59c57bb77f89b0993885f7e4df7e869fa0321a570969cf2e17b28aaf5ee67440

General

Target
59c57bb77f89b0993885f7e4df7e869fa0321a570969cf2e17b28aaf5ee67440
Size 7.5MB
Sample260801-kfz31axtcs
SHA256 59c57bb77f89b0993885f7e4df7e869fa0321a570969cf2e17b28aaf5ee67440
MD5 faf10f3a226bcdabdf5beac831bf255c
SHA1 90cd1f73158135d1ac23ec47e66e4f2342a8d4e5
SHA512 ec05d66eb77110f3c6beb6997b58a21d15e4b850e4d7e3e568582a439de31ff484ac48e1c06c6d9ae1dd09cf8704384dae1acb8a9f17288d63839a0e2fd8bb6c
SSDEEP 98304:F4urb15YLJaRMsR51je1raI6+iuQ4M2uAVJFQehCJRoVe8pz5LtjpI8UAHQTsD97:F40bDRpWrdDQxEVJhCJR0vjVhkNk5
TLSH
T1B18633A764533A26FF7F6D7AF630739E0270185F48EF8B1F2092329671D4616B248D62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd014.msi
- Size 7.7MB
- SHA256 fe4aa8172beb88aced1bd5d474e6e0e5904e531242fb6041ad22839d335ce3cd
- MD5 31d985cdf4b19db660e06c5273bc4ecc
- SHA1 48a78c87f2d690d2afb7c635157058c841b32368
- SHA512 5d2df9ce25a65beaff4d6a2e2dfb1011e6e2b544deabfa9a20c17c2515e33f0fa7529de00532a6a420601d7e5d8c4b5ba89e1e6cbca1ba4d9c737c2690b79ac2
- SSDEEP 98304:IuQ3X5Yt1g1MMtbzFqprAm2A8Gy49G9ZQrd/eJEl8cCVd4XKEp7vbrnbMuWi7Q7S:Ip3D1R6rF5y49kQR/HlCVdIjbbv6tq1
- TLSH
  T1638633C17C822B71E55BC7B4A11231AE7D243FDBBABB4F1A77D4364029B1322A276744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2