44b039afa21fa6d339a145bd60f6ec65c184aca252eb2fa090416f7b49f26ad1 | Triage

Sharing

General

Target

13bcb5d19a84b13be545ad64faa5fc10_NEAS
Size

71KB
Sample

240507-krbjsahb6v
MD5

13bcb5d19a84b13be545ad64faa5fc10
SHA1

ad8dad4694f3992ab1e84ea920d3e50ee50ccbc2
SHA256

44b039afa21fa6d339a145bd60f6ec65c184aca252eb2fa090416f7b49f26ad1
SHA512

3b249bcdbbde8ea1abaf8e7245288fe9352b642a066c5c8bd43fd28c462e45141e407298e6a010694076dedb7b97874af70f35488b19515c54cc138a1e64273b
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slh:Olg35GTslA5t3/w8K

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  13bcb5d19a84b13be545ad64faa5fc10_NEAS
- Size
  
  71KB
- MD5
  
  13bcb5d19a84b13be545ad64faa5fc10
- SHA1
  
  ad8dad4694f3992ab1e84ea920d3e50ee50ccbc2
- SHA256
  
  44b039afa21fa6d339a145bd60f6ec65c184aca252eb2fa090416f7b49f26ad1
- SHA512
  
  3b249bcdbbde8ea1abaf8e7245288fe9352b642a066c5c8bd43fd28c462e45141e407298e6a010694076dedb7b97874af70f35488b19515c54cc138a1e64273b
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slh:Olg35GTslA5t3/w8K
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan