Extracted

• • Target
    patch.exe
  • Size 509KB
  • SHA256 ac1f7f8efe964b1ce0290441d794446be7545182203cfae9030bf2f504d5787c
  • MD5 9b164a0c4e4e7a743f41c08088d57760
  • SHA1 2eaaaae91f034e3e74b6fe0934be424f9f21d5b4
  • SHA512 21aceb62e1122a84bd33d42cf95e6c235d2c2b02b6a18d1e8c6037752ebcfad5ba4bba32ca69205e1b5a045ea8ab3f27a9cb94b4cea7cc356ce802218e2d3fdd
  • SSDEEP 12288:fhoUZeviEqMeV89bROjl/1yJIRHqPuCA6H4pD0ai95WQHlT2:iUkn7eWBR5JIRR16zxvWaT2
  • TLSH
    T154B4AE2573E80E54E2FBDF78A4B171014ABABA4AD927DB9D1D0420CE0973B45EC91F72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasioncrysomeratprivilege_escalationratdiscoveryevasionexecutionpersistencetrojan

  • Detects CrysomeRAT Client

  • Family: CrysomeRAT

    CrysomeRAT is a Windows RAT written in C#.

    ratcrysomerat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Disables service(s)

    defense_evasionexecution

  • Stops running service(s)

    defense_evasionexecution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3behavioral4