4718404db72fdd1b88ddb11c20ae0b1410543ca491685d9dc36d712ce86f3c12

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-ttdxcsstat
SHA256 4718404db72fdd1b88ddb11c20ae0b1410543ca491685d9dc36d712ce86f3c12
MD5 d6585abb45e4c19425528c44b3320b1d
SHA1 26fd9b31f1c958fa6918e62cd21c0414b0983aa9
SHA512 b1c5af0fafbcb0287630a497520f910c54ac8f69c845972d094264156599a12f84bccf60167b434417b66c58be8dfaa7c3c15aa905e9add05cd068f7f660cbe0
SSDEEP 49152:fXssrDqmCxbmylFyHoA00u9UPFyeNj0CcwjTC1NJ9T1HDVCiketNKdfDBCwJ:/sdZm2ABuSPMeZ0fwjmDXTHZ1odfUg
TLSH
T10FE53394A0AED5C952BF9416816039DE070EDB2D7EB1312B5CFBC397248B7DE618D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 34.6MB
- SHA256 47a249dfb5653ef0a36eab337fc98d209a45d96c3f61999fb133d42b187674b7
- MD5 c95bafdb46984b8cce5c012c06785729
- SHA1 769996308ff5b3605dbf4cbabe0980aa0ea097c6
- SHA512 58f2dba85c55642474ecff208c37da6728b6732876772db5d53a1d628301ac7a537a41b3e724324bdbe32188cc91e762b27e6a9ce70eefbf487330ec5038cfe9
- SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAI:6ukQmH0HmKxofM3nl6UfMYrLgAI
- TLSH
  T134876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2