Overview

overview

10

Static

static

fdf5e4a689...4f.exe

windows7_x64

10

fdf5e4a689...4f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdf5e4a689691a96bf93bc3b34b6368b1902a5413980def6a864a57f0325ef4f

  • Size

    160KB

  • Sample

    220524-tfrlascecr

  • MD5

    788fe4e8bdcff1069a879664b02410ec

  • SHA1

    3931f99406bf4f8e5320bfd8c3b89a5fdc7b0d55

  • SHA256

    fdf5e4a689691a96bf93bc3b34b6368b1902a5413980def6a864a57f0325ef4f

  • SHA512

    b63d2495f737e0b6f58e0b25b5ca03280c6db4abbc9ca06a78192930cdea6586a3864daad819320c932915b81b55d1f0136726097e11c5b831cbf1944b354384

Score
10/10
coreentityevasionrezer0trojan

Malware Config

Targets

    • Target

      fdf5e4a689691a96bf93bc3b34b6368b1902a5413980def6a864a57f0325ef4f

    • Size

      160KB

    • MD5

      788fe4e8bdcff1069a879664b02410ec

    • SHA1

      3931f99406bf4f8e5320bfd8c3b89a5fdc7b0d55

    • SHA256

      fdf5e4a689691a96bf93bc3b34b6368b1902a5413980def6a864a57f0325ef4f

    • SHA512

      b63d2495f737e0b6f58e0b25b5ca03280c6db4abbc9ca06a78192930cdea6586a3864daad819320c932915b81b55d1f0136726097e11c5b831cbf1944b354384

    Score
    10/10
    coreentityrezer0evasiontrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks