108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc

General

Target
SOGllc_rmm_v2.5.0.67_oidd0e470ac-afa1-4983-85c7-cb47034ca869_bidENdcJV8NTECiIVPM-nafDQ.exe
Size 17.1MB
Sample260715-t4elmsct4s
SHA256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc
MD5 386529af136fe96a23da6aaa39711e2b
SHA1 f34330d4c6e0aa978dc3af40360c14b31ad51127
SHA512 7ee28ca0e2798fa47023858f27e5d98da5a0057d0783cdf2a4e61c1dc6c9ea27be9feda5ae8d1c3e3bcf7848d425712589f5538a36e5947128658206890d41ce
SSDEEP 393216:Sz0LnfhNw32VNelklzfhSecSpv5JwuFUvmB8leDOgwtEI0ppjagOibnaE4qX5y:SzMnsA88tSxe5JhUvmO0DOgXOgOijacQ
TLSH
T1E30733907CA4F70EDCA8D438C97053F041EB0EEDF6769017A4A27E6237B7293D69A845
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SOGllc_rmm_v2.5.0.67_oidd0e470ac-afa1-4983-85c7-cb47034ca869_bidENdcJV8NTECiIVPM-nafDQ.exe
- Size 17.1MB
- SHA256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc
- MD5 386529af136fe96a23da6aaa39711e2b
- SHA1 f34330d4c6e0aa978dc3af40360c14b31ad51127
- SHA512 7ee28ca0e2798fa47023858f27e5d98da5a0057d0783cdf2a4e61c1dc6c9ea27be9feda5ae8d1c3e3bcf7848d425712589f5538a36e5947128658206890d41ce
- SSDEEP 393216:Sz0LnfhNw32VNelklzfhSecSpv5JwuFUvmB8leDOgwtEI0ppjagOibnaE4qX5y:SzMnsA88tSxe5JhUvmO0DOgXOgOijacQ
- TLSH
  T1E30733907CA4F70EDCA8D438C97053F041EB0EEDF6769017A4A27E6237B7293D69A845
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

google defense_evasion discovery execution persistence phishing privilege_escalation
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Detected potential entity reuse from brand GOOGLE.
  phishing google
- Drops file in System32 directory
behavioral1 behavioral2