a7936e35191786ade62f1f3af76a81e832b1fe58c77ce0f29285718207387614

General

Target
a7936e35191786ade62f1f3af76a81e832b1fe58c77ce0f29285718207387614
Size 2.8MB
Sample260831-dnswbstfqe
SHA256 a7936e35191786ade62f1f3af76a81e832b1fe58c77ce0f29285718207387614
MD5 ebc3e7a5dcf9cb4115ed828988995899
SHA1 fd2b34938ec66bb6c134a9b92784bf74ab12b600
SHA512 87e26dc21e0f253c47f6ff963d0307d76763b0f9e4f84cc678b3b9b0e44dfc3081b1731370952ca769f4c1f9d636424d7a03fe9eca6418d8731c8c10ae7f5965
SSDEEP 49152:xgVa2XhONjgnH4TL3KSEOFw5rGP+BuSgiPpesCPNFrZE8alh3Q3iwdyixMn:xgg2XEanotwB0nSZ4scNFrRa3Q3iwdTS
TLSH
T1BBD533E5DC7C7C8AD66F527AC837091886A510E5983B0CF5E4FA37390ACBBE4C6625D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_q0.3.03.exe
- Size 25.8MB
- SHA256 292272f35b22c02e4d2fba72ec3d8692f5de8a6d3244ba6bec5845a66523b857
- MD5 c65c6de058cd07bde5c1676d71c5f33e
- SHA1 891621111cf0ef7f18404f3d8e528a3853137fad
- SHA512 56032bc31aa74523abe99995e9836591450359cc69507a1f309bba183e0fbd01bbfd76ebb62b56601c4cb90709de5a3f8deed15197ca6ead0227df88ab6d5dea
- SSDEEP 49152:oudCDvwT4vMN0GUX+UPhsVEFAt8D4ak1t2J++32xobI8iR1aoPnMB9CfZ1Cy9882:Gvq0nXhSaF5MxcNafMHW+EnzYP1j
- TLSH
  T17457094EB7478DD3F9095638499687E433B3ECB08A5647033298B32D6FBF2885DA7581
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2