bf8b3ec0d0f7fbf66e12ba7b828d8ec9fc0d09ed8e9cfadeb6e6fa55d5087184

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-kdgtmstsbx
SHA256 bf8b3ec0d0f7fbf66e12ba7b828d8ec9fc0d09ed8e9cfadeb6e6fa55d5087184
MD5 1f132ec51aa49e21ecad2013a11becf1
SHA1 e41f1209a6061e354bdbb67c85ba0376d4d516ef
SHA512 034ebd88d6573511eb6c25cc23424b0cfae1c3b3e43cb831da0efe59cdefadfe7ca2f6c1749f5b7427292dc6666f07d09de1d07b1b32ccabb87dae957da10112
SSDEEP 49152:QQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWcK:QQu32Ky/KqjKRLz3hVV79pdrdGAqUA+W
TLSH
T1B9D53397CAA71794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.15.exe
- Size 30.5MB
- SHA256 d4cf48148cf6f44ef2eeb651e8ceecb64d6c2c6b3e2a0557fa0f65a6c1e57aef
- MD5 cec6860ba338b527052028d75250e952
- SHA1 59bb975b9817cc9c6d4debc07e203a9c20b1da82
- SHA512 347cf4fcb08ac3d1d9d0a9742645a17eb2d3ea53687ff05d5731fde9f849c3392c934f894b690d86565e67ae4089ec282ab2f49569abf11eac356bb567939f5c
- SSDEEP 196608:FZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYR:yC/p+HuPOc4g
- TLSH
  T10267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2