76416b238ccc0a57e5a350624a668618bfba075f0f1f88e084b31f71ee4a1ad1

General

Target
76416b238ccc0a57e5a350624a668618bfba075f0f1f88e084b31f71ee4a1ad1
Size 3.3MB
Sample260813-cdc7fszbrh
SHA256 76416b238ccc0a57e5a350624a668618bfba075f0f1f88e084b31f71ee4a1ad1
MD5 ec5f0f72ca0ca10b9b880ac53df894e5
SHA1 28edc19065aeb9f26b346ca8f30e3ec6a9249568
SHA512 1617c20f14b1623277d11fea69af4d23cdc28df98ddc4301a2101f31f149f25c2b0431ee5a8969a792f703f1ea458ae22361a0dfacf3c89b99d835492be81b18
SSDEEP 98304:+Qx0MKcscw/RkqjKj/PsLbv8/loG+zjgio+UhgcdsJkccLaEZI3AGZXJe2nV+ok:txHVaHgW8lcggisHcWEy3AUZz+ok
TLSH
T123F533EFA11D9E77E4E052FAAEBB80430BD115F70BCA35215A0469D34E26A2DB1F0F54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_sint016.exe
- Size 40.7MB
- SHA256 d71abd7c4df0e1b93d1545dd2d281c4fd488b6c944fcffe2afedcc2d4a9ff9a7
- MD5 d079e2c72a931bde9740b655c9592935
- SHA1 af4b5c464132c57eb474321b5d12b8d12275a91b
- SHA512 b73ad70608601b2b3e218c1d59e2de3e3d6bc61ff8f64d0adeeb8110736b91e68dc6fe13ed8e99a080c102bc5309a9051962f0955d802aa9c9556f6cd4fd8bbd
- SSDEEP 49152:HJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejntn:Hu/9nmHZLxG80DuKA3XAD8ntZfh6fgCQ
- TLSH
  T197974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2