da8f0c51f06cdd3d257760f3a6af00f40dca69c0d7f347883570148b6b7abc20

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-e585bafx6z
SHA256 da8f0c51f06cdd3d257760f3a6af00f40dca69c0d7f347883570148b6b7abc20
MD5 23e14f4b9917140918d6fa0c7778c7f3
SHA1 0dc1afd1af491d9752e8bcedc8a5a27a07b92a20
SHA512 f7d72e845bc7b21ae11971b3cb7eb64c1a7eae158c63cb806ac5d287925c9bec1978572abdc25f474b57634d792f6aa74f8e16f6dab144f48ddaf4e437ba951c
SSDEEP 49152:AyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb+:sUjFqquuu6f9Aau1lZIUH0PgExyDbb+
TLSH
T1A9D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 79aa31132712acebc4d2c0c6300c78729b640055d7fb7c3f37b6b9e830a25488
- MD5 873f8d79c07a242dc1b93a17d4e8b9e5
- SHA1 35b366f225dba63fa2e0822f6702d9c5e80ae91a
- SHA512 406d4d21346b0c21a4f6fddfd74600e23cae7a9963a2e5afd7509e615a5338379d7fbf8a138caa2a535d2fb962375d40c28e46f9f4241be543e80be4442d3a82
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYu:DC/p+HuPOc4T
- TLSH
  T13267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2