9b9bb1d316cc12a5ab18503c036429363d1165626cc654ef08ce7e1df67a50f2

General

Target
9b9bb1d316cc12a5ab18503c036429363d1165626cc654ef08ce7e1df67a50f2
Size 6.0MB
Sample260805-nebksswele
SHA256 9b9bb1d316cc12a5ab18503c036429363d1165626cc654ef08ce7e1df67a50f2
MD5 6a5c62313e148fec2bf8a12c45fcdbf0
SHA1 1418d741321dfaf4baecd75609fe3a96535e3189
SHA512 6b479a457d4da84882df9e4b021c71d8e1ec3c55abc7d0052f6bdb120183b31e37afade3c175301f98d9757d388392c2e687b027fc99f87456d2cb86ac037e1b
SSDEEP 98304:Tt6Ld7yBnRZqLmNx6kKV0H+RnvhoiYlATLVQkpoi2HeiwEfa6jymcNSmgAaeG9GC:Tt6AvZimSN0ehelATxXip4xNStUGIiOA
TLSH
T14356339BECDF9E48FCF29278DA772217CF6234B417D19C43E09567CA1E8AA04CC5A644
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_r8004.exe
- Size 61.7MB
- SHA256 71bf88712d33fe6e2f948668cec905dbb5a10554b0b8869ad70109afc5410f9f
- MD5 fd1b145728af9dfa426db5dd69a71077
- SHA1 4bf9f31640ec2f3ef1c9ae037e9c49207da09237
- SHA512 9612f1afedc476c89b6ccd70d9d07a6c7a4431abe5c7f221d91110b5af383503bfec593034ef7c95b2af941aa234efe200563d03b2ec48ac0d1333720d9a8585
- SSDEEP 98304:guj9nmW2eUAAq4gm4mNSh6q+luaePvl8/bbJtF0gofLzXQQ7QfM3rE:BRnmW2s/m3xq9a2l8/QX9EfM3rE
- TLSH
  T192E78216B74289CEE076A238944B8F51E336E9704A71933723B5735D1FFE38C8EA6149
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2