6e8a3cd3669a4c32dd7065a0847926e33f10b3c9916ae26eb84359aeedd61a0e

General

Target
6e8a3cd3669a4c32dd7065a0847926e33f10b3c9916ae26eb84359aeedd61a0e
Size 8.4MB
Sample260801-bmhmvsck7s
SHA256 6e8a3cd3669a4c32dd7065a0847926e33f10b3c9916ae26eb84359aeedd61a0e
MD5 47820660544aeba97fa72e3ee7888dfd
SHA1 5a43695ab4324f03204a3db754bc3d67a71568d4
SHA512 d137411c1581b2c5a16195f6292f58458bde66e425076d530fed5feaeb0e0052165c2116ab0c07bd99443a7ff1ec12fcb80f5a64c5c03ee9f18403b1a24b7d5c
SSDEEP 196608:mY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezk:mY4qjnt3t0mrWDbV
TLSH
T12E963365E0E7CF5B059898DC07611A1ED83490246D291E973ACFF2AFB1A34E27C377A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 715ce60379895aebe10490d0f09c4c0d30accb0f71e7d7d0856dec80a4efe0a3
- MD5 558d8ef2d7731dadc64268224051e1ef
- SHA1 f7dd0f39b1e22fd9c8cb493b6e790a0ddeb93f07
- SHA512 808420d46d7c9515915481d469892aee989d008a029367ae88cc58edf374e8d39fd9d955b984c982cbed1220cbc81408da44e4371a8da0330938d5a5bc940369
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshq:rBjf4vFYmROxLV
- TLSH
  T1B1963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2