Analysis
-
max time kernel
149s -
max time network
59s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 12:12
Static task
static1
Behavioral task
behavioral1
Sample
winlog.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
winlog.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
winlog.exe
-
Size
441KB
-
MD5
206fa6f9e31c508d79a4677d679730f2
-
SHA1
222ddef076c12e0a141c1f4dbf0190a9bab5b811
-
SHA256
c382d2d33c7036ac95058ef7ab3305b3234394428c28786d8c35f4a049047653
-
SHA512
b067802014dad290db64d00f2a900b57789c71b78755dd73a855a081625488640d1390b319f9d3e19f09a2ca0cb252e19e61c33a384f482ad567e0a6a5251e37
Score
7/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
cmd.exemsdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 584 cmd.exe Token: SeDebugPrivilege 2664 msdt.exe Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cmd.exemsdt.exedescription pid process target process PID 584 set thread context of 3008 584 cmd.exe Explorer.EXE PID 2664 set thread context of 3008 2664 msdt.exe Explorer.EXE -
Suspicious use of WriteProcessMemory 88 IoCs
Processes:
winlog.exerundll32.exedescription pid process target process PID 3540 wrote to memory of 3180 3540 winlog.exe rundll32.exe PID 3540 wrote to memory of 3180 3540 winlog.exe rundll32.exe PID 3540 wrote to memory of 3180 3540 winlog.exe rundll32.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe PID 3180 wrote to memory of 584 3180 rundll32.exe cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3180 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
rundll32.execmd.exemsdt.exepid process 3180 rundll32.exe 584 cmd.exe 584 cmd.exe 584 cmd.exe 584 cmd.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe 2664 msdt.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
rundll32.execmd.exemsdt.exepid process 3180 rundll32.exe 584 cmd.exe 584 cmd.exe 584 cmd.exe 2664 msdt.exe 2664 msdt.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"C:\Users\Admin\AppData\Local\Temp\winlog.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Subclimax,Epimers3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Archery
-
C:\Users\Admin\AppData\Local\Temp\Subclimax.DLL
-
\Users\Admin\AppData\Local\Temp\Subclimax.dll
-
memory/584-4-0x0000000000000000-mapping.dmp
-
memory/2664-5-0x0000000000000000-mapping.dmp
-
memory/2664-6-0x0000000000380000-0x00000000004F3000-memory.dmpFilesize
1.4MB
-
memory/2664-7-0x0000000000380000-0x00000000004F3000-memory.dmpFilesize
1.4MB
-
memory/2812-8-0x0000000000000000-mapping.dmp
-
memory/3180-0-0x0000000000000000-mapping.dmp