35bf46a4562df3fdb49ab5cae2b83d4ff81ff495d916d2c4c3cd21aa3deb97f6 | Triage

Sharing

General

Target

35bf46a4562df3fdb49ab5cae2b83d4ff81ff495d916d2c4c3cd21aa3deb97f6
Size

842KB
Sample

221123-z1z13aec48
MD5

44ab671f5c236837cec2588ffa3b13a0
SHA1

35aa266ccc17754c64a195349698da143cbcccea
SHA256

35bf46a4562df3fdb49ab5cae2b83d4ff81ff495d916d2c4c3cd21aa3deb97f6
SHA512

20ddf228c9bf5a38fe582fbd725b7ee29248115219dcdae23ef471e68806be908ad3e84a63686da98cc7681b15cf433391f69de301efd463efd16184526f1fad
SSDEEP

24576:wX/ajNHhm/QeN/7DSBfWhYqmTI96H0m8R:hHU/ph7GBfWOqClHy

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  35bf46a4562df3fdb49ab5cae2b83d4ff81ff495d916d2c4c3cd21aa3deb97f6
- Size
  
  842KB
- MD5
  
  44ab671f5c236837cec2588ffa3b13a0
- SHA1
  
  35aa266ccc17754c64a195349698da143cbcccea
- SHA256
  
  35bf46a4562df3fdb49ab5cae2b83d4ff81ff495d916d2c4c3cd21aa3deb97f6
- SHA512
  
  20ddf228c9bf5a38fe582fbd725b7ee29248115219dcdae23ef471e68806be908ad3e84a63686da98cc7681b15cf433391f69de301efd463efd16184526f1fad
- SSDEEP
  
  24576:wX/ajNHhm/QeN/7DSBfWhYqmTI96H0m8R:hHU/ph7GBfWOqClHy
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2