General
- Target RealSetup_992b879f85b1c89cfed4bb6726b32d7cf099f45af8f25b3f912ec75c93a0557a.exe
- Size 13.2MB
- Sample260619-pbcjcsg12x
- SHA256 6560ad3c3a98805b3a8d3c7a0c1fa844c9e3a08f8da4bb2c1eb2a9ccaaf67483
Score
8/10
Malware Config
Targets
-
- Target RealSetup_992b879f85b1c89cfed4bb6726b32d7cf099f45af8f25b3f912ec75c93a0557a.exe
- Size 13.2MB
- SHA256 6560ad3c3a98805b3a8d3c7a0c1fa844c9e3a08f8da4bb2c1eb2a9ccaaf67483
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
A potential corporate email address has been identified in the URL: [email protected]
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Network Share Discovery
Attempt to gather information on host network.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1