990f0b74b35057d409b8fe7558d9404b057c29965c6780f0f2212336dc4a44d0

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-j1bepss1es
SHA256 990f0b74b35057d409b8fe7558d9404b057c29965c6780f0f2212336dc4a44d0
MD5 d483d27b384631b01ccfc704bfed87e7
SHA1 1ba50ff3f0f9a7e4177741ba37ade1dab0afc0d4
SHA512 71737608c46e6b38e3c79a210533a1799e8f0154cf6bfe5f52e5945c4206469efa558840d84d5f715f3c677a531999b28738ed5bacb75ed847057b9cfaf1113d
SSDEEP 49152:ayuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbc:eUjFqquuu6f9Aau1lZIUH0PgExyDbbc
TLSH
T127D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.14.exe
- Size 30.5MB
- SHA256 5795ec9aafac2dfc9ec705332ee10b11a1ce992f423427b56ba38c6e8e356636
- MD5 e8b28cdff1232f19d3d42a04750cd1c9
- SHA1 20c20c3c90652242f79340fa620f08adca095160
- SHA512 c426869a4a789f1bb3bbae229cccfdbf8a9ceaa007fd5f4bbb4b73bee3150167f5d1fd50677be69f4cbccd4335dec0f48b80621757ab6c602bf65b93fcfe1e52
- SSDEEP 196608:iZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYb:5C/p+HuPOc4q
- TLSH
  T10E67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2