b187f7466c75ea511033395eb881e24f8d9da799c9d47487295a5b787158f904 | Triage

Sharing

General

Target

b187f7466c75ea511033395eb881e24f8d9da799c9d47487295a5b787158f904.bin
Size

1.1MB
Sample

230505-xqyzxaaa3v
MD5

03c4c7ef4fe576ab5d1d7b2daff63584
SHA1

51c90514b9b0a8c610fcba31be6129e15bd86b69
SHA256

b187f7466c75ea511033395eb881e24f8d9da799c9d47487295a5b787158f904
SHA512

12d2d8af7a3b40172a9a342efb50aaeb70bb9a9ffd739bf3614a1295a2e370ba461918a72839402e0f18a5f97b1b2ec776c59d4fe682e8f67e340bee1bcf24e0
SSDEEP

24576:gykytLEDywasGeWFIyv1jCusL6F0E8blAToMUw0:nksgDPazqyv1jzt0JRnMD

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  b187f7466c75ea511033395eb881e24f8d9da799c9d47487295a5b787158f904.bin
- Size
  
  1.1MB
- MD5
  
  03c4c7ef4fe576ab5d1d7b2daff63584
- SHA1
  
  51c90514b9b0a8c610fcba31be6129e15bd86b69
- SHA256
  
  b187f7466c75ea511033395eb881e24f8d9da799c9d47487295a5b787158f904
- SHA512
  
  12d2d8af7a3b40172a9a342efb50aaeb70bb9a9ffd739bf3614a1295a2e370ba461918a72839402e0f18a5f97b1b2ec776c59d4fe682e8f67e340bee1bcf24e0
- SSDEEP
  
  24576:gykytLEDywasGeWFIyv1jCusL6F0E8blAToMUw0:nksgDPazqyv1jzt0JRnMD
Score

10^/10

evasion persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan