f28be13e3bdf3c25916f7a6712465bc2405afb6b5931db2fc5f5d1316f7c5332

Analysis

max time kernel
169s
max time network
168s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f28be13e3bdf3c25916f7a6712465bc2405afb6b5931db2fc5f5d1316f7c5332.dll
Size

184KB
MD5

64c2681e0741e4a504862266d6dee021
SHA1

4c7af8e37bb21b47e92c3194d105420684295893
SHA256

f28be13e3bdf3c25916f7a6712465bc2405afb6b5931db2fc5f5d1316f7c5332
SHA512

1510dae97b5900ef6a1b5223649ca8ea2567b256b2cbcdf47c808401d83563c42ce2211147bb668c5433f7fc2537eb3faca0e698a5782690d9dd13705e2c7616
SSDEEP

3072:qvXmimD0k0QRW1PhI1sItKOgGdX3DUP+ooqApFtEU1aFjKGyfHaWlmgM89Wl:q+fD/0QSzItKOgGFYGooqKEQf6WzMh

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
948	rundll32mgr.exe
2024	WaterMark.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/948-62-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/948-64-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/948-63-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/948-65-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/948-71-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2024-86-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2024-88-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2024-199-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1880	rundll32.exe
1880	rundll32.exe
948	rundll32mgr.exe
948	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px789A.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2024	WaterMark.exe
2024	WaterMark.exe
2024	WaterMark.exe
2024	WaterMark.exe
2024	WaterMark.exe
2024	WaterMark.exe
2024	WaterMark.exe
2024	WaterMark.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	WaterMark.exe
Token: SeDebugPrivilege	1340	svchost.exe
Token: SeDebugPrivilege	2024	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
948	rundll32mgr.exe
2024	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1880	1680	rundll32.exe	28
PID 1680 wrote to memory of 1880	1680	rundll32.exe	28
PID 1680 wrote to memory of 1880	1680	rundll32.exe	28
PID 1680 wrote to memory of 1880	1680	rundll32.exe	28
PID 1680 wrote to memory of 1880	1680	rundll32.exe	28
PID 1680 wrote to memory of 1880	1680	rundll32.exe	28
PID 1680 wrote to memory of 1880	1680	rundll32.exe	28
PID 1880 wrote to memory of 948	1880	rundll32.exe	29
PID 1880 wrote to memory of 948	1880	rundll32.exe	29
PID 1880 wrote to memory of 948	1880	rundll32.exe	29
PID 1880 wrote to memory of 948	1880	rundll32.exe	29
PID 948 wrote to memory of 2024	948	rundll32mgr.exe	30
PID 948 wrote to memory of 2024	948	rundll32mgr.exe	30
PID 948 wrote to memory of 2024	948	rundll32mgr.exe	30
PID 948 wrote to memory of 2024	948	rundll32mgr.exe	30
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1976	2024	WaterMark.exe	31
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 2024 wrote to memory of 1340	2024	WaterMark.exe	32
PID 1340 wrote to memory of 260	1340	svchost.exe	7
PID 1340 wrote to memory of 260	1340	svchost.exe	7
PID 1340 wrote to memory of 260	1340	svchost.exe	7
PID 1340 wrote to memory of 260	1340	svchost.exe	7
PID 1340 wrote to memory of 260	1340	svchost.exe	7
PID 1340 wrote to memory of 336	1340	svchost.exe	6
PID 1340 wrote to memory of 336	1340	svchost.exe	6
PID 1340 wrote to memory of 336	1340	svchost.exe	6
PID 1340 wrote to memory of 336	1340	svchost.exe	6
PID 1340 wrote to memory of 336	1340	svchost.exe	6
PID 1340 wrote to memory of 372	1340	svchost.exe	5
PID 1340 wrote to memory of 372	1340	svchost.exe	5
PID 1340 wrote to memory of 372	1340	svchost.exe	5
PID 1340 wrote to memory of 372	1340	svchost.exe	5
PID 1340 wrote to memory of 372	1340	svchost.exe	5
PID 1340 wrote to memory of 384	1340	svchost.exe	4
PID 1340 wrote to memory of 384	1340	svchost.exe	4
PID 1340 wrote to memory of 384	1340	svchost.exe	4
PID 1340 wrote to memory of 384	1340	svchost.exe	4
PID 1340 wrote to memory of 384	1340	svchost.exe	4
PID 1340 wrote to memory of 420	1340	svchost.exe	3
PID 1340 wrote to memory of 420	1340	svchost.exe	3
PID 1340 wrote to memory of 420	1340	svchost.exe	3
PID 1340 wrote to memory of 420	1340	svchost.exe	3
PID 1340 wrote to memory of 420	1340	svchost.exe	3
PID 1340 wrote to memory of 464	1340	svchost.exe	2
PID 1340 wrote to memory of 464	1340	svchost.exe	2
PID 1340 wrote to memory of 464	1340	svchost.exe	2
PID 1340 wrote to memory of 464	1340	svchost.exe	2

