301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f

Resubmissions

23/03/2024, 23:50

240323-3vttmsed8810

12/12/2020, 10:26

201212-wddwj75xse10

Sharing

Copy URL Twitter E-mail

General

Target
301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.sample
Size 413KB
Sample201212-wddwj75xse
SHA256 301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f
MD5 3023d7526b479ea3df315a5b1779a43d
SHA1 b5ae71b96a28b9353a4f33c5370ac18750937c17
SHA512 67fe1cf7538e8ef76b6acbba99326af0de58464bf5710ae6fa7b85d73da9a84c58122de6b87c7d9560f0d366de711a95d03be231c1018eacb7489fd32aeb0834
MD5 SHA1 SHA512

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.sample
- Size 413KB
- SHA256 301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f
- MD5 3023d7526b479ea3df315a5b1779a43d
- SHA1 b5ae71b96a28b9353a4f33c5370ac18750937c17
- SHA512 67fe1cf7538e8ef76b6acbba99326af0de58464bf5710ae6fa7b85d73da9a84c58122de6b87c7d9560f0d366de711a95d03be231c1018eacb7489fd32aeb0834
- MD5 SHA1 SHA512
Score

10^/10

evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies security service
  evasion
- Suspicious use of NtCreateProcessExOtherParentProcess
- ServiceHost packer
  Detects ServiceHost packer used for .NET malware
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Modifies WinLogon for persistence

Modifies security service

Suspicious use of NtCreateProcessExOtherParentProcess

ServiceHost packer

Executes dropped EXE

Modifies Installed Components in the registry

Deletes itself

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2