE7AB0F75B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Docs/LIONHEARTEDLY.DOCX
- Size 30KB
- SHA256 52abef4ccf8ec3f53d9de45a62b9ae70292d2a949e6ddbaa3ebe2fe644fe6727
- MD5 e1d09945d2116ebf98901fceb11ddef4
- SHA1 665ebb7f77310cbd1b85250d384131a4cd7419f0
- SHA512 547c2eb8e2a34eca0bb1468918891f711b9ad519ed0e3f561fa925331106427e96f2516828d376fdf30270d25e22684e7296cb6aa6e4b2ed24751fe59e74c043
- SSDEEP 768:0m0uGfsTarRnHLauxajgwuwXbzWSI8Cn0ALcfV6csI2ZWB:0m2lnHGQajKAbzWd8C0ucfV6cs0B
- TLSH
  T15BD2E1C8F1C60539D9A4D177AE983102A951D893D27EBF0B7A4681ECE0819F2235D78E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Docs/LYMPHADENECTASIA.DOCX
- Size 23KB
- SHA256 67b379989d6ae8846850253f3627a850a56aa921649b2c45435b0179b3957509
- MD5 12b78fad9b23f99e2b5444ef53d80bc1
- SHA1 a74a3dc9c1c492f3d6f140144c1d59fc87b4a2fd
- SHA512 02531e69f460cbde6139a6e7186655b0cde1f3c4f15fc7c7e733aa94c32c23d98c2272e72dc8e49352188d265d179d00576d276cbb51c13d6885c88cbed5d40e
- SSDEEP 384:wrpDvQovdvdOlaMpoT4w5aFVCsVo/Fz/sHVMYo5+3lXqmV3Lb4p+nz21RZeMS6rO:wrxvPdpT4oEVPgp/s1BV3Lb4E2ZWSO
- TLSH
  T14AB2D0E495471838F93AE233B99D2683F240F84265BA641B6F6037550413FDB630EA7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Docs/MULTIFOLIOLATE.DOCX
- Size 21KB
- SHA256 31bd7c5fc8323d1feaf603aed1a76d1f909eae8f49ef90b48e4734385e860be5
- MD5 0c2a6c20e7a5fc9a8be6919aa89e1ff3
- SHA1 5d33038efa7f01ac445a74637bd0f9f5d6ec2c7d
- SHA512 82ccb8155c67aed97ca45e3e2d27dd6500c93502a149dd9956a8f832ceed51c7d6b6bc15aa4a7cf5dc3e4980a46b03d022e1c5f8f659124923cc713ddd58e5c9
- SSDEEP 384:M/e1RNyg723uKqJGDy8FPqjVLhwpmfah5/TiyzAGyHl2kVoFbTrYsnz21RZeMS69:Mm1PB23uKqRljVtwMMiyLgl2kVolT92T
- TLSH
  T115A2CFA4909D0639F901C27BF26811A7FC11D893E47F9DAB9E495AFBC5020EA2747A0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Docs/MULTISPERMOUS.DOCX
- Size 21KB
- SHA256 7e18b47140aced488fd051afe4ba3d85dacfb4ac42baa73366b48fc2c72a8604
- MD5 46da66454011e0e01f2dc572e1762272
- SHA1 9abca6743d5a185eeacca91c2a3f2befab312e53
- SHA512 f26e83be3e9c2285df66837dc8adbb0e5c9c6060cfa277e9d77ce16e491ad46a5231f38cbb9b0319606af7dc907a45d47b4649ff185eff353c28577633dfc5a9
- SSDEEP 384:U1dPKVrxAT1neM7fmPfOvNBFACtAeO5ynqtZ8gUPzWsTBOBQDxeu1VTd9bIdnz2p:HVrxAT1neMbmWAuno0qtqPasldDIu1V1
- TLSH
  T160A2BFD1D8C04931F9534276E40E0302F8116173FFAE86AB7B5E1787D9538EB921A7CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Docs/OVERASSUMING.DOCX
- Size 27KB
- SHA256 f729e9e362bbc7318971c5fb9a2650641a4a2480331ca46ad68a4a268112ed97
- MD5 c5c52ea74d4f02659b558daf226c25b3
- SHA1 ccda8a400af6c62ae2f1b081bffada7c18812dff
- SHA512 3606d878b84ea732020b5d61c9b8c4f30e568971ce2263df749ce2686708e2441582ca4144e0fd159d48e8a02d95034f2b57bc23f195fd8f4281b9ad2d748087
- SSDEEP 768:X6g9dc7NW3wBZ6FJEJR/GLF06NfqkNdcVOWh02ZWJ:XRGSqZZR/X6NfziVOWhAJ
- TLSH
  T102C2D0E0E0D87875DA0BED30F17CA1B39512CC45976FAE17A99C3896A903375634B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Docs/PAIREDNESS.DOCX
- Size 32KB
- SHA256 332d9913f829ed0a1c1b66e4750b7f6ff98bd9decb7d27de2508504f9c775850
- MD5 ee06fa6734894a31d744f718409a20f9
- SHA1 0ec40ce352bf85d89c8eaf81d90cc1f72f51a433
- SHA512 d4e1b0f3382cc42008a36d1b5e5c218c522afcd1b08149e28b9a205de0c8e0906e1c8ceb474a0363c87b155161aa50a57eee1f763a3055c070dd3c1523d9bcfa
- SSDEEP 768:2qR0nntz60q3KJDJkZCE/7Wxn2bxyhQIfcNNcVvqML2ZWI:2qR0nt2d7Wxn2bIhJMqVvqMpI
- TLSH
  T16EE2D0D2905F0537C105C27661EB0AA3BC91C4E3E6BBC59E164E5BB4D0039FE635FA89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Docs/RAGOUT.DOCX
- Size 25KB
- SHA256 a93f17a597824eb0e98579c270af514938cfb9ab3a343c5b9aacbc46bc88e84b
- MD5 fb8c60ebe31cf07f64e9c5a130a28af7
- SHA1 64340b786f89713baab30b615d301e4ee90c02fe
- SHA512 5271a916789c1018959066c942dfb17f243e76eadebf86bf62c7aaf5a48d9b42064565fd50591baba7649bc9971150561ef7bec59e9ee655abb3014caf69a03c
- SSDEEP 768:vWFuHOq+GqCh2WxRJzRk7o3BTmSnaVXfzk2ZWUz:BHOrRSXFSoxTmSaVXfzQUz
- TLSH
  T1EAC2D062458E3E72F501A172F54D2A07F8F5A403C7F7F40F5E0A26A584425BB93AB6CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Docs/TROPACOCAINE.DOCX
- Size 22KB
- SHA256 fd158263df93ec02474c2a68b1b30df1efc8c2fcfd8aa09c4c2191e96156116c
- MD5 dc4b2220bf40bff2adfaa12f9ba5af84
- SHA1 a3f699ce51c44bef9605ea7b05104f7227f4cd6b
- SHA512 e3065bd135fc60c82d1a654cd210b8fa18c1c791e58126a8ced0373c9829e8fc241b581ecf80ce654c4fcdb63eda10f3e12cfcfcb25641cc6bab0230d5428d72
- SSDEEP 384:gIO0/eIoHaJWtHFs/z4CPEbZDYkQRjN6qjcPrf1iB8RF9VKXHBsnz21RZeMS6mcE:gIO0dMlW4AkQRjIGcD8m9VKXHO2ZWd
- TLSH
  T1B7A2D064A05A8130D216E2B1F5A72243F4B5CC4AC60DEE2E6F4A6777D8426F1630BF5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32