90314107a6e735c20eb830d472dddab9bac3625739ebfc920bff8bb7e3797c4c

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-nnec2seh38
SHA256 90314107a6e735c20eb830d472dddab9bac3625739ebfc920bff8bb7e3797c4c
MD5 0d824946d27e6cac34a51eb5839eb1c3
SHA1 ff8642bff05140ce98eb3e5e3e75173315c4b560
SHA512 93df6e87f2be910af0e8dd6a3349fc00509f151cc34775e71f4132cbf222baf54182067ce39a499c425a7dbb0dc4c0fd520be6b781de0909b1c9c4756fe03971
SSDEEP 49152:eQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWcF:eQu32Ky/KqjKRLz3hVV79pdrdGAqUA+J
TLSH
T1C1D53397CA671B94FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.04.exe
- Size 30.5MB
- SHA256 8455bf3908a1773574891842e2b2a33eb27cdc1f83c5beb85e6e9dc43cadbb3f
- MD5 b7e35d296a79591c6a2669db3959f92a
- SHA1 74429dde31296c67c87a38420286c6ca4ae35264
- SHA512 3356f3577a1e7853824ae237a810521444df3cea31893600a4cc60493be896fce3ed975991d7e993dd4d8b98caef853102d712470a2b068a356b6fb1a0925293
- SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYe:TC/p+HuPOc4n
- TLSH
  T11B67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2