b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1

General

Target
b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1.exe
Size 13.3MB
Sample260506-fd153aew2n
SHA256 b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1
MD5 156b6073e2391e2bff64fdd098f2aab9
SHA1 a6c754007e8a14b75aa62aeab50f579c0b68ca0a
SHA512 6a064f40b722256f94341380a949283c48ca0eafe23440dc34927cd416762d61b052768dd31f4775e9457428d2dba3d1d3eeb69655ff30edec10129eb1c4182f
SSDEEP 393216:u9iXfqWfWw9BJIPJhlm7dzfT2vrszY/Brv0:u5WOaB4I792sYa
TLSH
T1F4E6E101F5C14165D85B317B791A6B3EBB35AB114B308AC7E2887DA87FB02D2673924F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1.exe
- Size 13.3MB
- SHA256 b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1
- MD5 156b6073e2391e2bff64fdd098f2aab9
- SHA1 a6c754007e8a14b75aa62aeab50f579c0b68ca0a
- SHA512 6a064f40b722256f94341380a949283c48ca0eafe23440dc34927cd416762d61b052768dd31f4775e9457428d2dba3d1d3eeb69655ff30edec10129eb1c4182f
- SSDEEP 393216:u9iXfqWfWw9BJIPJhlm7dzfT2vrszY/Brv0:u5WOaB4I792sYa
- TLSH
  T1F4E6E101F5C14165D85B317B791A6B3EBB35AB114B308AC7E2887DA87FB02D2673924F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/DcryptDll.dll
- Size 20KB
- SHA256 ad313f94da4ab0980173e60cbda7d1510e92fb49d2359224e0f89dc3ec0584e7
- MD5 0a5e967b684d6f3db31cffb619cc0222
- SHA1 2ed62db69f3ef5b0294805e326e3f41e5b3b0ac5
- SHA512 9cf83f8827aafba394befe1a7c91cf6e12ccadc0767fd1934a823e951b6b6cb24ecf7ee56a4c012c162a41900de0c5f1820ca6fd6836bc474881d9f23e966954
- SSDEEP 384:k3tsJOACduC6f6o14y5+UKjNLUtTQdCLXXCBwnp:k3tsJOhuDC44y5uLEeCLXSBwnp
- TLSH
  T1E492D750CAD10420E0B322BA7AF955129CF87E321836610FFEB7065B6D78AD76767732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6