d9b690870d515e39edb1274ca6aaf5badcf5c630a639c955603f8c013f0d459a | Triage

Sharing

General

Target

634a63cd27eeabb6fa39df1b6cb63780_NEAS
Size

72KB
Sample

240507-er876acc22
MD5

634a63cd27eeabb6fa39df1b6cb63780
SHA1

55c82bb181db6f2643d79061798ec9200b3e3588
SHA256

d9b690870d515e39edb1274ca6aaf5badcf5c630a639c955603f8c013f0d459a
SHA512

28eefd465fe797037067876da909bf9718cdffe3919d7b6266d2344770c969ac244b717228cc354c4e9d6f8590846e8e44af723986fa2b6584f3403acf3b2dbc
SSDEEP

1536:xr9S940hfcXdb8hnrBNf7IdWBeKzKLUHun+zmIGA/cC:W940hNVBIdWBjUDAf

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  634a63cd27eeabb6fa39df1b6cb63780_NEAS
- Size
  
  72KB
- MD5
  
  634a63cd27eeabb6fa39df1b6cb63780
- SHA1
  
  55c82bb181db6f2643d79061798ec9200b3e3588
- SHA256
  
  d9b690870d515e39edb1274ca6aaf5badcf5c630a639c955603f8c013f0d459a
- SHA512
  
  28eefd465fe797037067876da909bf9718cdffe3919d7b6266d2344770c969ac244b717228cc354c4e9d6f8590846e8e44af723986fa2b6584f3403acf3b2dbc
- SSDEEP
  
  1536:xr9S940hfcXdb8hnrBNf7IdWBeKzKLUHun+zmIGA/cC:W940hNVBIdWBjUDAf
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan