Overview

overview

10

Static

static

dd1aa660f2...6c.exe

windows7_x64

10

dd1aa660f2...6c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd1aa660f2f24368dd58c5ce7a709b6c

  • Size

    818KB

  • Sample

    201109-g4tq7xt3d6

  • MD5

    dd1aa660f2f24368dd58c5ce7a709b6c

  • SHA1

    a54d435a04d3e883b1773d1c8d439dc95628fa07

  • SHA256

    25f867b8065165d7876adb29673ac78be2a731ae82b9ea57eb54ba6479bc642e

  • SHA512

    a86738a5fd7915f3fbd9ddc8b5c3e01a936074749b7e8d14ceb91defef6657b5e5c1fc76fc6461b86424add2099c14b90c88b7b84de53928404562f2148b16b5

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      dd1aa660f2f24368dd58c5ce7a709b6c

    • Size

      818KB

    • MD5

      dd1aa660f2f24368dd58c5ce7a709b6c

    • SHA1

      a54d435a04d3e883b1773d1c8d439dc95628fa07

    • SHA256

      25f867b8065165d7876adb29673ac78be2a731ae82b9ea57eb54ba6479bc642e

    • SHA512

      a86738a5fd7915f3fbd9ddc8b5c3e01a936074749b7e8d14ceb91defef6657b5e5c1fc76fc6461b86424add2099c14b90c88b7b84de53928404562f2148b16b5

    Score
    10/10
    evasionpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

3
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks