6fbd5056ae092846712f2ad636674e37ffcf853884b9f8e228106610b7223243

General

Target
6fbd5056ae092846712f2ad636674e37ffcf853884b9f8e228106610b7223243
Size 8.4MB
Sample260801-bkrsrabd37
SHA256 6fbd5056ae092846712f2ad636674e37ffcf853884b9f8e228106610b7223243
MD5 11c3b53835dd581aed2125394f4c821b
SHA1 72251018c0241c993d4dee42c07fd494acc1712e
SHA512 8910e7e0dd637833c7f9f55dff6fdf29bdafdf652a49370389fe0f36446dba2d9030a415243c31e211f0f5768a30f62c234694567e1ca772d083f0dd6cc5c3a0
SSDEEP 196608:FY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezE:FY4qjnt3t0mrWDbJ
TLSH
T1F9963365E0E7CF5B059898DC0B611A1ED83490346D241E873ACFF2AFB5A35E27C277A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 d5d5476039b63bf0c5eaea3dfe718c85cee2f7a97924d30a2e8ef65ab72589af
- MD5 91c408d3cbcef97682ebe5d51b47792c
- SHA1 ff218935df6bc8f0ee2ece3b8c1171398c7f06a6
- SHA512 fe65682893498ba8f84425c7ef66df45de514ba2590fe1c8b36fded6e48b060fccca625b424c32d0bfcdc129b8f5385ea35d8ea93cfd217397bacbed940ad332
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshf:rBjf4vFYmROxLg
- TLSH
  T10E963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2