623c716ebd5e19130e1856612be5c304236dbc9ab6075d4ead03f10afeac1e31

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261023-ma3ytacf38
SHA256 623c716ebd5e19130e1856612be5c304236dbc9ab6075d4ead03f10afeac1e31
MD5 7b6b1d61caf2e88219d0268b804a7fda
SHA1 8dcdcaadeb50104a66cc6c646bb3ac01dbb1233b
SHA512 ca6f729067579ad9a1b401539a6a54a3a9c928db1af07d223d9127062e4c4e395511e8307b697de0fbbc35506feb087a54ea03233d754c25ee20727cf870d250
SSDEEP 49152:rQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWck:rQu32Ky/KqjKRLz3hVV79pdrdGAqUA+w
TLSH
T19FD53397CA671794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.04.exe
- Size 30.5MB
- SHA256 1a9329e07432690ecc88836f85f2aaff45cc845d3a126a6090b336764aedf690
- MD5 2ebca74e9502b1df7849ca33ee5eaf63
- SHA1 9640c81926ff2d089128c0dfb9e451577d542fdf
- SHA512 67312c5af5ccf0832662f83825548aa1c125cd6eed867e56e2bc93d9394d6353f83440dbc6e2132890b128c76ab60fe19782afd247bf01199f7d48768d95d5cc
- SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYt:TC/p+HuPOc4c
- TLSH
  T1AD67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2