c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb
Size

56KB
Sample

221203-qylk8ahg4z
MD5

3b8a64d5d87cb5f98501d90d1902c740
SHA1

179e1a4b5f6db94165943bc62a64856c8bb5789f
SHA256

c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb
SHA512

57972c6aafa0818cc03c440a953a03b1a368d8f79a9fd17c18a0b127c1edb854cf6a6a4eb3b8700feacc30d3a63a3f8371d0a3c2bd490682de9d3e93a20e0bf3
SSDEEP

1536:8xLDHfZJ75TUf9Xm96ehhpNA1JPcifA8cjW0:8xLDHfZl5EZm4r1JPbfpc

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb
- Size
  
  56KB
- MD5
  
  3b8a64d5d87cb5f98501d90d1902c740
- SHA1
  
  179e1a4b5f6db94165943bc62a64856c8bb5789f
- SHA256
  
  c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb
- SHA512
  
  57972c6aafa0818cc03c440a953a03b1a368d8f79a9fd17c18a0b127c1edb854cf6a6a4eb3b8700feacc30d3a63a3f8371d0a3c2bd490682de9d3e93a20e0bf3
- SSDEEP
  
  1536:8xLDHfZJ75TUf9Xm96ehhpNA1JPcifA8cjW0:8xLDHfZl5EZm4r1JPbfpc
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2