23d6cea5dc4cf3190ad9654f5f6c7c86e8dfcf49ef4df419464be4049c964cd8

General

Target
23d6cea5dc4cf3190ad9654f5f6c7c86e8dfcf49ef4df419464be4049c964cd8
Size 7.7MB
Sample260731-mjs5za1arf
SHA256 23d6cea5dc4cf3190ad9654f5f6c7c86e8dfcf49ef4df419464be4049c964cd8
MD5 ee614c6bf50b5ab0cc27e1165156602a
SHA1 b9f3c3263d7fad5d2a6f8c7047a2d51753e66b8c
SHA512 8d9c6e33542884de397a86a98716510f4f6f83ec51a4f4b84fa791ad335ca61fd8533c3f4b12b4d8b1dac50fb11779bae84e2faa142bbf52f6eea154f814450c
SSDEEP 196608:N1PiJp1+trhZbLu/Jl6ytMl3HVV0DmBK+qXrybYjsYdcw:KJ6trhZe/b6ytMl31uD6Uyb4h2w
TLSH
T1D78633B43E0D312918836C1079FC94C79D924383E876D0FFA695CD7077FEA9A46A4D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd011.msi
- Size 7.8MB
- SHA256 975396803ca29e23ee48564a4d42b293d4b5b43e3bc6c8f34ff4861781fedfe4
- MD5 c84f60018c509ac8a489c4522f9a94e5
- SHA1 3f095218499315fde541b06d1609763fc9d56563
- SHA512 965b12879bf6d0f8b72d7ba45ded35179196c7316fae2b26edf596081758172b3379fd9f5bc3574c7e66cf7f34bd73e9d9b54b17909a6da44002d830a49a2175
- SSDEEP 196608:iD2Cp/qJrlHvLy/H1Y8PKchkLzJaizM0wPtiFEpcCjEc:qlIJrlHG/VY8SzPgYAiFONIc
- TLSH
  T1DE8633D9BD8E2371D047C770929BA09E30283FC2AE768C5B36E57A0C5FB761544BAB44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2