01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83

General

Target

01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
Size

105KB
MD5

61ca1e73dc8a40a28082dd4e0748aa30
SHA1

6c7985571c63b2ea940fb573bb7fa03f2d8899ec
SHA256

01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83
SHA512

c4274413d1074e962e5b13a56ac0ee6d83b4970f6981a44f876e821990dbd262b433106abf0847c5c4c66c1f941888f403482656ffa74f80dd13f8ea0f7f7e49
SSDEEP

1536:wXrgGCCavYFVdlCcb0n7w1vS5hQ94XxHnnIGOyfqBw:fVCo8tC80n35hWUKWv

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1812-58-0x0000000000400000-0x0000000001400000-memory.dmp	upx
behavioral1/memory/1812-61-0x0000000000400000-0x0000000001400000-memory.dmp	upx
behavioral1/memory/1812-62-0x0000000000400000-0x0000000001400000-memory.dmp	upx
behavioral1/memory/1812-64-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
behavioral1/memory/1812-67-0x0000000000400000-0x0000000001400000-memory.dmp	upx
behavioral1/memory/1812-68-0x0000000000400000-0x0000000001400000-memory.dmp	upx
behavioral1/memory/1812-69-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
behavioral1/memory/1812-72-0x0000000000400000-0x00000000004DC000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1812	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\adfizkw = "rundll32 \"C:\\Users\\Admin\\AppData\\Local\\adfizkw.dll\",adfizkw"	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adfizkw\Startup = "adfizkw"	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adfizkw	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adfizkw\Impersonate = "1"	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adfizkw\Asynchronous = "1"	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adfizkw\MaxWait = "1"	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adfizkw\amkaidiw = 0af6d73f28d85fff51b0	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adfizkw\DllName = "C:\\Users\\Admin\\AppData\\Local\\adfizkw.dll"	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 364 set thread context of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26
PID 364 wrote to memory of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26
PID 364 wrote to memory of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26
PID 364 wrote to memory of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26
PID 364 wrote to memory of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26
PID 364 wrote to memory of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26
PID 364 wrote to memory of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26
PID 364 wrote to memory of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26
PID 364 wrote to memory of 1812	364	01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe	26

C:\Users\Admin\AppData\Local\Temp\01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
"C:\Users\Admin\AppData\Local\Temp\01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe
  "C:\Users\Admin\AppData\Local\Temp\01334de44bc0aa2f350429626606799ba9d23b04e69cbc84075bb3c2c249ba83.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies WinLogon
  PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\adfizkw.dll

Filesize
399KB

MD5
7c0a04097c671b54cefd2bb63ac7e479

SHA1
6d0d4cc5c677671666d94b64c2adc8776845e600

SHA256
b9302505e2455a9cd5200f5becfa04f8d26896aa2f1644427eb1b62f10dc57be

SHA512
fa368c30b9c46b6dc5e7ca6cb0dcfdca335cbb838636a925d62f2a9370ed5e8838a56ab7f5e3d18561c474840699ae2d2593475484194122305000c15a8c789b

Download Submit
memory/364-60-0x0000000000360000-0x0000000000364000-memory.dmp

Filesize
16KB

Download
memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1812-62-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1812-58-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1812-61-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1812-57-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1812-64-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/1812-67-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1812-68-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1812-69-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/1812-71-0x00000000360E0000-0x0000000036153000-memory.dmp

Filesize
460KB

Download
memory/1812-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1812-72-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads