c9ee6f5696de004bdcd6874a4fc87acf2cc9d75ef630ea7f331bf670794959b1

General

Target
c9ee6f5696de004bdcd6874a4fc87acf2cc9d75ef630ea7f331bf670794959b1
Size 2.6MB
Sample260820-r9cywszalg
SHA256 c9ee6f5696de004bdcd6874a4fc87acf2cc9d75ef630ea7f331bf670794959b1
MD5 a600c18e50b9e6b0b1bbe9968eab0e9a
SHA1 38727729f7a0bb0a5b46123ed7b6f9cfb4e47c35
SHA512 b8de29090c34a174a0e97d9035249f0ab740cb0b3222619f10c1a0b0e1ea6a0d7387053bf3627b51e92bec49f797601e7ed0d80d442591bebe4fe944929eea79
SSDEEP 49152:+q43jJCDIMMRW4TCDIxQFt9Bccf6f5dECa4tbKrHCrqH2UBcPGUBNK:ICDdVDIKsQC5d9a4tbxO2UBcPGSE
TLSH
T10CD5338300BEDDB6E91647B199B2DF37C1E340F39BE92147F98155EC9C20E2C915E2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  inste_a3.1.3.14.exe
- Size 37.7MB
- SHA256 508da4eacd217712fd37a0d93c461c22ef66e5ff3d7ed628f84eb3ad5d41bff1
- MD5 9b8bb9b42ba1198ed23acbb2cb6f8fdb
- SHA1 3cfcb204426ff82a0c867c7eed69a8ca6e78a182
- SHA512 822a42c2831bb0e9fa8759be1b8c8d21584c492613331ec2380141f33f5ddfcec6d4d694515dfb5e44bb24ceffc6eeeec82a591e3e67de6aafc5974b861185bd
- SSDEEP 49152:pzbKaSqzPPldbfPDZaLGZNT3E2fVAPfEMMEE5SjZpYbdWwimZthRW7B52pUZy0Yk:ZbvP6Gz7BXhDFkzht/
- TLSH
  T1B4877002F30559DEE47A6238488B4F55E331E9B096B1937723F9261C2FEF34C4EA6964
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2