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:844
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1760
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1744
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1216
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1044
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:456
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:292
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:592

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:492

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1952

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1804

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f28be13e3bdf3c25916f7a6712465bc2405afb6b5931db2fc5f5d1316f7c5332.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f28be13e3bdf3c25916f7a6712465bc2405afb6b5931db2fc5f5d1316f7c5332.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:948
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:1976
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1340

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
92KB

MD5
e6d2ce425ee7875c2b6006c7ca938f16

SHA1
b47bd42fbe8948ca5284e7d4d7d98464f5834d12

SHA256
69379c2c6b3da8617d2af7e2745f929dc1545297ff0b4d5e3e1c50643b091101

SHA512
bbac6540b44e5413b37e6dada09e78602a790178352fcd2b0a357272b16de0e594b89952ed7d725639edc44dad94d6cffd61c6c2e74d551afd3d30d874d364cb

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
92KB

MD5
e6d2ce425ee7875c2b6006c7ca938f16

SHA1
b47bd42fbe8948ca5284e7d4d7d98464f5834d12

SHA256
69379c2c6b3da8617d2af7e2745f929dc1545297ff0b4d5e3e1c50643b091101

SHA512
bbac6540b44e5413b37e6dada09e78602a790178352fcd2b0a357272b16de0e594b89952ed7d725639edc44dad94d6cffd61c6c2e74d551afd3d30d874d364cb

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
92KB

MD5
e6d2ce425ee7875c2b6006c7ca938f16

SHA1
b47bd42fbe8948ca5284e7d4d7d98464f5834d12

SHA256
69379c2c6b3da8617d2af7e2745f929dc1545297ff0b4d5e3e1c50643b091101

SHA512
bbac6540b44e5413b37e6dada09e78602a790178352fcd2b0a357272b16de0e594b89952ed7d725639edc44dad94d6cffd61c6c2e74d551afd3d30d874d364cb

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
92KB

MD5
e6d2ce425ee7875c2b6006c7ca938f16

SHA1
b47bd42fbe8948ca5284e7d4d7d98464f5834d12

SHA256
69379c2c6b3da8617d2af7e2745f929dc1545297ff0b4d5e3e1c50643b091101

SHA512
bbac6540b44e5413b37e6dada09e78602a790178352fcd2b0a357272b16de0e594b89952ed7d725639edc44dad94d6cffd61c6c2e74d551afd3d30d874d364cb

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
92KB

MD5
e6d2ce425ee7875c2b6006c7ca938f16

SHA1
b47bd42fbe8948ca5284e7d4d7d98464f5834d12

SHA256
69379c2c6b3da8617d2af7e2745f929dc1545297ff0b4d5e3e1c50643b091101

SHA512
bbac6540b44e5413b37e6dada09e78602a790178352fcd2b0a357272b16de0e594b89952ed7d725639edc44dad94d6cffd61c6c2e74d551afd3d30d874d364cb

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
92KB

MD5
e6d2ce425ee7875c2b6006c7ca938f16

SHA1
b47bd42fbe8948ca5284e7d4d7d98464f5834d12

SHA256
69379c2c6b3da8617d2af7e2745f929dc1545297ff0b4d5e3e1c50643b091101

SHA512
bbac6540b44e5413b37e6dada09e78602a790178352fcd2b0a357272b16de0e594b89952ed7d725639edc44dad94d6cffd61c6c2e74d551afd3d30d874d364cb

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
92KB

MD5
e6d2ce425ee7875c2b6006c7ca938f16

SHA1
b47bd42fbe8948ca5284e7d4d7d98464f5834d12

SHA256
69379c2c6b3da8617d2af7e2745f929dc1545297ff0b4d5e3e1c50643b091101

SHA512
bbac6540b44e5413b37e6dada09e78602a790178352fcd2b0a357272b16de0e594b89952ed7d725639edc44dad94d6cffd61c6c2e74d551afd3d30d874d364cb

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
92KB

MD5
e6d2ce425ee7875c2b6006c7ca938f16

SHA1
b47bd42fbe8948ca5284e7d4d7d98464f5834d12

SHA256
69379c2c6b3da8617d2af7e2745f929dc1545297ff0b4d5e3e1c50643b091101

SHA512
bbac6540b44e5413b37e6dada09e78602a790178352fcd2b0a357272b16de0e594b89952ed7d725639edc44dad94d6cffd61c6c2e74d551afd3d30d874d364cb

Download Submit
memory/948-71-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/948-63-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/948-65-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/948-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/948-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1340-93-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1340-90-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1880-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1976-87-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1976-82-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1976-78-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1976-200-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2024-86-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2024-88-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2024-199-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download