Analysis
- max time kernel
144s - max time network
153s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:25
General
- Target dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe
- Size 355KB
- Sample201109-xbj2krd3f2
- SHA256 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Modifies WinLogon 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 149 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe"C:\Users\Admin\AppData\Local\Temp\dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1236-4-0x0000000002310000-0x0000000002321000-memory.dmp
memory/1236-5-0x0000000002310000-0x0000000002321000-memory.dmp
memory/1236-7-0x00000000029F0000-0x0000000002A01000-memory.dmp
memory/1236-8-0x00000000029F0000-0x0000000002A01000-memory.dmp
memory/1236-10-0x00000000029F0000-0x0000000002A01000-memory.dmp
memory/1236-11-0x0000000002BF0000-0x0000000002C01000-memory.dmp
memory/1236-12-0x0000000002BF0000-0x0000000002C01000-memory.dmp
memory/1236-80-0x0000000002BF0000-0x0000000002C01000-memory.dmp
memory/1236-96-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-106-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-107-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-108-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-110-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-111-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-112-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-113-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-114-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-115-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-117-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-119-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/1236-120-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-167-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-174-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-175-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-180-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-188-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-194-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-198-0x00000000071D0000-0x00000000071E1000-memory.dmp
memory/1236-202-0x00000000071D0000-0x00000000071E1000-memory.dmp
memory/1236-204-0x00000000071D0000-0x00000000071E1000-memory.dmp
memory/1236-205-0x00000000071D0000-0x00000000071E1000-memory.dmp
memory/1236-206-0x00000000071D0000-0x00000000071E1000-memory.dmp
memory/1236-215-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-258-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-269-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-283-0x0000000008A90000-0x0000000008AA1000-memory.dmp
memory/1236-284-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/1236-285-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/1236-287-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/1236-297-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-352-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-354-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-366-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/1236-367-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/1236-368-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/1236-380-0x0000000006E10000-0x0000000006E21000-memory.dmp
memory/1236-381-0x0000000006E10000-0x0000000006E21000-memory.dmp
memory/1236-382-0x0000000006E10000-0x0000000006E21000-memory.dmp
memory/1236-383-0x0000000006E10000-0x0000000006E21000-memory.dmp
memory/1236-384-0x0000000006E10000-0x0000000006E21000-memory.dmp
memory/1236-386-0x0000000006E10000-0x0000000006E21000-memory.dmp
memory/1236-393-0x0000000006E10000-0x0000000006E21000-memory.dmp
memory/1236-394-0x0000000003100000-0x0000000003111000-memory.dmp
memory/1236-398-0x0000000002E00000-0x0000000002E11000-memory.dmp
memory/1236-443-0x0000000002E00000-0x0000000002E11000-memory.dmp
memory/1236-449-0x0000000002E00000-0x0000000002E11000-memory.dmp
memory/1236-463-0x0000000005380000-0x0000000005391000-memory.dmp
memory/1236-464-0x0000000005380000-0x0000000005391000-memory.dmp
memory/1236-465-0x0000000005380000-0x0000000005391000-memory.dmp
memory/1236-467-0x0000000005380000-0x0000000005391000-memory.dmp
memory/1236-477-0x0000000002E00000-0x0000000002E11000-memory.dmp
memory/1236-487-0x0000000002E00000-0x0000000002E11000-memory.dmp
memory/1236-490-0x0000000002E00000-0x0000000002E11000-memory.dmp
memory/1236-519-0x0000000002F00000-0x0000000002F11000-memory.dmp
memory/1236-532-0x0000000002F00000-0x0000000002F11000-memory.dmp
memory/1236-545-0x00000000086D0000-0x00000000086E1000-memory.dmp
memory/1236-546-0x0000000008210000-0x0000000008221000-memory.dmp
memory/1236-547-0x0000000008210000-0x0000000008221000-memory.dmp
memory/1236-548-0x0000000008210000-0x0000000008221000-memory.dmp
memory/1236-550-0x0000000008210000-0x0000000008221000-memory.dmp
memory/1236-559-0x0000000002F00000-0x0000000002F11000-memory.dmp
memory/1236-609-0x0000000002F00000-0x0000000002F11000-memory.dmp
memory/1236-623-0x0000000006A10000-0x0000000006A21000-memory.dmp
memory/1236-636-0x0000000006F50000-0x0000000006F61000-memory.dmp
memory/1236-646-0x0000000006F50000-0x0000000006F61000-memory.dmp
memory/1236-648-0x0000000006F50000-0x0000000006F61000-memory.dmp
memory/1236-649-0x0000000006F50000-0x0000000006F61000-memory.dmp
memory/1236-650-0x0000000003900000-0x0000000003911000-memory.dmp
memory/1236-679-0x0000000003900000-0x0000000003911000-memory.dmp
memory/1236-686-0x0000000003900000-0x0000000003911000-memory.dmp
memory/1236-700-0x0000000003900000-0x0000000003911000-memory.dmp
memory/1236-713-0x0000000002F00000-0x0000000002F11000-memory.dmp
memory/1236-714-0x0000000005EC0000-0x0000000005ED1000-memory.dmp
memory/1236-726-0x0000000002F00000-0x0000000002F11000-memory.dmp
memory/1236-777-0x0000000002F00000-0x0000000002F11000-memory.dmp
memory/1360-105-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp