General
- Target WeModPatcher.exe
- Size 2.0MB
- Sample260705-ftstmadv7j
- SHA256 23ef62989c2210f05bd598c64ec995b96c381ee15ff78ecdd6225fb163c0a388
- MD5 2d2b9c759730a8b30107748a3fdf9f09
- SHA1 229b793724849ebc236d1352d8abae6c825fe256
- SHA512 70fe8eae71249364eb8d406514568bb179b18333da210ed713a7587e7371882b3ae7c2c658065a9dcc76e40eb79d261dba542bbd96967f69893972b1a6cb8a46
- SSDEEP 49152:pdTE5z0C1/bruDDlz7+L/HjBPr8u+3m+tC/1Y9:G0C1IW/H5kE/1Y9
- TLSH T1019501A3A7949F68FED040FAC421CD5E95B1EF21722B527B03F476B6394AE418B27071
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WeModPatcher.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target WeModPatcher.exe
- Size 2.0MB
- SHA256 23ef62989c2210f05bd598c64ec995b96c381ee15ff78ecdd6225fb163c0a388
- MD5 2d2b9c759730a8b30107748a3fdf9f09
- SHA1 229b793724849ebc236d1352d8abae6c825fe256
- SHA512 70fe8eae71249364eb8d406514568bb179b18333da210ed713a7587e7371882b3ae7c2c658065a9dcc76e40eb79d261dba542bbd96967f69893972b1a6cb8a46
- SSDEEP 49152:pdTE5z0C1/bruDDlz7+L/HjBPr8u+3m+tC/1Y9:G0C1IW/H5kE/1Y9
- TLSH T1019501A3A7949F68FED040FAC421CD5E95B1EF21722B527B03F476B6394AE418B27071
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates processes with tasklist