a80ef375b243630e00043c64e10c547a4c93b6bf2ad2d8c7cfef83b088064a1c

General

Target
a80ef375b243630e00043c64e10c547a4c93b6bf2ad2d8c7cfef83b088064a1c
Size 5.4MB
Sample260805-cx8gpscb68
SHA256 a80ef375b243630e00043c64e10c547a4c93b6bf2ad2d8c7cfef83b088064a1c
MD5 2bf13eb6595c371b97a6afad606a670c
SHA1 7af747d6d44793cea86d5b8b13b233ea1607bfa4
SHA512 bd22edb5ae6bea61581e89a44c41f99454437e146d844db5aa006e76d50bb09b63fa32285fab9286718ea29cc74ab0aaffe87d1dd58a03060a9c2cb2d754b680
SSDEEP 98304:6mtR2BLF9cLDpmQb3h5tIktNv6hPiXJXzPT7R9UPEXhMjgScPXdIIr1OXDpHDGyO:/zsoJnbxvv6hKXdPT7jRHXdIIrepHKaY
TLSH
T1CD463340F83BCEAEECEE2F388D501DD4DE545B38EC55595A45DEC42EAD88BC97B10222
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  inst_smt009.exe
- Size 55.2MB
- SHA256 2f31d5310132d4c049891078569da2dababc3d4273d6ccf9b24d2b035fe0263e
- MD5 e90fd95f586224a241ac4dd984437e8b
- SHA1 39cd0cbedc1386b476695a9e74e64ca475efa15e
- SHA512 88ae231563af80e3125f0f7b42d4571b7f861652eb16a9760b03cd53b8d17a083f8aa8b068d45a309cc461514903bc5ab2e212b6ed08bbfe5719caf3af7df56e
- SSDEEP 196608:HnnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps6c:HSRe9QD8
- TLSH
  T1F5C78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2