d20287b9d598bb83703b775a73481a7ad2b9586af57c87145788a414dd14c9c4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d20287b9d598bb83703b775a73481a7ad2b9586af57c87145788a414dd14c9c4
Size

67KB
Sample

240429-c31n2sff99
MD5

123d64b2315cc988eba5c3a683b50bf5
SHA1

16d53966b2cd6f8ea6ed9e15a8ca2dcf12938b78
SHA256

d20287b9d598bb83703b775a73481a7ad2b9586af57c87145788a414dd14c9c4
SHA512

adc077cb65c0d5ee2a98081e75ed05d05870b4b67d734e2f7da7edf6cf588f33abeac25af9d3b531252de418489bdc8fc4efc2dadda9c33713eebfc3ae5c8448
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+awff:ulg35GTslA5t3Gawff

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  d20287b9d598bb83703b775a73481a7ad2b9586af57c87145788a414dd14c9c4
- Size
  
  67KB
- MD5
  
  123d64b2315cc988eba5c3a683b50bf5
- SHA1
  
  16d53966b2cd6f8ea6ed9e15a8ca2dcf12938b78
- SHA256
  
  d20287b9d598bb83703b775a73481a7ad2b9586af57c87145788a414dd14c9c4
- SHA512
  
  adc077cb65c0d5ee2a98081e75ed05d05870b4b67d734e2f7da7edf6cf588f33abeac25af9d3b531252de418489bdc8fc4efc2dadda9c33713eebfc3ae5c8448
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+awff:ulg35GTslA5t3Gawff
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan