0129f442316f990f2f7d1877e275478306ce0dd45caf3e462a9715c907c8dc15

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-nkl9gstybt
SHA256 0129f442316f990f2f7d1877e275478306ce0dd45caf3e462a9715c907c8dc15
MD5 e6d1187e10f3fd114d8b49b4a179cbeb
SHA1 add339aa04ea06c437510acea205480712181702
SHA512 dc2451dc99274a601c11ef62c4885afc403394a66e9443585e2becc926b02ff17477a8fdb782db62734d4649495efc6edf33f6467ae65249fc86e6b2c72406b0
SSDEEP 49152:bQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWcl:bQu32Ky/KqjKRLz3hVV79pdrdGAqUA+p
TLSH
T1A2D53397CAA71794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.04.exe
- Size 30.5MB
- SHA256 fd8e57418914be4e131812754f5aca76ca880ecbda5b9921fbcbe4ce56f48ef8
- MD5 e15781164ee9866752232a23ef383d4f
- SHA1 8ef1b3f054d666b6355003653d8ec64cdc272486
- SHA512 39b7df455db262a47db68ee7bd1c454c5d9bec30fbf0bf3bf8e19152537b5b9d734a3eb91816f12ee20cad18eb55cf21cbdd291c86a5766dcd11444c02470f56
- SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYI:TC/p+HuPOc4x
- TLSH
  T1D067181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2