Analysis
- max time kernel
151s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
13/04/2022, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
2ceb0e965ee72e99fc787b2dc5b46da6.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2ceb0e965ee72e99fc787b2dc5b46da6.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 2ceb0e965ee72e99fc787b2dc5b46da6.exe
- Size 35KB
- Sample220413-b6y4ysdhb3
- SHA256 e80bff855228e7b8e810ac5d10e25f61861b946cb90b1d714cd56dbe599c8015
- MD5 2ceb0e965ee72e99fc787b2dc5b46da6
- SHA1 e45c186a609780ebaa510fcd297ebac9c204232e
- SHA512 2fe90690e0225b7ce373396c45c367c5a8b0401445b9e894a270179bed83ea3c1d0c016e811d02101f20ac8efa14296b722ab7b22fa54f07c142b7cdb0e3d441
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe," 2ceb0e965ee72e99fc787b2dc5b46da6.exe -
resource yara_rule behavioral2/memory/604-135-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx behavioral2/memory/604-136-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx behavioral2/memory/604-137-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx behavioral2/memory/604-138-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx behavioral2/memory/604-140-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx behavioral2/memory/604-141-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx behavioral2/memory/604-139-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx behavioral2/memory/604-142-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx behavioral2/memory/604-143-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx behavioral2/memory/604-144-0x0000000014D00000-0x0000000014D0B000-memory.dmp upx - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntos.exe 2ceb0e965ee72e99fc787b2dc5b46da6.exe File created C:\Windows\SysWOW64\ntos.exe 2ceb0e965ee72e99fc787b2dc5b46da6.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3 PID 2000 wrote to memory of 604 2000 2ceb0e965ee72e99fc787b2dc5b46da6.exe 3
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2ceb0e965ee72e99fc787b2dc5b46da6.exe"C:\Users\Admin\AppData\Local\Temp\2ceb0e965ee72e99fc787b2dc5b46da6.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000