eab43cf7cb47b58827600c5b4e383ea00c112630b1adb2a92c62283a7dae93d4

General

Target
eab43cf7cb47b58827600c5b4e383ea00c112630b1adb2a92c62283a7dae93d4
Size 7.5MB
Sample260801-kdqrjs1eqf
SHA256 eab43cf7cb47b58827600c5b4e383ea00c112630b1adb2a92c62283a7dae93d4
MD5 1dfde1e9065c9ef5dc72fa66831bf5f1
SHA1 6cc3fa9930e314c9b4d0bc2221b02aba48e3a761
SHA512 b30c0acf51af0ad5197579629c5536a188dcc31282ba25487f3bf946931a3b1c77047782b9f1e06b4b66f22bdfb21c97f4bf3c224e870ed183871434e6271aa4
SSDEEP 98304:34urb15YLJaRMsR51je1raI6+iuQ4M2uAVJFQehCJRoVe8pz5LtjpI8UAHQTsD9B:340bDRpWrdDQxEVJhCJR0vjVhkNkT
TLSH
T1988633A764533A27FF7F6D7AF630739E0270185F48EF8B1F2092329671D4616A248D62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd014.msi
- Size 7.7MB
- SHA256 eee7b96904e300265f63759189b6caf5c9a6b9fb037f04f4c04c1fb707ce7c65
- MD5 21aee979f7ecfceeaf4f3f997fc9d6e3
- SHA1 e9da8fcb00394e3fe8cfc7496a4e20f76236e09c
- SHA512 14147c2e98ba7a254100191ae592bee55a287e9c2fb802403def1f47ab9698c4223357f83ce47de0421b90b30e7034bdc298743f3777d63fcf4087ea3597a62b
- SSDEEP 98304:IuQ3X5Yt1g1MMtbzFqprAm2A8Gy49G9ZQrd/eJEl8cCVd4XKEp7vbrnbMuWi7Q7z:Ip3D1R6rF5y49kQR/HlCVdIjbbv6tqU
- TLSH
  T1868633C17C822B71E55BC7B4A11231AE7D243FDBBABB4F1A77D4364029B1322A276744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2