edd25a6ba1f0a6057f07ba81f90772ca1db7e51e3b246d476a1bce2a31b64e5d

General

Target
FACEIT_Installer64.exe
Size 110.5MB
Sample261024-cwr4bshs7p
SHA256 edd25a6ba1f0a6057f07ba81f90772ca1db7e51e3b246d476a1bce2a31b64e5d
MD5 78de752776227720fe7d8ced02d1860c
SHA1 c2d676eb2b18fd0cfe4764bb488f3e9ced799820
SHA512 05c1cf4ce128dd6ffbf679005be4eef26fbee654c22b448e962072d52eb8dbdbe97d420d39e91af554f1a61bfafeea0311465193d925c06e9dd9a8a5bb3c5842
SSDEEP 3145728:ZPwLH3vMtEhLLFWHBCQkzrVDZac94TA6k8G:1mfKsXMhkzxTeTdG
TLSH
T133483329926801B3D9A21579DB5ED933E732BCDA4F14918B23D07C3B7F130567A3A2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  FACEIT_Installer64.exe
- Size 110.5MB
- SHA256 edd25a6ba1f0a6057f07ba81f90772ca1db7e51e3b246d476a1bce2a31b64e5d
- MD5 78de752776227720fe7d8ced02d1860c
- SHA1 c2d676eb2b18fd0cfe4764bb488f3e9ced799820
- SHA512 05c1cf4ce128dd6ffbf679005be4eef26fbee654c22b448e962072d52eb8dbdbe97d420d39e91af554f1a61bfafeea0311465193d925c06e9dd9a8a5bb3c5842
- SSDEEP 3145728:ZPwLH3vMtEhLLFWHBCQkzrVDZac94TA6k8G:1mfKsXMhkzxTeTdG
- TLSH
  T133483329926801B3D9A21579DB5ED933E732BCDA4F14918B23D07C3B7F130567A3A2D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact installer persistence ransomware spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Deletes system backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1