31a1a4200bb270b08913e815973c478f23cae63d2e15c76e4554ee6a89e8d068

Target
kbg_out.exe
Size 118.4MB
Sample260701-fr4hcaey4p
SHA256 31a1a4200bb270b08913e815973c478f23cae63d2e15c76e4554ee6a89e8d068
MD5 f147f0c4dad59af15de73c11e0c37045
SHA1 0952f97e2d4d1f1ab2feea070d9babe40315add2
SHA512 43bcf23e7e4f91f2c55183be28c9d57b00f7f1a44455027bf462f0f3329fe326ec75409c15744c21fbe7c2c17b431e1ab7ef286bdc1b79a8a6f3181ffeeb56de
SSDEEP 3145728:jXwdgYRPSC++6y9S6H2zbWBN/h8fNknAnIdY7lxU84VnoBGDey945Co5l:jXsxaC4y9SmCuGfqd+kwGh9iZ
TLSH
T17E48339A7BC42587F5DE873B718AD42B9C85FA4D5347809382B018331A672D5FA7EE30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  kbg_out.exe
- Size 118.4MB
- SHA256 31a1a4200bb270b08913e815973c478f23cae63d2e15c76e4554ee6a89e8d068
- MD5 f147f0c4dad59af15de73c11e0c37045
- SHA1 0952f97e2d4d1f1ab2feea070d9babe40315add2
- SHA512 43bcf23e7e4f91f2c55183be28c9d57b00f7f1a44455027bf462f0f3329fe326ec75409c15744c21fbe7c2c17b431e1ab7ef286bdc1b79a8a6f3181ffeeb56de
- SSDEEP 3145728:jXwdgYRPSC++6y9S6H2zbWBN/h8fNknAnIdY7lxU84VnoBGDey945Co5l:jXsxaC4y9SmCuGfqd+kwGh9iZ
- TLSH
  T17E48339A7BC42587F5DE873B718AD42B9C85FA4D5347809382B018331A672D5FA7EE30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution exploit persistence privilege_escalation
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Possible privilege escalation attempt
  exploit
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1