c4409ef9b01dfbdc636543aa7ae9593b4a9a746b8a93aa89869a9579bd3be3b6 | Triage

Sharing

General

Target

6babcd8c912825f47991428299662b90N.exe
Size

68KB
Sample

240821-e4s2pstekl
MD5

6babcd8c912825f47991428299662b90
SHA1

a3c0183e6b2fa73e75302a33f2f38cb265b77916
SHA256

c4409ef9b01dfbdc636543aa7ae9593b4a9a746b8a93aa89869a9579bd3be3b6
SHA512

819d98b1cc4db9dd3af847df792c0a90025fdafb0a956e04deb5b7f076180d227b86d803bb2e9e1a1cff409f424dd5a2c992f884b5d7dfc3eea6f7c7eb04b90c
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8N:Olg35GTslA5t3/w8N

Score

10^/10

defense_evasion discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  6babcd8c912825f47991428299662b90N.exe
- Size
  
  68KB
- MD5
  
  6babcd8c912825f47991428299662b90
- SHA1
  
  a3c0183e6b2fa73e75302a33f2f38cb265b77916
- SHA256
  
  c4409ef9b01dfbdc636543aa7ae9593b4a9a746b8a93aa89869a9579bd3be3b6
- SHA512
  
  819d98b1cc4db9dd3af847df792c0a90025fdafb0a956e04deb5b7f076180d227b86d803bb2e9e1a1cff409f424dd5a2c992f884b5d7dfc3eea6f7c7eb04b90c
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8N:Olg35GTslA5t3/w8N
Score

10^/10

defense_evasion discovery evasion persistence trojan
- Windows security bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Impair Defenses

Disable or Modify Tools

Indicator Removal

Clear Persistence

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistencetrojan

behavioral2

defense_evasiondiscoveryevasionpersistencetrojan