5c5ce50f5330a6f9d279bad066f196e0491e630378da0b1a18084a25b639a06b

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-t16wqadx2x
SHA256 5c5ce50f5330a6f9d279bad066f196e0491e630378da0b1a18084a25b639a06b
MD5 ede8a372d58849f6f82d4d26e4ad0818
SHA1 9a3506e509df44d888f1530f0edfa0c6ec2f06b2
SHA512 6b1aef89e9c4a41a02c1217dae92d452f5b8ee1881c94d805a8a40b961f7d23db20605c1ddaa08c28deaf0323df57e38660acf9ee6bf21836c5e80131b97cd00
SSDEEP 49152:uXssrDqmCxbmylFyHoA00u9UPFyeNj0CcwjTC1NJ9T1HDVCiketNKdfDBCwA:ysdZm2ABuSPMeZ0fwjmDXTHZ1odfUR
TLSH
T16AE53394A0AED5C952BF9416816039DE070EDB2D7EB1312B5CFBC397248B7DE618D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 34.6MB
- SHA256 036c5f9c36cad41721c07c7a0ea059e78f196074df9c54f177f9736944a4e5ce
- MD5 6509c3c2319f5655b29dfa49de1d1528
- SHA1 62a40f6f9e09f09ded8bc9f29e3dc565aa0c44c8
- SHA512 195f576d790f0a8881775be75bf8100a2203303086af8d71f05dd0ceb772cd4de90f593a118b117730e1252a4e56f189d2f56b2c68d6cf80212b13b3ff6a289d
- SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAd:6ukQmH0HmKxofM3nl6UfMYrLgAd
- TLSH
  T1EA876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2