Overview

overview

10

Static

static

10

e142a1e51c...cf.exe

windows7-x64

e142a1e51c...cf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e142a1e51ce0e8d28fd852683b65688dcc97a6b705e8adc799d5af0bdefefecf.bin

  • Size

    216KB

  • Sample

    250125-xyqnhaymgp

  • MD5

    118962ea993c489f14c068235b1a8397

  • SHA1

    0f6e1c3388f65c6f483b15e6a35b8acdf0a93de6

  • SHA256

    e142a1e51ce0e8d28fd852683b65688dcc97a6b705e8adc799d5af0bdefefecf

  • SHA512

    8ebc8268f53f87698a2685ccc8d6233043f9f405abbe0dcba039c19f7862f37fbcced43a674dbccc97cadec44b0e10e0aa2dd06dd726751b81177762f642435b

  • SSDEEP

    3072:GtSqS6SbEjAr+Y1/5G6yC2Yb6CyH6wap4EWHUW1:GtRmbEjAr+K/5mC2dH6wpL

Score
10/10
ramnitbankerdefense_evasiondiscoverypersistencespywarestealertrojanworm

Malware Config

Targets

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

4
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

3
T1562.001

Modify Registry

9
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks