6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af

General

Target

6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
Size

634KB
MD5

7b82bae2fe9386bfb5c49243400df954
SHA1

f484ebedd8e68097bdcfe11373c958280e70d28b
SHA256

6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af
SHA512

75e7fc908a5ab75192508819d455f4a70514d25edab6b571d9c9104f90c02f58eb09db6850186d13db12eb8fc7271886cae48297739777291a36b948298e16a5

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Z426sPaOxdzsYJQ6\\tdlrc6ydfvAL.exe\",explorer.exe"	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
Token: SeDebugPrivilege	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1716	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	27
PID 564 wrote to memory of 1716	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	27
PID 564 wrote to memory of 1716	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	27
PID 564 wrote to memory of 1716	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	27
PID 564 wrote to memory of 1504	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	28
PID 564 wrote to memory of 1504	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	28
PID 564 wrote to memory of 1504	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	28
PID 564 wrote to memory of 1504	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	28
PID 564 wrote to memory of 268	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	29
PID 564 wrote to memory of 268	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	29
PID 564 wrote to memory of 268	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	29
PID 564 wrote to memory of 268	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	29
PID 564 wrote to memory of 1876	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	32
PID 564 wrote to memory of 1876	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	32
PID 564 wrote to memory of 1876	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	32
PID 564 wrote to memory of 1876	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	32
PID 564 wrote to memory of 1692	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	30
PID 564 wrote to memory of 1692	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	30
PID 564 wrote to memory of 1692	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	30
PID 564 wrote to memory of 1692	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	30
PID 564 wrote to memory of 1776	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	31
PID 564 wrote to memory of 1776	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	31
PID 564 wrote to memory of 1776	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	31
PID 564 wrote to memory of 1776	564	6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe	31

C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
"C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564
- C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
  "C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe"
  2⤵
  PID:1716
- C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
  "C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe"
  2⤵
  PID:1504
- C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
  "C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe"
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
  "C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe"
  2⤵
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
  "C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe"
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe
  "C:\Users\Admin\AppData\Local\Temp\6dfaf59e3589a3b89789410c647f32ac899342e2b1314cb171357af07e1fb5af.exe"
  2⤵
  PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/564-55-0x0000000074450000-0x00000000749FB000-memory.dmp

Filesize
5.7MB

Download
memory/564-56-0x0000000074450000-0x00000000749FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing