41b26b233936c9b1530fc3b9fdafc5ef2bdad2317c7fb18b55193aef4cb474b2

General

Target
41b26b233936c9b1530fc3b9fdafc5ef2bdad2317c7fb18b55193aef4cb474b2
Size 5.4MB
Sample260724-nq8pnsyfja
SHA256 41b26b233936c9b1530fc3b9fdafc5ef2bdad2317c7fb18b55193aef4cb474b2
MD5 8eff7496befc1319737258b4231f5cad
SHA1 9bcb6df5ccbbb6e2b7096239b52e43c9c11227fe
SHA512 d46f3b6a4576d8e3167cb82c6a610fcfb95fa6a18505ac5e2b9d535b1a65904dd18ad97b635fa3b50b670762ff6fd8f378a3a927d62096bde0f69891316bb672
SSDEEP 98304:9WdtfGwfh//TEQMq24wudiXMAFOHttF6/nGhGi6Wtp1H5gRiAtTQR9GVm+F28Zd:0RGy/TP24wud8MAqo/i6WtjZgRiAto9M
TLSH
T1F1463333DB52EC083EFE65065C24480B2289CEE5C696BBD9CCEBBD15539AEC84331D65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intll.0.88018.msi
- Size 5.6MB
- SHA256 d177dd0b499241279e4d89bbd00aafcfd2727a403963dd802ed42f1a998bd45d
- MD5 aea042367eef273ea62268d22002ce74
- SHA1 db4def6ee2c55ae5e4aa92965fb5e58f79a4dc1c
- SHA512 55217d885195c5ccd73cbf0013b183434773454b0f50a24e2bfe9226a27d1fb9c28932491aea3e6a2ab93ec5777960eb938cd92e479fa253d1202f9d2e1e0b39
- SSDEEP 98304:0lKynB3oibTkw4Cqo4U9OfM85YJtnP5a5WDUpj9grio19ChzCRqAjOw3D:0lKynBVTTqo4U9AM8adg5WDW5grio1OE
- TLSH
  T1ED4633C2BEC46631D1DFC7704882682E7E1C7F85BA67AD077ACA7A104EB261A5737304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2