171c213f489a9dd54b5fc5091087066b53b84fb2f8be9d62061c9eb2ba884e95 | Triage

Sharing

General

Target

171c213f489a9dd54b5fc5091087066b53b84fb2f8be9d62061c9eb2ba884e95
Size

70KB
Sample

240522-xpe6each6v
MD5

3a5c8e20a6605099b772ed85343f5be6
SHA1

4d47584ed91f7149f96fb5341c6e230cefed9161
SHA256

171c213f489a9dd54b5fc5091087066b53b84fb2f8be9d62061c9eb2ba884e95
SHA512

e9c005dad6243ed72066ce7660250b5b3cd079d78e9f394aa626131f5f27e12bc946cc2317628b0d9e809d8e23d7bb0947924f14e12942ae45945c0f9a87fe42
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8r:Olg35GTslA5t3/w8r

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  171c213f489a9dd54b5fc5091087066b53b84fb2f8be9d62061c9eb2ba884e95
- Size
  
  70KB
- MD5
  
  3a5c8e20a6605099b772ed85343f5be6
- SHA1
  
  4d47584ed91f7149f96fb5341c6e230cefed9161
- SHA256
  
  171c213f489a9dd54b5fc5091087066b53b84fb2f8be9d62061c9eb2ba884e95
- SHA512
  
  e9c005dad6243ed72066ce7660250b5b3cd079d78e9f394aa626131f5f27e12bc946cc2317628b0d9e809d8e23d7bb0947924f14e12942ae45945c0f9a87fe42
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8r:Olg35GTslA5t3/w8r
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan