3ad0eb8f66da7d609f0638644f09143d7e153c6def80d96e667c399fe5f22e70

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-datwgaht9t
SHA256 3ad0eb8f66da7d609f0638644f09143d7e153c6def80d96e667c399fe5f22e70
MD5 4eab992539d2f257237131986a83f652
SHA1 c2c37863ecc41f651d4a76cb50200f3f798f9b27
SHA512 d41de7521e66ae35841e291c45e0e94a344f243fb7888e6f2284e837e83322c5e30d243539c2c56a50a2b349af6a50d4a2bde5971ce0cc6bac66fcce9e5df16a
SSDEEP 98304:okpt2wTLbIUY1Yjc7WE6uyWQiQX0ewnuT3g07ACy1t:bHIic7WE6uyWQi40ewnG7ACat
TLSH
T172E5332DCCBDE8966829A605075438166BAB813E5F0F4EF544E8235E0FC7FDE746848E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.10.exe
- Size 34.6MB
- SHA256 9938aa5e282e80c2c4a9777087a189558acb602e95b8dc52e2383d67196c5e7b
- MD5 683c41ba710b85824afd41b23c663286
- SHA1 e33e731708fb090c2f03831d01ee47bc8ce6a32c
- SHA512 6360d3f0dd8229482b5eeb29780f65db242e5bbae7f32c4ee2fcad63a3c1dd0babff9e5ffa7d766954fce29c4730092557e525582f7cb6335db92a51aa8030d5
- SSDEEP 98304:Z6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAh:oukQmH0HmKxofM3nl6UfMYrLgAh
- TLSH
  T197876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2