22d3f8a803dda70c24a5a97a5186409c129d5dbc6433080d9d15aa011230e7d0 | Triage

Sharing

General

Target

22d3f8a803dda70c24a5a97a5186409c129d5dbc6433080d9d15aa011230e7d0
Size

72KB
Sample

240513-x7ktlsbf86
MD5

8ee9f65e8263d9ac1fba34ce1a6bf461
SHA1

3850e8eb4f6f9820efe048dc3cc0ea8d13e4344d
SHA256

22d3f8a803dda70c24a5a97a5186409c129d5dbc6433080d9d15aa011230e7d0
SHA512

89150486935d2e068be4dc61096ff4cfc1e6e5fe73e5987c239d3a59b21a13e37753355f6daaba75843e293caded6523211b44aed034e6e95db2071f089a86e2
SSDEEP

1536:xPhWNc6tJBsHnsim25qCp7nwHyxTQrQRLIT8:xKR4sf25qCp7wHyxEcl

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  22d3f8a803dda70c24a5a97a5186409c129d5dbc6433080d9d15aa011230e7d0
- Size
  
  72KB
- MD5
  
  8ee9f65e8263d9ac1fba34ce1a6bf461
- SHA1
  
  3850e8eb4f6f9820efe048dc3cc0ea8d13e4344d
- SHA256
  
  22d3f8a803dda70c24a5a97a5186409c129d5dbc6433080d9d15aa011230e7d0
- SHA512
  
  89150486935d2e068be4dc61096ff4cfc1e6e5fe73e5987c239d3a59b21a13e37753355f6daaba75843e293caded6523211b44aed034e6e95db2071f089a86e2
- SSDEEP
  
  1536:xPhWNc6tJBsHnsim25qCp7nwHyxTQrQRLIT8:xKR4sf25qCp7wHyxEcl
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan