911bdc14e5d50f8a704b04dcb73c967ccd5f5a87512684cff29132093a47cfe2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

911bdc14e5d50f8a704b04dcb73c967ccd5f5a87512684cff29132093a47cfe2
Size

73KB
Sample

241018-a6s29sweng
MD5

0664fb68600acee2f1ad68343d10ca87
SHA1

c5347d7a5f1632c5decbfd82c540f84b2b08d9b5
SHA256

911bdc14e5d50f8a704b04dcb73c967ccd5f5a87512684cff29132093a47cfe2
SHA512

f7224e2f8fe3f99402f5d5f025f42e59341aa5c981e81faa920b43569dfc8c69a4231e1ae70fc9585dbe8eb71e3b4c7338034f523e580c0b14379d8cf6fa3834
SSDEEP

1536:x+Yh85gHOEutUKZKEHfmWqk0AEPGER3ZaE/:fh3HOEuaWKE+/RA87Rn

Score

10^/10

defense_evasion discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  911bdc14e5d50f8a704b04dcb73c967ccd5f5a87512684cff29132093a47cfe2
- Size
  
  73KB
- MD5
  
  0664fb68600acee2f1ad68343d10ca87
- SHA1
  
  c5347d7a5f1632c5decbfd82c540f84b2b08d9b5
- SHA256
  
  911bdc14e5d50f8a704b04dcb73c967ccd5f5a87512684cff29132093a47cfe2
- SHA512
  
  f7224e2f8fe3f99402f5d5f025f42e59341aa5c981e81faa920b43569dfc8c69a4231e1ae70fc9585dbe8eb71e3b4c7338034f523e580c0b14379d8cf6fa3834
- SSDEEP
  
  1536:x+Yh85gHOEutUKZKEHfmWqk0AEPGER3ZaE/:fh3HOEuaWKE+/RA87Rn
Score

10^/10

defense_evasion discovery evasion persistence trojan
- Windows security bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Impair Defenses

Disable or Modify Tools

Indicator Removal

Clear Persistence

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistencetrojan

behavioral2

defense_evasiondiscoveryevasionpersistencetrojan