Overview

overview

10

Static

static

7

6dba6ad753...07.exe

windows7-x64

10

6dba6ad753...07.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6dba6ad753db34abcac6d544a7e43507

  • Size

    508KB

  • Sample

    240121-w6yteagec6

  • MD5

    6dba6ad753db34abcac6d544a7e43507

  • SHA1

    d556f9c0726b1f7dd3b129b715a0ed7303472d44

  • SHA256

    0bb7b95f9be12bf7f0d7881d007e00bcf404888d30f063f4fab1b5d7acdf0a48

  • SHA512

    903851dff3dced887ba686634b9d1528389f98cfe65045924d6e7180707832e0febcfc4525a1b071c012eb6999ced82ed4259e64fa1278422ac31e006cd8a813

  • SSDEEP

    12288:4+x8j4HRNXhMnh2bV4TQboyOx23vPfm8kCH/zdh:4r0KnchzkydfbDdh

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      6dba6ad753db34abcac6d544a7e43507

    • Size

      508KB

    • MD5

      6dba6ad753db34abcac6d544a7e43507

    • SHA1

      d556f9c0726b1f7dd3b129b715a0ed7303472d44

    • SHA256

      0bb7b95f9be12bf7f0d7881d007e00bcf404888d30f063f4fab1b5d7acdf0a48

    • SHA512

      903851dff3dced887ba686634b9d1528389f98cfe65045924d6e7180707832e0febcfc4525a1b071c012eb6999ced82ed4259e64fa1278422ac31e006cd8a813

    • SSDEEP

      12288:4+x8j4HRNXhMnh2bV4TQboyOx23vPfm8kCH/zdh:4r0KnchzkydfbDdh

    Score
    10/10
    evasionpersistencetrojanupx

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Installed Components in the registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Defense Evasion

Modify Registry

5
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks