2c364684aff937a60ddf8621b1083d51b95a701e2fa1969e9b3bb3ed87417185

General

Target
2c364684aff937a60ddf8621b1083d51b95a701e2fa1969e9b3bb3ed87417185
Size 7.5MB
Sample260801-ke2kfaxtav
SHA256 2c364684aff937a60ddf8621b1083d51b95a701e2fa1969e9b3bb3ed87417185
MD5 876771fe901a79d7111c587aac89881d
SHA1 58034b70d3aa41244abf3072a2a40dc2f286d7f1
SHA512 41b19c23e7fc49f603baf4bdc74c072f9ad284272ec556f6c29d0b30ad5461366885f2eacd05ce899cee9dfafdaa927f596171da17eb3ef01e080027ce1c5807
SSDEEP 98304:K4urb15YLJaRMsR51je1raI6+iuQ4M2uAVJFQehCJRoVe8pz5LtjpI8UAHQTsD9M:K40bDRpWrdDQxEVJhCJR0vjVhkNkm
TLSH
T18F8633A764533A26FF7F6D7AF630739E0270185F48EF8B1F2092329671D4616B248D62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd014.msi
- Size 7.7MB
- SHA256 899561856294d99988c0d1a9d7b333c05b48b54621ebd2624b104c6e92e3792e
- MD5 05667e0aa333885750eeac0d711027f4
- SHA1 a508a95aae5a8c65bea1853d7372b2e66f70a363
- SHA512 460f4c990c7e35b174439428099400caab92fce78dc0584ea35c2ae8e8839774600fec8ebd0f10effb820a9039100f5dc172002476d3a291cc62e24edb74b631
- SSDEEP 98304:IuQ3X5Yt1g1MMtbzFqprAm2A8Gy49G9ZQrd/eJEl8cCVd4XKEp7vbrnbMuWi7Q7a:Ip3D1R6rF5y49kQR/HlCVdIjbbv6tq9
- TLSH
  T1418633C17C822B71E55BC7B4A11231AE7D243FDBBABB4F1A77D4364029B1322A276744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2