44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9

General

Target

44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
Size

332KB
MD5

0968b9d36f5894707b646d050a4fcb03
SHA1

de7b46f525cd4b2b97e391b7ed98a5a65be2ec5a
SHA256

44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9
SHA512

22bd986fc8721b3e2c04d6d08261f69402e2ec61d931e731d1a624e70155549a2e6b33eda8a0d6c83862abb58023f9b37939f3bb7eed09a86472d2c33b0baaf8
SSDEEP

6144:xaNJmnQo41QAOMwEIzUjQiZZvEYqWnKZ+pnVa2:x234BEIYjQWvrq1snk2

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe\""	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe\""	winlogon.exe

Executes dropped EXE 1 IoCs

pid	Process
1260	winlogon.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1984	netsh.exe

Deletes itself 1 IoCs

pid	Process
1260	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe\""	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe\""	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
1260	winlogon.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1984	1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe	29
PID 1368 wrote to memory of 1984	1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe	29
PID 1368 wrote to memory of 1984	1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe	29
PID 1368 wrote to memory of 1984	1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe	29
PID 1368 wrote to memory of 1260	1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe	31
PID 1368 wrote to memory of 1260	1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe	31
PID 1368 wrote to memory of 1260	1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe	31
PID 1368 wrote to memory of 1260	1368	44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe	31

C:\Users\Admin\AppData\Local\Temp\44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
"C:\Users\Admin\AppData\Local\Temp\44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\winlogon.exe" CityScape Enable
  2⤵
  - Modifies Windows Firewall
  PID:1984
- C:\Users\Admin\AppData\Roaming\winlogon.exe
  /d C:\Users\Admin\AppData\Local\Temp\44b5097bf6359e58edb3d5101ec6d8988ad9fca6f0dd45915e65034ae4f5b6b9.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Deletes itself
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:1260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winlogon.exe

Filesize
332KB

MD5
53f511ed929bb85fb81b528942d45e94

SHA1
b750681fb622d3adee9e021a2dc5bb7527aaff3b

SHA256
1395496e82e36e35bdab716a3984d1031e0ce8589391ca65101d6b423501e7cd

SHA512
f66cfe4330d914cf4d54cc53b5a7a0b600bfe34c155a66935734c060f7a936b61820ecdc58b9e1ede730b233f31a7d9cef6975a283f1ec134ad9fae1a01e2371

Download Submit
C:\Users\Admin\AppData\Roaming\winlogon.exe

Filesize
332KB

MD5
53f511ed929bb85fb81b528942d45e94

SHA1
b750681fb622d3adee9e021a2dc5bb7527aaff3b

SHA256
1395496e82e36e35bdab716a3984d1031e0ce8589391ca65101d6b423501e7cd

SHA512
f66cfe4330d914cf4d54cc53b5a7a0b600bfe34c155a66935734c060f7a936b61820ecdc58b9e1ede730b233f31a7d9cef6975a283f1ec134ad9fae1a01e2371

Download Submit
\Users\Admin\AppData\Roaming\winlogon.exe

Filesize
332KB

MD5
53f511ed929bb85fb81b528942d45e94

SHA1
b750681fb622d3adee9e021a2dc5bb7527aaff3b

SHA256
1395496e82e36e35bdab716a3984d1031e0ce8589391ca65101d6b423501e7cd

SHA512
f66cfe4330d914cf4d54cc53b5a7a0b600bfe34c155a66935734c060f7a936b61820ecdc58b9e1ede730b233f31a7d9cef6975a283f1ec134ad9fae1a01e2371

Download Submit
\Users\Admin\AppData\Roaming\winlogon.exe

Filesize
332KB

MD5
53f511ed929bb85fb81b528942d45e94

SHA1
b750681fb622d3adee9e021a2dc5bb7527aaff3b

SHA256
1395496e82e36e35bdab716a3984d1031e0ce8589391ca65101d6b423501e7cd

SHA512
f66cfe4330d914cf4d54cc53b5a7a0b600bfe34c155a66935734c060f7a936b61820ecdc58b9e1ede730b233f31a7d9cef6975a283f1ec134ad9fae1a01e2371

Download Submit
memory/1260-66-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1260-65-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1368-62-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1368-54-0x0000000000460000-0x00000000004B5000-memory.dmp

Filesize
340KB

Download
memory/1368-56-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1368-55-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1984-64-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads