be4470991fea96ba835b9e0e58c191a02d0fbfe334bb83e65f580096dc963eb1

General

Target
be4470991fea96ba835b9e0e58c191a02d0fbfe334bb83e65f580096dc963eb1
Size 8.7MB
Sample260801-evlk9sdr3t
SHA256 be4470991fea96ba835b9e0e58c191a02d0fbfe334bb83e65f580096dc963eb1
MD5 968884dc04e286e74aa4604a6b285cc6
SHA1 614bb02101a350ce94a9a03e71ea52672d118604
SHA512 a4c2d0cb185104fe0f88706bca2d12d161ae7f35f3d71ccfca4994af665a6829b7fce9d1c64d374fb008536886138931399246d2a32e4f16f0e8a7c9bd66bebe
SSDEEP 196608:rPl2Vu28YMUlDzUlmAtyn27sKgpn+hc6JET/pYDVyINLHcKPJyR/:7l2D8TUlYoIJE/p7cq/
TLSH
T19C9633F70FDE8700678CBA44766E7E938D546EE835452F7416CFA2268CF867A8843B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd007.msi
- Size 8.8MB
- SHA256 49dff4082552d1e1f9cf911bd283dffbe56a27ffd2f7f4001df82a4fb1a5c794
- MD5 3772ee7b453678125e19020cb7c05230
- SHA1 d9703b146ce0abb910ba25b9fdfbaf7c8242f111
- SHA512 364382cd59d72e1ea287cf06aaa00ada4fdc2d7cfac6b9d9dd197176343c1b2c664c27852ab0a66257cfd0fa09dd797cfb8e7c331b92822e10df33e993630773
- SSDEEP 196608:+/LMNlAH4OysweVpPIBL/BLvZ2von+hkepcBNHCpfyqXH5QNLfEnQ:+jMNlA3yNeVcLJA33wNHxfWQ
- TLSH
  T1BE9633EA3ECA1734D78BCBB05147682FBD283F64BA665D1A37CAB7115EB02251372341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2