Overview

overview

10

Static

static

9

f1a015c0d8...83.exe

windows7_x64

10

f1a015c0d8...83.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1a015c0d8f30aecac2e32e83bc6ad3e1236d3ba709255cb023a740e3fc45483

  • Size

    93KB

  • Sample

    220524-z9pxfsgfa7

  • MD5

    00161aff7e341a7049d1011270c43211

  • SHA1

    f8d4d89c7245fb6f47bf3dfc14197a97b15f3bcf

  • SHA256

    f1a015c0d8f30aecac2e32e83bc6ad3e1236d3ba709255cb023a740e3fc45483

  • SHA512

    18631006d93732182253dfadfba1328172a424b00978072b8345f8351a1cff3f9752ad6db40178f459b937ce524265fba3a6c2a836dbdc3aa206d9a87b43cb0d

Score
10/10
coreentityevasionrezer0trojan

Malware Config

Targets

    • Target

      f1a015c0d8f30aecac2e32e83bc6ad3e1236d3ba709255cb023a740e3fc45483

    • Size

      93KB

    • MD5

      00161aff7e341a7049d1011270c43211

    • SHA1

      f8d4d89c7245fb6f47bf3dfc14197a97b15f3bcf

    • SHA256

      f1a015c0d8f30aecac2e32e83bc6ad3e1236d3ba709255cb023a740e3fc45483

    • SHA512

      18631006d93732182253dfadfba1328172a424b00978072b8345f8351a1cff3f9752ad6db40178f459b937ce524265fba3a6c2a836dbdc3aa206d9a87b43cb0d

    Score
    10/10
    coreentityrezer0evasiontrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • CoreCCC Packer

      Detects CoreCCC packer used to load .NET malware.

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks