2c668a339dca35da35b5d6a7fb68bf1cf94996f6110b06c746de30986e0844c2 | Triage

Sharing

General

Target

2c668a339dca35da35b5d6a7fb68bf1cf94996f6110b06c746de30986e0844c2
Size

43KB
Sample

221123-lrpl3sfe4x
MD5

91c46e95ce08e00514859222664496db
SHA1

90c1ae410c0f3966097abe03eb7b29f4f8824c98
SHA256

2c668a339dca35da35b5d6a7fb68bf1cf94996f6110b06c746de30986e0844c2
SHA512

079c3916fc35d77f8b7b92211cca770658eb7a173c31dc9baa5eafb755efe24df4e858228ce024a2f3316fdf7fffae37e9684506d83ccc991e89c5db2f73599f
SSDEEP

768:3PJadenAqtYQnaXH96rV2kllriFqR7Atmqfvfj7sMC72ZWzFwKF/Kppls:3PnAClrVLTrEqNAxvXsf7rzV/KpXs

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  2c668a339dca35da35b5d6a7fb68bf1cf94996f6110b06c746de30986e0844c2
- Size
  
  43KB
- MD5
  
  91c46e95ce08e00514859222664496db
- SHA1
  
  90c1ae410c0f3966097abe03eb7b29f4f8824c98
- SHA256
  
  2c668a339dca35da35b5d6a7fb68bf1cf94996f6110b06c746de30986e0844c2
- SHA512
  
  079c3916fc35d77f8b7b92211cca770658eb7a173c31dc9baa5eafb755efe24df4e858228ce024a2f3316fdf7fffae37e9684506d83ccc991e89c5db2f73599f
- SSDEEP
  
  768:3PJadenAqtYQnaXH96rV2kllriFqR7Atmqfvfj7sMC72ZWzFwKF/Kppls:3PnAClrVLTrEqNAxvXsf7rzV/KpXs
Score

8^/10

persistence discovery
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence