cecb2ee3c83046edd188eaa14560d4ca7cec0a7be383fd3cb7fda6fea46d84f9 | Triage

Sharing

General

Target

cecb2ee3c83046edd188eaa14560d4ca7cec0a7be383fd3cb7fda6fea46d84f9.bin
Size

1.5MB
Sample

230505-yektkscc3y
MD5

b0cc5316c4796d64dd84e557d2caaa3e
SHA1

bfae5803b10f6d4b35928e06561bffdd73c211d8
SHA256

cecb2ee3c83046edd188eaa14560d4ca7cec0a7be383fd3cb7fda6fea46d84f9
SHA512

696185294f94b916c551908d3bfc95e8dbec50e158f8d70e30effa550549a7939ef80ff9b6e393969087bd8bc10c3a34a3b07a9c3a27771b0a46a3a00f2ecffc
SSDEEP

24576:hyhbx1EWlTJkjDD6F+c0UFabZAqGaFYhRSy7cr05Uo67hNmeHKy2/8jVw299QP:UhbPJkjDDm+HiKYGy74yyYk2EhwB

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  cecb2ee3c83046edd188eaa14560d4ca7cec0a7be383fd3cb7fda6fea46d84f9.bin
- Size
  
  1.5MB
- MD5
  
  b0cc5316c4796d64dd84e557d2caaa3e
- SHA1
  
  bfae5803b10f6d4b35928e06561bffdd73c211d8
- SHA256
  
  cecb2ee3c83046edd188eaa14560d4ca7cec0a7be383fd3cb7fda6fea46d84f9
- SHA512
  
  696185294f94b916c551908d3bfc95e8dbec50e158f8d70e30effa550549a7939ef80ff9b6e393969087bd8bc10c3a34a3b07a9c3a27771b0a46a3a00f2ecffc
- SSDEEP
  
  24576:hyhbx1EWlTJkjDD6F+c0UFabZAqGaFYhRSy7cr05Uo67hNmeHKy2/8jVw299QP:UhbPJkjDDm+HiKYGy74yyYk2EhwB
Score

10^/10

persistence evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistencetrojan