Overview

overview

10

Static

static

3

53c5e8dd4a...17.exe

windows7-x64

10

53c5e8dd4a...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53c5e8dd4a49773f95c6b60d4dd7e0ef9f066be6a3146f961c59e16b59c60217.exe

  • Size

    24KB

  • Sample

    240522-23r5cace46

  • MD5

    021feaa6171ab07bc0ed1e098382c800

  • SHA1

    bd7bdf1b497f0e5bba520f3898c2fdc3edcec1f5

  • SHA256

    53c5e8dd4a49773f95c6b60d4dd7e0ef9f066be6a3146f961c59e16b59c60217

  • SHA512

    be1afee36378daee17ba2681d5dbb7a279c6a9e06486d6175479d0e91b68a9796780fcbf8e4a1e3c1589b10c8ca8b5228638baae6142903ad8b1912912c987e2

  • SSDEEP

    768:jIUWqeC/juNK4QPv71sL83w/0nIqM0ejXIt:jxKNK4271syw/g

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      53c5e8dd4a49773f95c6b60d4dd7e0ef9f066be6a3146f961c59e16b59c60217.exe

    • Size

      24KB

    • MD5

      021feaa6171ab07bc0ed1e098382c800

    • SHA1

      bd7bdf1b497f0e5bba520f3898c2fdc3edcec1f5

    • SHA256

      53c5e8dd4a49773f95c6b60d4dd7e0ef9f066be6a3146f961c59e16b59c60217

    • SHA512

      be1afee36378daee17ba2681d5dbb7a279c6a9e06486d6175479d0e91b68a9796780fcbf8e4a1e3c1589b10c8ca8b5228638baae6142903ad8b1912912c987e2

    • SSDEEP

      768:jIUWqeC/juNK4QPv71sL83w/0nIqM0ejXIt:jxKNK4271syw/g

    Score
    10/10
    evasionpersistencetrojanupx

    • Windows security bypass

      evasiontrojan

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks