d46a73ee15f206d77da227ed7d30a0c8aded6a6877fda06fc9bd5f0af88156be

General

Target
d46a73ee15f206d77da227ed7d30a0c8aded6a6877fda06fc9bd5f0af88156be
Size 6.8MB
Sample260814-re83vavgrd
SHA256 d46a73ee15f206d77da227ed7d30a0c8aded6a6877fda06fc9bd5f0af88156be
MD5 3f7cc28d4bebc013dc765a1cfef01c61
SHA1 630c625c9f0124c64a60dd258b13efeff08f7f37
SHA512 3692766bd24e85c2c2ca8c53dbab3d3aa4e18e9d033312d891016d002dc0dbe85dc038316e0f9243ee045cbaadc6e0c9305acc3a1558d31909de4d25eb956d21
SSDEEP 196608:thMRGDdgTIDWS987a2w1Bz6LYAGMPo6CJ8NIQURu+hCF:LdgTICNKBz2YcQ6CJ4iId
TLSH
T1E776237167085917E1B73DB2E4F01849341C26FDCADAB92FE3F837D4BEA21A98510623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinst_up015.exe
- Size 36.8MB
- SHA256 96875883b75b6d13b70d985ad09b916e30aac3ba78fb42199755ca48dafc8588
- MD5 d19bef9c35db50cfa9a0b6b3dfcf94a3
- SHA1 630ae786852f90213ac0ff65feabf2a4cd3fe67e
- SHA512 8a9629b40da178b8af11a23c1fbd467ce7bafe0a77418d8b789bc0cdc1518938a1dbfb7d519dd69aa7bd148f43f3440a32bb57366973a4c70457b783b7936cef
- SSDEEP 196608:ZFnmfRW0ATZPh7c2Qp3BqtiEPFNPyDhC81eHIy:/SRgXQhDhf1uP
- TLSH
  T17087F84ABB41CDD9E136923894AB5F01E331E97186B1976333B02729CFDB38C8F66558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2