ecef9c23a5de343eba209c43bbad2a521fc403069acddb2a4ce8965404d28e08 | Triage

Sharing

General

Target

ecef9c23a5de343eba209c43bbad2a521fc403069acddb2a4ce8965404d28e08
Size

140KB
Sample

221203-xtck3sgb74
MD5

34fb496426b66de83257f34239f196eb
SHA1

737f705d32dd3969b2a688da8b8250004a857ea2
SHA256

ecef9c23a5de343eba209c43bbad2a521fc403069acddb2a4ce8965404d28e08
SHA512

97f8f1a9fb6213bcabe5ad186a62e4605ac3f57c5d8f8504c06a4dbf14942f3d8f71bb343b7a5e3fc2d83dae657086030b58faebcec9ae701f337b38c31060fb
SSDEEP

3072:6feOeIStu3NP0glbFhBFtB+oTzgRAQID0puQWO+H29RZvoi5FtbG:6xuANcglbFhBzccFJO+H2lvoi5Ftb

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  ecef9c23a5de343eba209c43bbad2a521fc403069acddb2a4ce8965404d28e08
- Size
  
  140KB
- MD5
  
  34fb496426b66de83257f34239f196eb
- SHA1
  
  737f705d32dd3969b2a688da8b8250004a857ea2
- SHA256
  
  ecef9c23a5de343eba209c43bbad2a521fc403069acddb2a4ce8965404d28e08
- SHA512
  
  97f8f1a9fb6213bcabe5ad186a62e4605ac3f57c5d8f8504c06a4dbf14942f3d8f71bb343b7a5e3fc2d83dae657086030b58faebcec9ae701f337b38c31060fb
- SSDEEP
  
  3072:6feOeIStu3NP0glbFhBFtB+oTzgRAQID0puQWO+H29RZvoi5FtbG:6xuANcglbFhBzccFJO+H2lvoi5Ftb
Score

10^/10

evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2