564f23a904b3811e430a394dcc40699d66e1210f9810d4ae1fe26a93ad4a39b8

General

Target
COPILT.exe
Size 89.0MB
Sample261012-3fagfssxay
SHA256 564f23a904b3811e430a394dcc40699d66e1210f9810d4ae1fe26a93ad4a39b8
MD5 e5b888cf4f3084163c64f0608741a634
SHA1 75e19d26637e16046ebcbeb30953393220bdb5dd
SHA512 0c76e3f564c41e4ee698137ccd05c104443951b826ad5baaac3246ac877db5ad48a6a0e59b4e708e1dbe0c89022d64378459a69e6d66f25ae087f2d4c623f405
SSDEEP 1572864:jUBcVqw0hW83VmEPqb8iu6E6HvqwtizGtVKP0OiuB+laGRu:Av30EPqb8i3Hviz0a
TLSH
T1F918333FB894C981B18D91BCC5421CDECE41DA9F69EF9DC41B5EFE42A425A4E8E93403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  COPILT.exe
- Size 89.0MB
- SHA256 564f23a904b3811e430a394dcc40699d66e1210f9810d4ae1fe26a93ad4a39b8
- MD5 e5b888cf4f3084163c64f0608741a634
- SHA1 75e19d26637e16046ebcbeb30953393220bdb5dd
- SHA512 0c76e3f564c41e4ee698137ccd05c104443951b826ad5baaac3246ac877db5ad48a6a0e59b4e708e1dbe0c89022d64378459a69e6d66f25ae087f2d4c623f405
- SSDEEP 1572864:jUBcVqw0hW83VmEPqb8iu6E6HvqwtizGtVKP0OiuB+laGRu:Av30EPqb8i3Hviz0a
- TLSH
  T1F918333FB894C981B18D91BCC5421CDECE41DA9F69EF9DC41B5EFE42A425A4E8E93403
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer upx
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (2375) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2