General
- Target mei44uuabaj9ctvf.bin
- Size 502KB
- Sample260511-rxt2mscv7y
- SHA256 6f1225c6fc8dc975a884724e917f0e6e88fbe9e3b8764a17882a1187e584fcb1
Score
10/10
Malware Config
Targets
-
- Target mei44uuabaj9ctvf.bin
- Size 502KB
- SHA256 6f1225c6fc8dc975a884724e917f0e6e88fbe9e3b8764a17882a1187e584fcb1
Score10/10Modifies WinLogon for persistence
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
Executes dropped EXE
Loads dropped DLL
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1