81cecfacec7f2a6b1d6ea1560171b370cdf5e7ec16117307b6b665520629955f

General

Target
81cecfacec7f2a6b1d6ea1560171b370cdf5e7ec16117307b6b665520629955f
Size 5.1MB
Sample260807-lrdjtasape
SHA256 81cecfacec7f2a6b1d6ea1560171b370cdf5e7ec16117307b6b665520629955f
MD5 d1053dfab37bcaed1475e53ff6647147
SHA1 3f3f1b2809b79fefd407e6cdb94a1d3730b76533
SHA512 d402279a469b1942f8e41a5843478352dfa086e83d6d4986d691b8258ef5538e6a49a16027149f03b77949306a643af1cb5b1135b57f8ab4b88543b88d2f426c
SSDEEP 98304:CXHfCZ9F6f0xKXuEiWPYZJjFK6SWQC0gfa7yQxJ9g2bT1pfbrkK0F80GffxnhhJ3:Cqn6SIrfPY1NEC0AExJ/1pD90F16hWi
TLSH
T1733633428F5168CE33E03BCDE7F1C9F136642B150E50108EF55E86DA2F5962E8BAF51A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_1.0.149.msi
- Size 5.3MB
- SHA256 a071eb92bb671d21d49b9f5495ebd5c6c0eaac04a0ddd3afb21534443d004ed6
- MD5 edd4be8504e88a12ec199bad0b4de82b
- SHA1 68da44b4d3f59d14f16280f41cc4a4999f632ff9
- SHA512 0c663c72c5914e941770baeff54632deb839203e77579b8a64bfdc8bc4c6f5f409a9b9b27b35c65f100ca02f263dabe88bc39e843b0f0762c75c125cfc32767c
- SSDEEP 98304:RruImmXtm+z5O8VCZQEIkLSZJ3FOqaoSKR4kI5z3BJRg2bv8KrJH5EC0xGYiL/zq:UImUt1zNAxVLSRfiKR4J5LBJv8Krxj0J
- TLSH
  T1364633C53EC536B5D0DBD3B48262667DB1283FC63EB60C0A76ED3A584E7221989B7344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2