Overview

overview

10

Static

static

3

0ca4811582...98.exe

windows7-x64

10

0ca4811582...98.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0ca4811582d906eca1b15785a17072df9851834495a61b966377f36bd493be98

  • Size

    23KB

  • Sample

    240309-zk3r1shh63

  • MD5

    5e08afa3028531a64054b9c61811719c

  • SHA1

    5973c34c07dba3b764cbd859dce9bef59d796fe8

  • SHA256

    0ca4811582d906eca1b15785a17072df9851834495a61b966377f36bd493be98

  • SHA512

    4f1f35e561a99334b5f675e6c9b30548df5cdd43f1eb6df78e77a90777cf277129d5a9a0ec34c4450c3aee21594a57c16b801c61000e3e41d6de113a71bb1bb8

  • SSDEEP

    384:jIz4SkysDMEAsy/9z6xcU2uTTgJwSK5YBV26Bcjze+wW5ton0yBRyDFUuM:jIU9rDHSR6Wl2gZKizyzeS5t6r4BtM

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      0ca4811582d906eca1b15785a17072df9851834495a61b966377f36bd493be98

    • Size

      23KB

    • MD5

      5e08afa3028531a64054b9c61811719c

    • SHA1

      5973c34c07dba3b764cbd859dce9bef59d796fe8

    • SHA256

      0ca4811582d906eca1b15785a17072df9851834495a61b966377f36bd493be98

    • SHA512

      4f1f35e561a99334b5f675e6c9b30548df5cdd43f1eb6df78e77a90777cf277129d5a9a0ec34c4450c3aee21594a57c16b801c61000e3e41d6de113a71bb1bb8

    • SSDEEP

      384:jIz4SkysDMEAsy/9z6xcU2uTTgJwSK5YBV26Bcjze+wW5ton0yBRyDFUuM:jIU9rDHSR6Wl2gZKizyzeS5t6r4BtM

    Score
    10/10
    evasionpersistencetrojanupx

    • Windows security bypass

      evasiontrojan

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks