89d40e3c95e83c8309f4c8d19f9924327755145eaf66258f47aee1cae161b9ba | Triage

Sharing

Copy URL Twitter E-mail

General

Target

640e761c206365408f9553ccc5c196dc.exe
Size

68KB
Sample

240517-rttlpsca53
MD5

640e761c206365408f9553ccc5c196dc
SHA1

f1d65de5a1137edf9c571e50c46df993eac70db4
SHA256

89d40e3c95e83c8309f4c8d19f9924327755145eaf66258f47aee1cae161b9ba
SHA512

cf3e279ec2ab58109f75022d99ffd78e0db26b22a2116155858186b6316dbc92ee1a3bb73bf10a2e3702ca50f545d6282b36505f54f17618d1dfd150232a4671
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Q:Olg35GTslA5t3/w8Q

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  640e761c206365408f9553ccc5c196dc.exe
- Size
  
  68KB
- MD5
  
  640e761c206365408f9553ccc5c196dc
- SHA1
  
  f1d65de5a1137edf9c571e50c46df993eac70db4
- SHA256
  
  89d40e3c95e83c8309f4c8d19f9924327755145eaf66258f47aee1cae161b9ba
- SHA512
  
  cf3e279ec2ab58109f75022d99ffd78e0db26b22a2116155858186b6316dbc92ee1a3bb73bf10a2e3702ca50f545d6282b36505f54f17618d1dfd150232a4671
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Q:Olg35GTslA5t3/w8Q
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan