569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77 | Triage

Sharing

General

Target

569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77
Size

109KB
Sample

221123-rlkntsgh49
MD5

05d355677e0ded454d952b3eaf8c52fd
SHA1

df2d6da1168ca1fe3571f3a83f12bf061a3f19fd
SHA256

569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77
SHA512

942cb3bbeccf8e67446ce7f9c37ddad8ae4bb69573eae00da15b0db83fc3d8aa2a9c6b797846eb90a53f01a568c69b11657defcdc0cc58d8eef3cb0a1a1d5d10
SSDEEP

1536:fAvmyHcD9m4kjaLDyRcYP8EYP2NVRJnlQyFKeBbLVDA:fAueuLDyRJ8ERNVRJlPFK4ZA

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77
- Size
  
  109KB
- MD5
  
  05d355677e0ded454d952b3eaf8c52fd
- SHA1
  
  df2d6da1168ca1fe3571f3a83f12bf061a3f19fd
- SHA256
  
  569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77
- SHA512
  
  942cb3bbeccf8e67446ce7f9c37ddad8ae4bb69573eae00da15b0db83fc3d8aa2a9c6b797846eb90a53f01a568c69b11657defcdc0cc58d8eef3cb0a1a1d5d10
- SSDEEP
  
  1536:fAvmyHcD9m4kjaLDyRcYP8EYP2NVRJnlQyFKeBbLVDA:fAueuLDyRJ8ERNVRJlPFK4ZA
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2