a0018ecedd085e139e7751bc4792f1bffada96bcbed5cd5345be8501c5403a82

General

Target
a0018ecedd085e139e7751bc4792f1bffada96bcbed5cd5345be8501c5403a82
Size 7.5MB
Sample260801-ka2pmsxses
SHA256 a0018ecedd085e139e7751bc4792f1bffada96bcbed5cd5345be8501c5403a82
MD5 424fd574e62e57f045aafbd723c3b5e5
SHA1 6912ad56aa9b46d3b72676eb87f0c6de34490522
SHA512 2f87d9e4360e080d67624a5e7728db82f6c303663aac760e6d1f9eaa2218a42f3f002730bd744786952138f76bfd21dbc70ee2d126c69bdcf7415d4658b9c006
SSDEEP 98304:E4urb15YLJaRMsR51je1raI6+iuQ4M2uAVJFQehCJRoVe8pz5LtjpI8UAHQTsD9t:E40bDRpWrdDQxEVJhCJR0vjVhkNkD
TLSH
T1AD8633A764533A26FF7F6D7AF630739E0270185F48EF8B1F2092329671D4616B248D62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd014.msi
- Size 7.7MB
- SHA256 782c2b43a02d78d87a6f4067442f4b5658d115d87d15c0d4e33f68b32b300df2
- MD5 3422938208b0b79013d868c3803ec5b8
- SHA1 13e8840187588571a6daf0f351a3cc58d95e5136
- SHA512 fef9a0153251716c620dd4173b1d065ca3a29fdfdf0ec43aa7def178637b06e82b0617f4e389e368966b279e19d46f18822d9919fecb8e9015e3080d3170885c
- SSDEEP 98304:IuQ3X5Yt1g1MMtbzFqprAm2A8Gy49G9ZQrd/eJEl8cCVd4XKEp7vbrnbMuWi7Q7B:Ip3D1R6rF5y49kQR/HlCVdIjbbv6tqm
- TLSH
  T1B28633C17C822B71E55BC7B4A11231AE7D243FDBBABB4F1A77D4364029B1322A276744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2