Analysis
- max time kernel
150s - max time network
152s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:25
General
- Target 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe
- Size 355KB
- Sample201109-sa5e59z2va
- SHA256 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Modifies WinLogon 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 285 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe"C:\Users\Admin\AppData\Local\Temp\68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1056-1-0x0000000000320000-0x0000000000321000-memory.dmp
memory/1228-7-0x0000000002450000-0x0000000002461000-memory.dmp
memory/1228-6-0x0000000002450000-0x0000000002461000-memory.dmp
memory/1228-9-0x0000000002920000-0x0000000002931000-memory.dmp
memory/1228-10-0x0000000002920000-0x0000000002931000-memory.dmp
memory/1228-12-0x0000000002CF0000-0x0000000002D01000-memory.dmp
memory/1228-13-0x0000000002CF0000-0x0000000002D01000-memory.dmp
memory/1228-14-0x0000000008120000-0x0000000008131000-memory.dmp
memory/1228-16-0x0000000006690000-0x00000000066A1000-memory.dmp
memory/1228-18-0x0000000007310000-0x0000000007321000-memory.dmp
memory/1228-20-0x0000000007310000-0x0000000007321000-memory.dmp
memory/1228-21-0x0000000006DD0000-0x0000000006DE1000-memory.dmp
memory/1228-22-0x0000000006DD0000-0x0000000006DE1000-memory.dmp
memory/1228-23-0x0000000006DD0000-0x0000000006DE1000-memory.dmp
memory/1228-24-0x0000000006DD0000-0x0000000006DE1000-memory.dmp
memory/1228-25-0x0000000006DD0000-0x0000000006DE1000-memory.dmp
memory/1228-26-0x0000000006DD0000-0x0000000006DE1000-memory.dmp
memory/1228-27-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-73-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-91-0x0000000008320000-0x0000000008331000-memory.dmp
memory/1228-92-0x0000000008120000-0x0000000008131000-memory.dmp
memory/1228-93-0x0000000008120000-0x0000000008131000-memory.dmp
memory/1228-95-0x0000000008120000-0x0000000008131000-memory.dmp
memory/1228-97-0x0000000008120000-0x0000000008131000-memory.dmp
memory/1228-98-0x0000000008120000-0x0000000008131000-memory.dmp
memory/1228-104-0x0000000003010000-0x0000000003021000-memory.dmp
memory/1228-105-0x0000000008EE0000-0x0000000008EF1000-memory.dmp
memory/1228-106-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-108-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-117-0x0000000003010000-0x0000000003021000-memory.dmp
memory/1228-122-0x0000000003010000-0x0000000003021000-memory.dmp
memory/1228-124-0x0000000003010000-0x0000000003021000-memory.dmp
memory/1228-125-0x0000000003010000-0x0000000003021000-memory.dmp
memory/1228-137-0x0000000008DA0000-0x0000000008DB1000-memory.dmp
memory/1228-138-0x0000000008320000-0x0000000008331000-memory.dmp
memory/1228-139-0x0000000008320000-0x0000000008331000-memory.dmp
memory/1228-142-0x0000000008320000-0x0000000008331000-memory.dmp
memory/1228-144-0x0000000008320000-0x0000000008331000-memory.dmp
memory/1228-145-0x0000000008320000-0x0000000008331000-memory.dmp
memory/1228-146-0x0000000008320000-0x0000000008331000-memory.dmp
memory/1228-150-0x0000000007960000-0x0000000007971000-memory.dmp
memory/1228-151-0x0000000007960000-0x0000000007971000-memory.dmp
memory/1228-153-0x0000000007960000-0x0000000007971000-memory.dmp
memory/1228-157-0x0000000007960000-0x0000000007971000-memory.dmp
memory/1228-162-0x0000000007960000-0x0000000007971000-memory.dmp
memory/1228-163-0x0000000007820000-0x0000000007831000-memory.dmp
memory/1228-171-0x0000000007820000-0x0000000007831000-memory.dmp
memory/1228-172-0x0000000007820000-0x0000000007831000-memory.dmp
memory/1228-173-0x0000000007820000-0x0000000007831000-memory.dmp
memory/1228-176-0x0000000008B20000-0x0000000008B31000-memory.dmp
memory/1228-177-0x0000000007820000-0x0000000007831000-memory.dmp
memory/1228-189-0x00000000075A0000-0x00000000075B1000-memory.dmp
memory/1228-203-0x0000000008320000-0x0000000008331000-memory.dmp
memory/1228-215-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-216-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-267-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-279-0x0000000008620000-0x0000000008631000-memory.dmp
memory/1228-292-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-293-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-295-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-296-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-305-0x0000000006BE0000-0x0000000006BF1000-memory.dmp
memory/1228-306-0x0000000006BE0000-0x0000000006BF1000-memory.dmp
memory/1228-313-0x0000000006BE0000-0x0000000006BF1000-memory.dmp
memory/1228-318-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-321-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-356-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-362-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-364-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-369-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-381-0x0000000006A50000-0x0000000006A61000-memory.dmp
memory/1228-382-0x0000000006A50000-0x0000000006A61000-memory.dmp
memory/1228-395-0x0000000007450000-0x0000000007461000-memory.dmp
memory/1228-407-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-408-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-447-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-449-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-459-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-471-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-472-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-473-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-474-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-476-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-477-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-478-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-484-0x0000000004ED0000-0x0000000004EE1000-memory.dmp
memory/1228-485-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-535-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-548-0x0000000008220000-0x0000000008231000-memory.dmp
memory/1228-549-0x0000000008220000-0x0000000008231000-memory.dmp
memory/1228-561-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-580-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-612-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-624-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-625-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-688-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-705-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1228-709-0x0000000006F50000-0x0000000006F61000-memory.dmp
memory/1228-710-0x0000000006F50000-0x0000000006F61000-memory.dmp
memory/1228-716-0x0000000006F50000-0x0000000006F61000-memory.dmp
memory/1228-721-0x0000000008360000-0x0000000008371000-memory.dmp
memory/1228-722-0x0000000008120000-0x0000000008131000-memory.dmp
memory/1228-735-0x0000000002F10000-0x0000000002F21000-memory.dmp
memory/1784-15-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmp