5e9d5f16ba543b06cb9e2100c3cd720041d3aecb67b8c7c998d3e2033f2f4df7 | Triage

Sharing

General

Target

5e9d5f16ba543b06cb9e2100c3cd720041d3aecb67b8c7c998d3e2033f2f4df7
Size

69KB
Sample

240307-y7kpaadb37
MD5

60252f94321e5e758441e73aab1faa41
SHA1

d3af223812c0a068514be5b8a9a7c8014541ece0
SHA256

5e9d5f16ba543b06cb9e2100c3cd720041d3aecb67b8c7c998d3e2033f2f4df7
SHA512

da25939a216b3bc46cb5d79ad5adeb7b22f30dc4d1bfd8523644c70e2e951b92d066e4b8f0e8cdf359a87129814cd9ed9df6eaa46669699497c286614e8199d7
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8L:Olg35GTslA5t3/w8L

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  5e9d5f16ba543b06cb9e2100c3cd720041d3aecb67b8c7c998d3e2033f2f4df7
- Size
  
  69KB
- MD5
  
  60252f94321e5e758441e73aab1faa41
- SHA1
  
  d3af223812c0a068514be5b8a9a7c8014541ece0
- SHA256
  
  5e9d5f16ba543b06cb9e2100c3cd720041d3aecb67b8c7c998d3e2033f2f4df7
- SHA512
  
  da25939a216b3bc46cb5d79ad5adeb7b22f30dc4d1bfd8523644c70e2e951b92d066e4b8f0e8cdf359a87129814cd9ed9df6eaa46669699497c286614e8199d7
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8L:Olg35GTslA5t3/w8L
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan