56240bd530a2aa41e8933fb27f4f262efc27afd3bd3a11e2c777a0897e6d2340 | Triage

Sharing

General

Target

4041cdabb4bc763485c902c30636f690_NEAS
Size

70KB
Sample

240507-a8nwbsdh72
MD5

4041cdabb4bc763485c902c30636f690
SHA1

e42b97a4eb737b3c1ca575605a2c85002962680f
SHA256

56240bd530a2aa41e8933fb27f4f262efc27afd3bd3a11e2c777a0897e6d2340
SHA512

0dd743568cf6d372c4369a5a0e69c47f53e714ffa587a27f9ccc97e8b34e0147ec2eb71799a7b3f53e08a79f9d847c03df17397d30fb11734172469c9d155f6d
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sla:Olg35GTslA5t3/w8P

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  4041cdabb4bc763485c902c30636f690_NEAS
- Size
  
  70KB
- MD5
  
  4041cdabb4bc763485c902c30636f690
- SHA1
  
  e42b97a4eb737b3c1ca575605a2c85002962680f
- SHA256
  
  56240bd530a2aa41e8933fb27f4f262efc27afd3bd3a11e2c777a0897e6d2340
- SHA512
  
  0dd743568cf6d372c4369a5a0e69c47f53e714ffa587a27f9ccc97e8b34e0147ec2eb71799a7b3f53e08a79f9d847c03df17397d30fb11734172469c9d155f6d
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sla:Olg35GTslA5t3/w8P
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan