e585cad28bb10c52591a31018a4cb34783f769059ee628c252fb6d99ef765dee

General

Target
e585cad28bb10c52591a31018a4cb34783f769059ee628c252fb6d99ef765dee
Size 5.5MB
Sample260727-k82gjaab83
SHA256 e585cad28bb10c52591a31018a4cb34783f769059ee628c252fb6d99ef765dee
MD5 2345ca98d7809ce370aea677fccb85b7
SHA1 810b42ac34470cd3575830f769211f4576744fb3
SHA512 d379b37948b11d1c4b2baa117d78c720a9c5a6fcd8859f7e22474bd153a78eb7954a9f1c53fc296f134efabfed973f4b894a1afd27338cdf30db61d04fadaa21
SSDEEP 98304:eCytmy2wm4cbwB2DcL3D/JwXE9f8p6VSUYiRd/UcSBTbIO7ri:Xi53c0B2Q3BEE1VlY0dxcl3i
TLSH
T1F64633D3826EA46D8F43602A35B8037AFBA43CED0734E5BD9D69A91C507D7A7F40D188
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setupll.0.nn013.msi
- Size 5.6MB
- SHA256 4bc99492701b3625f7d4234a61fdeb9f424ed57daf6f3957d77b16a49b789fbf
- MD5 e6582d5e6aaf949466ae99a4a6f98ea8
- SHA1 f05007431539a18111b520aec00154211a0b437c
- SHA512 58d63edf7e5d93a42f452030ef52eeb370c546a10933b85883d9d8a88007a7cfc3a23b4c9e33879dd4a62b792c920675cefced2b2a223c082582c6d106c17d5c
- SSDEEP 98304:nmhaYPORt7KO2Zi/WcVQj+fyL3bjvwL0x7QzGVaiEiMc26Py2y0sJRbOotvJ:nsPO3IoOc6j+K/LO01VJEiv26Pym6FpJ
- TLSH
  T1B05633D77CCE6635C453C3312166726EF22D3FC96F658C1ABA993E082D32726647A384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2