Overview

overview

10

Static

static

7

59b7c3a6c5...97.exe

windows7-x64

10

59b7c3a6c5...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    59b7c3a6c5b6541b34b127a5d894d458216f12d8bc9f40fc35a38c40e7706e97

  • Size

    19KB

  • Sample

    240613-269tkaybql

  • MD5

    718935aa1a1852a4036a6e5e712a1740

  • SHA1

    701153a5ea273b0ed39ed22ec697d770a6c20c9a

  • SHA256

    59b7c3a6c5b6541b34b127a5d894d458216f12d8bc9f40fc35a38c40e7706e97

  • SHA512

    4cd8fe993dd98f91b6c1d417644952b3a8f421804ce163110615bb801b532ae454e52c4c010f1bab52687539c74e52efdec6a8f0ef678480288f31dfd251d75f

  • SSDEEP

    384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvXm0x7:rRkiLw3HsDSARGG/2U7

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      59b7c3a6c5b6541b34b127a5d894d458216f12d8bc9f40fc35a38c40e7706e97

    • Size

      19KB

    • MD5

      718935aa1a1852a4036a6e5e712a1740

    • SHA1

      701153a5ea273b0ed39ed22ec697d770a6c20c9a

    • SHA256

      59b7c3a6c5b6541b34b127a5d894d458216f12d8bc9f40fc35a38c40e7706e97

    • SHA512

      4cd8fe993dd98f91b6c1d417644952b3a8f421804ce163110615bb801b532ae454e52c4c010f1bab52687539c74e52efdec6a8f0ef678480288f31dfd251d75f

    • SSDEEP

      384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvXm0x7:rRkiLw3HsDSARGG/2U7

    Score
    10/10
    evasionpersistencetrojanupx

    • Windows security bypass

      evasiontrojan

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks