c382d2d33c7036ac95058ef7ab3305b3234394428c28786d8c35f4a049047653

General

Target

winlog.exe
Size

441KB
MD5

206fa6f9e31c508d79a4677d679730f2
SHA1

222ddef076c12e0a141c1f4dbf0190a9bab5b811
SHA256

c382d2d33c7036ac95058ef7ab3305b3234394428c28786d8c35f4a049047653
SHA512

b067802014dad290db64d00f2a900b57789c71b78755dd73a855a081625488640d1390b319f9d3e19f09a2ca0cb252e19e61c33a384f482ad567e0a6a5251e37

Score

7^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

cmd.exemsdt.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	584	cmd.exe
Token: SeDebugPrivilege	2664	msdt.exe
Token: SeShutdownPrivilege	3008	Explorer.EXE
Token: SeCreatePagefilePrivilege	3008	Explorer.EXE
Token: SeShutdownPrivilege	3008	Explorer.EXE
Token: SeCreatePagefilePrivilege	3008	Explorer.EXE
Token: SeShutdownPrivilege	3008	Explorer.EXE
Token: SeCreatePagefilePrivilege	3008	Explorer.EXE

Suspicious use of SetThreadContext 2 IoCs

Processes:

cmd.exemsdt.exe

description	pid	process	target process
PID 584 set thread context of 3008	584	cmd.exe	Explorer.EXE
PID 2664 set thread context of 3008	2664	msdt.exe	Explorer.EXE

Suspicious use of WriteProcessMemory 88 IoCs

Processes:

winlog.exerundll32.exe

description	pid	process	target process
PID 3540 wrote to memory of 3180	3540	winlog.exe	rundll32.exe
PID 3540 wrote to memory of 3180	3540	winlog.exe	rundll32.exe
PID 3540 wrote to memory of 3180	3540	winlog.exe	rundll32.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe
PID 3180 wrote to memory of 584	3180	rundll32.exe	cmd.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3180 rundll32.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

Processes:

rundll32.execmd.exemsdt.exe

pid	process
3180	rundll32.exe
584	cmd.exe
584	cmd.exe
584	cmd.exe
584	cmd.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe
2664	msdt.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

rundll32.execmd.exemsdt.exe

pid process

3180 rundll32.exe
584 cmd.exe
584 cmd.exe
584 cmd.exe
2664 msdt.exe
2664 msdt.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Users\Admin\AppData\Local\Temp\winlog.exe
"C:\Users\Admin\AppData\Local\Temp\winlog.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe Subclimax,Epimers
3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3180

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:584

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2664

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\SysWOW64\cmd.exe"
3⤵
PID:2812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Archery

Download Submit
C:\Users\Admin\AppData\Local\Temp\Subclimax.DLL

Download Submit
\Users\Admin\AppData\Local\Temp\Subclimax.dll

Download Submit
memory/584-4-0x0000000000000000-mapping.dmp

Download
memory/2664-5-0x0000000000000000-mapping.dmp

Download
memory/2664-6-0x0000000000380000-0x00000000004F3000-memory.dmp

Filesize
1.4MB

Download
memory/2664-7-0x0000000000380000-0x00000000004F3000-memory.dmp

Filesize
1.4MB

Download
memory/2812-8-0x0000000000000000-mapping.dmp

Download
memory/3180-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads