b2591333bec907aa6d5a9e20269b493047dfd1e0b6c9b7b4fb62740cc11dce49

General

Target
b2591333bec907aa6d5a9e20269b493047dfd1e0b6c9b7b4fb62740cc11dce49
Size 6.6MB
Sample260730-cll5bsxdma
SHA256 b2591333bec907aa6d5a9e20269b493047dfd1e0b6c9b7b4fb62740cc11dce49
MD5 1f1493eaf8610c18d6d5c21ea24a53d0
SHA1 c0d0ab6e7f2c9bf140bd8ea37a6bae8be6d548d5
SHA512 02cf88cb7368148cf4c4887347f4cf7f47a6ba3f1c432ecc0985839083838902a56942f50a2d505526356c4cb00c305fa245c0debe6d33c76cd4eab3fc60e9e5
SSDEEP 196608:nzsUuJYGpVfhn8xH9EFl4WU2xsHmY8s4iw2sM0U:nAUuJZr5n8xdErHTskiYMf
TLSH
T1CB663309F3C01AB4BFCD957613BD1683D1E75264B5AAD971647A333BF0CA26B6824383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n003.msi
- Size 6.8MB
- SHA256 a2df6c6428838a764aa57d428b44218654fd2812b6bebd3d57c77d6cd3cd8ff7
- MD5 d7a813b0397a45f93dfa3f376492aef5
- SHA1 3d89b8d773c273c25552700e539a42c772cf4e28
- SHA512 2ea106bb2b4a18ca30e889503cf9e1d8f21f9c95dc1a2c1a25b232b1b313df3e3cdeea468cf75c0c93f95cc2024a677969d63a7d2dd62f609085a33f5d7f198b
- SSDEEP 196608:Xilcw0Iv39df8Dt7kvgmswdObgc8Eu04gkcSr:mPnf8Dpkvv9Oq0IcO
- TLSH
  T190763386F8C112B5E18FC3B0419625AEB86E3FD97E678C1A7A7833116E7372E5531381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2