2e57e3c42667cc5ee68377c20be9ea0c853684a2086aa0b00be7d5b2e39902a8

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261023-fe8xaswwbs
SHA256 2e57e3c42667cc5ee68377c20be9ea0c853684a2086aa0b00be7d5b2e39902a8
MD5 e2df7241c2cc09327eb75f66adf492f9
SHA1 64d2fbde9c698cf08c49f523083ebbd6c1d44c5e
SHA512 76949c1dc9d4031f47f89ac511f80d99ea1cd61b9ff5b4877a66a51799952f7951d89dd11450a090f63e20f5e12343c67beaeec45b754cfd4f06121f6396d02d
SSDEEP 98304:klKGExswz9I2lyPhSM+HCrJB6xmBtXLb5Ww2B+Dj/:klUV970hSM+HCrsmfXLN9j/
TLSH
T1A0E533E6E1ECD0C06CBEE065C79637DE9A2F82A8647B380DDCF692A159477700194E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.09.exe
- Size 34.6MB
- SHA256 6f5963597108a237b833e95305e0efe10d256ac9bff96deddb48f9fa8f2f2a1e
- MD5 41441dd4eb47f006f3b128e54870f0ad
- SHA1 26c13afa31cdf93c2abd5cbdb503f4e85f0db1d9
- SHA512 343c7d5da4fc7229a92c9751604e4a15db5ffe28158bddbbd45fae3dcece89627bbfe2f67292326793d08769d5eccd6a3737c22ad6b9a1c977232b6b58e916fb
- SSDEEP 98304:x6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAE:wukQmH0HmKxofM3nl6UfMYrLgAE
- TLSH
  T1FD876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2