1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973

General

Target
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
Size 72KB
Sample200816-wanx7z71ss
SHA256 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973
MD5 052ccfcaf3c8f4008d8cdd8c473c879c
SHA1 87d7f7484426a11b75b56e5057df507593cead93
SHA512 d989bbb902658873cdaae07271235f6801010960aac9be6237096274ef38b9a34d374e6534c57e5fc94837857c92f689cf05df397ee43fb50e3fdb9fb63cc398
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\host32.exe,"	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3676 set thread context of 3840	3676	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe	67

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\host32.exe	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
File opened for modification	C:\Windows\host32.exe	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3840	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
3840	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
3840	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
3840	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3840	3676	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe	67
PID 3676 wrote to memory of 3840	3676	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe	67
PID 3676 wrote to memory of 3840	3676	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe	67
PID 3676 wrote to memory of 3840	3676	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe	67
PID 3676 wrote to memory of 3840	3676	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe	67
PID 3676 wrote to memory of 3840	3676	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe	67
PID 3676 wrote to memory of 3840	3676	1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe	67

C:\Users\Admin\AppData\Local\Temp\1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
"C:\Users\Admin\AppData\Local\Temp\1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
  "C:\Users\Admin\AppData\Local\Temp\1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3840-0-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3840-2-0x0000000000400000-0x0000000000416000-memory.dmp