6ba0f021a0072fc15a6cc35cbece9d6d90d20c892c43c5bf23f417ee8051f640

General

Target
6ba0f021a0072fc15a6cc35cbece9d6d90d20c892c43c5bf23f417ee8051f640
Size 5.4MB
Sample260805-c3scnscc33
SHA256 6ba0f021a0072fc15a6cc35cbece9d6d90d20c892c43c5bf23f417ee8051f640
MD5 e5221822b0d5e7585c60a2f70fc5756c
SHA1 b1466c666c23a994d2d2d3c8d325ccfed533d3df
SHA512 dfb53de21e3fd607d1a38643fa83d0b06c9ebcc4600cac6272100f48c9ff48e2ba250675c3712c4d0c062e2395bb4fcf6290d56fe1aed6f7321e459d538b8dba
SSDEEP 98304:ZyJOksLHaXHrVnExlceMhdMCoB4ClJXzPT7R9UPEXhMjgScPXdIIr1OXDpHDGypE:MfrHGlc9OrfdPT7jRHXdIIrepHKa6Pae
TLSH
T184463346F5639A9EFCEF0F38CD101EC99A888628EC424C66DEFED81D5D89F857B10605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  inst_smt008.exe
- Size 55.2MB
- SHA256 832f507752f98f4566af50bef575c6ecd6931d2b0cf7d668c644b6ea4dda224f
- MD5 c1dc9ce2475d332b97b7a0617ce76891
- SHA1 fc3b14beb6d1ea33742d6871fc8a4c6b3b0a9cb8
- SHA512 1646bf0130be2cb96aa0b6cbcf9e040d309685764cb9010958fd9d24e1bfb648ff12966cbcf0f9e0b6f62246791d55bfdfd49de342229458215d8d41892b79e6
- SSDEEP 196608:InnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps6Y:iSRe9QD4
- TLSH
  T1B8C78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2