ad18823d3e3a81c5e376bb98bb40930d2bf8461ea87346780a77fa5a09c3418e

General

Target
ad18823d3e3a81c5e376bb98bb40930d2bf8461ea87346780a77fa5a09c3418e
Size 8.4MB
Sample260801-aj9rhateld
SHA256 ad18823d3e3a81c5e376bb98bb40930d2bf8461ea87346780a77fa5a09c3418e
MD5 8ca666df7bd067919971024f2eeecf10
SHA1 db5eb8dbb1dc3390417be852d30698157c0dc4d4
SHA512 eba186157d187b622f01b4d50b84420f6b53f4ee5ea8df1cc22416d21c48e4a6cfb2890a4b4e34a5c6fa7cafab13de2e48aa2f4d5f2afbd40b5547d9b07ff009
SSDEEP 196608:7Y45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHM:7Y4qjnt3t0mrWDbF
TLSH
T103963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 6346bb4ff25d52508dd61d08b3b1fd59d6b99c6acae69a0bbf7fcc2bc6749075
- MD5 e99112439e0efa24df24c729bed3cd0d
- SHA1 4f1ac95f78bf2d0c0acd4b21de1ebdfa273b2f58
- SHA512 b94dcd87ca1cb2dd09cbac8955f4239fd5e74c92213b395937c1e4e5bd44ed6803d4f6d3608afa12403897829fd29d4caab5aa52113b5f92f71b5a35063d98aa
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZsh4:rBjf4vFYmROxLH
- TLSH
  T14E963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2