4e015754cf49bbe4a053954cdbb1dfc9f8b598ebcdff242fdb8802eb4ab48f99

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-ca3myab17p
SHA256 4e015754cf49bbe4a053954cdbb1dfc9f8b598ebcdff242fdb8802eb4ab48f99
MD5 5016576f212a96983bd61d6a57b5f128
SHA1 ed705506ed9c543e4c64a6bbb5c34b15b612c7ef
SHA512 86032125c04c63db14af01236417c97faaf6b5165a61be7ea344096a4fa0053aaecf972031d515a255ef68003c56a8d49d741bb9e4fb4308442c63cc48a55e48
SSDEEP 49152:4S7Crkei40pGjr0+ltjUm34wgQCMcLHSPxblCaFlmSiHk1PPQCd5qZ:4vrkG4G3Im34wnCMcrSfHzmSiQPYG5qZ
TLSH
T109E5338DEC24AC4B9C1D851D8372058B6B76817BCF8A1DF864D412EE5BC3FEDB14984A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.07.exe
- Size 34.6MB
- SHA256 cf1bbfcbf29149645c1499ea8b351ef15d54c04590b29e32fac2781d402a28ec
- MD5 f90ac039b12fe2639aeb4f9cabdf893f
- SHA1 e300c133327725cc2b3263ec64e779bc34c63171
- SHA512 b781aea270c99ffd99ec796915f06dcb00d610428e33c461a01da936d87699fdfc09bb0c6e76c440f29e41d650ba0c36e38538f47a50a48e877bd27f47ae5c95
- SSDEEP 98304:I6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAA:zukQmH0HmKxofM3nl6UfMYrLgAA
- TLSH
  T123876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2