2bde8a0357a3e9c2202962b1c941198d8389709b1e34abf10b11bdd70fe70060 | Triage

Sharing

General

Target

2bde8a0357a3e9c2202962b1c941198d8389709b1e34abf10b11bdd70fe70060
Size

2.6MB
Sample

240811-1phs3sthng
MD5

9ccb508018835587a848ddaabae897d1
SHA1

2d87df0d1599d652e3478bcff975109517bf29c7
SHA256

2bde8a0357a3e9c2202962b1c941198d8389709b1e34abf10b11bdd70fe70060
SHA512

3dd58ce8f7eb8b95dcb322b9d4059176dbd77617f56a00bb40608900805f03d5adea506727501f9f0862ea54004aac67905d18103514efd29f583559f89814be
SSDEEP

12288:HSprXDGV/9Ji6mqUuGybDagMKaA8SFaL4OcDb70:FleZ8bahA8KVb70

Score

10^/10

discovery evasion execution trojan

Malware Config

Targets

- Target
  
  2bde8a0357a3e9c2202962b1c941198d8389709b1e34abf10b11bdd70fe70060
- Size
  
  2.6MB
- MD5
  
  9ccb508018835587a848ddaabae897d1
- SHA1
  
  2d87df0d1599d652e3478bcff975109517bf29c7
- SHA256
  
  2bde8a0357a3e9c2202962b1c941198d8389709b1e34abf10b11bdd70fe70060
- SHA512
  
  3dd58ce8f7eb8b95dcb322b9d4059176dbd77617f56a00bb40608900805f03d5adea506727501f9f0862ea54004aac67905d18103514efd29f583559f89814be
- SSDEEP
  
  12288:HSprXDGV/9Ji6mqUuGybDagMKaA8SFaL4OcDb70:FleZ8bahA8KVb70
Score

10^/10

discovery evasion execution trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionexecutiontrojan

behavioral2

discoveryevasionexecutiontrojan