455bcdd28e234b1d0d1980a6f19517b7d72f0c3a7fb5a323636621dfa524888a

General

Target
docusigninstaller.exe
Size 4.2MB
Sample261012-tk4resgw2n
SHA256 455bcdd28e234b1d0d1980a6f19517b7d72f0c3a7fb5a323636621dfa524888a
MD5 6f9b0cef01f7e8375ec474bdd55a6b63
SHA1 15a3995a79d02c34925944f90e486f15e2b59228
SHA512 552cd6a059be4249fdc076243e0e793efdff128ad2e5c6d1664c11c5e61160f61fc2fa6be01ca42c80f42924321b61b94c713574ae32bec11ac8b1be0dab3453
SSDEEP 49152:aP0dfmVfyr+CU8D1i+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA26Yuw:aPt6Laeoi+0QFfXp4Oiw
TLSH
T19D16CF90FCDB54B5E603553158AB62BF2734AD094F31CBC7D6407BAEAC73AE10936229
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  docusigninstaller.exe
- Size 4.2MB
- SHA256 455bcdd28e234b1d0d1980a6f19517b7d72f0c3a7fb5a323636621dfa524888a
- MD5 6f9b0cef01f7e8375ec474bdd55a6b63
- SHA1 15a3995a79d02c34925944f90e486f15e2b59228
- SHA512 552cd6a059be4249fdc076243e0e793efdff128ad2e5c6d1664c11c5e61160f61fc2fa6be01ca42c80f42924321b61b94c713574ae32bec11ac8b1be0dab3453
- SSDEEP 49152:aP0dfmVfyr+CU8D1i+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA26Yuw:aPt6Laeoi+0QFfXp4Oiw
- TLSH
  T19D16CF90FCDB54B5E603553158AB62BF2734AD094F31CBC7D6407BAEAC73AE10936229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor defense_evasion discovery execution persistence privilege_escalation ransomware rat revoked_codesign adware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2