c828822719ac87b9a64e9decc39bc09a802c143887bb492ffba11a77d307c814

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-kcpsvsdw5q
SHA256 c828822719ac87b9a64e9decc39bc09a802c143887bb492ffba11a77d307c814
MD5 dd3685ceaaeeb7ec4381ed9061bb99b5
SHA1 511f39bf42ec0836133627d58c3b2fef47366cb3
SHA512 46b93aef94b29b36d0b77143fabfaaa6a98aa2d719b67853e3234ca8e683ef3020253417c8d444a629700b97b433670f7247fb273774c7cddd300d63bd3ac43f
SSDEEP 49152:+S7Crkei40pGjr0+ltjUm34wgQCMcLHSPxblCaFlmSiHk1PPQCd5qI:+vrkG4G3Im34wnCMcrSfHzmSiQPYG5qI
TLSH
T1F3E5338DEC64B84BAC1D851D8372058F6B35817BCF8A1DF824E416AE5B83FEDB05D44A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.10.exe
- Size 34.6MB
- SHA256 b3db6dfe1e0b3f9d502a23edf3fd13dc5e9541a2b3a953cdbf3e71afce41e954
- MD5 dacec1f1381203d9e6970d0187f8ca67
- SHA1 72b013f4c564874097d49026663844177e724131
- SHA512 22c40767383f367f09af4e7c074290c9fd4884afc78a5f04f95a35699f443f2b68909b87a75932a2ecad4faf3bcf04df3386498eae76a72ad95f505eff5228c4
- SSDEEP 98304:g6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAE:bukQmH0HmKxofM3nl6UfMYrLgAE
- TLSH
  T1E2876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2