b784b835393b11ff736ba1c3126a22b368db543c2d8e80a1e852b5c808858b98 | Triage

Sharing

General

Target

b784b835393b11ff736ba1c3126a22b368db543c2d8e80a1e852b5c808858b98
Size

71KB
Sample

240522-gphcrsec75
MD5

de30c2330891018ec1a2d0061fffcd82
SHA1

8e0507513240b2c3b5688d39942678c00e13f60f
SHA256

b784b835393b11ff736ba1c3126a22b368db543c2d8e80a1e852b5c808858b98
SHA512

44ae379369f571cdcf30ddb5206de5ea063fd6029049d8f2a0cb6bbcac68ce615283a3f42f22b1fbaf518883834a13546331b9a8d37f8ea21f0fb9e50ea51e5c
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slab:Olg35GTslA5t3/w8J

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  b784b835393b11ff736ba1c3126a22b368db543c2d8e80a1e852b5c808858b98
- Size
  
  71KB
- MD5
  
  de30c2330891018ec1a2d0061fffcd82
- SHA1
  
  8e0507513240b2c3b5688d39942678c00e13f60f
- SHA256
  
  b784b835393b11ff736ba1c3126a22b368db543c2d8e80a1e852b5c808858b98
- SHA512
  
  44ae379369f571cdcf30ddb5206de5ea063fd6029049d8f2a0cb6bbcac68ce615283a3f42f22b1fbaf518883834a13546331b9a8d37f8ea21f0fb9e50ea51e5c
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slab:Olg35GTslA5t3/w8J
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan