126bdc37c80f075d1923654f23b9aab74a889bc06f46a2c2ab793ded80b61bc7

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-ezz98aw14l
SHA256 126bdc37c80f075d1923654f23b9aab74a889bc06f46a2c2ab793ded80b61bc7
MD5 145a6dcc192b9fce293fd0b6b14f7b94
SHA1 de61dbfd82d67d715242f8887f2d917a150ed512
SHA512 2724971a7958b959f584dab25a7b699e222e6fc9c4d2affb580d0e9fd99ce126ef78b26fffa55bc1c0b83a4f5f9107178e3523d0d327d073f22df094870b8a27
SSDEEP 49152:ayuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbz:eUjFqquuu6f9Aau1lZIUH0PgExyDbbz
TLSH
T1D1D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 013915c71ed6efa5b85dda72d0bb5092a17571b1e4d8d06b41a9f9d6f18893d4
- MD5 2889e2a8c7e0c15491497026f3afbee0
- SHA1 b46666aad27651d3ec6d0f5230b968d9fa4066dc
- SHA512 bbedb1dac4c978fe56f4fbe7dc7c2cca6d3ef75473cb68121efb0c6c7a75e07884674fa48ac891bd0b13b6012e97682b0696072cafd14ae651cae606f7ba16e9
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYA:DC/p+HuPOc49
- TLSH
  T14A67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2