f9c3fb8c4254097f61059eac3c5bd35a4658fc4ced350d249dcdffa478cb1cb2 | Triage

Sharing

General

Target

f9c3fb8c4254097f61059eac3c5bd35a4658fc4ced350d249dcdffa478cb1cb2.exe
Size

70KB
Sample

240522-xkd3jsch25
MD5

7db5185aa216e08c6cf0addd0074756a
SHA1

37a52cb309fb2962d13c8d28aeafb49bc4d165b8
SHA256

f9c3fb8c4254097f61059eac3c5bd35a4658fc4ced350d249dcdffa478cb1cb2
SHA512

d400553a2af9c3f80cc4cfcd5729f7b3b6b3a8366fe1a0cbb7fa4e1da58bf9c67c4688835585ca54a038ac8b0981b0f738dade2c0ce8ca57e90bf383b57ab6b8
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl6r:Olg35GTslA5t3/w87r

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  f9c3fb8c4254097f61059eac3c5bd35a4658fc4ced350d249dcdffa478cb1cb2.exe
- Size
  
  70KB
- MD5
  
  7db5185aa216e08c6cf0addd0074756a
- SHA1
  
  37a52cb309fb2962d13c8d28aeafb49bc4d165b8
- SHA256
  
  f9c3fb8c4254097f61059eac3c5bd35a4658fc4ced350d249dcdffa478cb1cb2
- SHA512
  
  d400553a2af9c3f80cc4cfcd5729f7b3b6b3a8366fe1a0cbb7fa4e1da58bf9c67c4688835585ca54a038ac8b0981b0f738dade2c0ce8ca57e90bf383b57ab6b8
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl6r:Olg35GTslA5t3/w87r
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan