75cfc2028e51691068cbfc9f018cb50e3cd0a505e81032ab5e287ca4407c774f

General

Target
ada5401e57df9510827cfda62aeebd61da748ae36eb2d6b73d3e0824e61a5378.zip
Size 1KB
Sample260720-jb1nash13r
SHA256 75cfc2028e51691068cbfc9f018cb50e3cd0a505e81032ab5e287ca4407c774f
MD5 8d64763333e621677845109d28a6ca18
SHA1 2d0fb14dbf46e2270fc39bb641b2153444f5a389
SHA512 358e42a5250bd86cc696947d085bf73a686c316de1666b0d970c5f7752a8fe8db3ce7f24983a4ce09e4e63456ca055bfd4821bbdde97e877b1f82f9274293129
TLSH
T152310BEFB027A870D8D8F379DCB9B1F6436549933C3C0390A5F81084F9E791E0561695
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  ada5401e57df9510827cfda62aeebd61da748ae36eb2d6b73d3e0824e61a5378
- Size 4KB
- SHA256 ada5401e57df9510827cfda62aeebd61da748ae36eb2d6b73d3e0824e61a5378
- MD5 001817a3383acec9f7ddc93545567192
- SHA1 73e2bb92140b7088359ce6164f74bb2afa09bc57
- SHA512 5ee0fa7607685372d572276792a338b7dc108c4bd96395f5e28c938bd3bf58e67e0868e21b775d399b190828d65e357ec00b8a5a14ee3135693768efd7a16f14
- SSDEEP 96:m3wjb49dZH4G0jTd4M9IjN+Sie/R4rwd4mqPalj27As:cZEPQB+SN/wwTm
- TLSH
  T1A19198A2BE0915544633C6B561B2B05DF586712B588F0C34FB9CC5EB1F323EAD8E0AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Use of msiexec (install) with remote resource
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2