5b56c52e1fd2505f4958e7750efa310cf8c2737498d0edc59c644204df69d405 | Triage

Sharing

General

Target

5b56c52e1fd2505f4958e7750efa310cf8c2737498d0edc59c644204df69d405
Size

70KB
Sample

240522-1x27paaf57
MD5

0d6190f8707d75ca54b9474eac58e47c
SHA1

30e65e56de225aa1504dda75dc542409fcf4ad43
SHA256

5b56c52e1fd2505f4958e7750efa310cf8c2737498d0edc59c644204df69d405
SHA512

a60d71e43fb06f66a7b7f3fc69bcea25902cbd37c34f49a3c1df04c00dd678bc6f9a3419d70595d7bb06fc890887f7bda8948897c82d2b12a1a2ebaab19b8c8e
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8T:Olg35GTslA5t3/w8T

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  5b56c52e1fd2505f4958e7750efa310cf8c2737498d0edc59c644204df69d405
- Size
  
  70KB
- MD5
  
  0d6190f8707d75ca54b9474eac58e47c
- SHA1
  
  30e65e56de225aa1504dda75dc542409fcf4ad43
- SHA256
  
  5b56c52e1fd2505f4958e7750efa310cf8c2737498d0edc59c644204df69d405
- SHA512
  
  a60d71e43fb06f66a7b7f3fc69bcea25902cbd37c34f49a3c1df04c00dd678bc6f9a3419d70595d7bb06fc890887f7bda8948897c82d2b12a1a2ebaab19b8c8e
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8T:Olg35GTslA5t3/w8T
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan