e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b

Analysis

max time kernel
201s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
Size 84KB
Sample221121-2xvnaaae68
SHA256 e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b
MD5 05220cd76d99c8a788ebc2ab3629704d
SHA1 cc68f677f6115e62092b87adf1b67b006ab8a17f
SHA512 cdc74816f7df23707e85cf8e5b80897794874c5e3cd20c0d7d10268a9d6569cad21ace3dc14a1992a79a97202cb1374e8b0815ebbdd896453fcc2736227d0e9e
SSDEEP 768:FL/PergAj31Mive10cuPoVbHaIkGahawzsCR0UWmKCmkfXSl6GXgGTfbvEE:FbPSpjlMbl9KGEawz/R05U7fe64bt
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2712	winlogin.exe
3468	winlogin.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E	winlogin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E\cfg = "{C4E8235E-FF57-47BA-9FF9-1A8352DEEC40}TARGGR }COXNLIOB "	winlogin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogin = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\winlogin.exe"	winlogin.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	api.ipify.org
40	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4912 set thread context of 4664	4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	82
PID 2712 set thread context of 3468	2712	winlogin.exe	91

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4788	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
2712	winlogin.exe
2712	winlogin.exe
2712	winlogin.exe
2712	winlogin.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
2712	winlogin.exe
2712	winlogin.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4664	4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	82
PID 4912 wrote to memory of 4664	4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	82
PID 4912 wrote to memory of 4664	4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	82
PID 4912 wrote to memory of 4664	4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	82
PID 4912 wrote to memory of 4664	4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	82
PID 4912 wrote to memory of 4664	4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	82
PID 4912 wrote to memory of 4664	4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	82
PID 4912 wrote to memory of 4664	4912	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	82
PID 4664 wrote to memory of 3724	4664	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	83
PID 4664 wrote to memory of 3724	4664	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	83
PID 4664 wrote to memory of 3724	4664	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	83
PID 4664 wrote to memory of 1836	4664	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	85
PID 4664 wrote to memory of 1836	4664	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	85
PID 4664 wrote to memory of 1836	4664	e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe	85
PID 1836 wrote to memory of 4788	1836	cmd.exe	87
PID 1836 wrote to memory of 4788	1836	cmd.exe	87
PID 1836 wrote to memory of 4788	1836	cmd.exe	87
PID 1836 wrote to memory of 2712	1836	cmd.exe	90
PID 1836 wrote to memory of 2712	1836	cmd.exe	90
PID 1836 wrote to memory of 2712	1836	cmd.exe	90
PID 2712 wrote to memory of 3468	2712	winlogin.exe	91
PID 2712 wrote to memory of 3468	2712	winlogin.exe	91
PID 2712 wrote to memory of 3468	2712	winlogin.exe	91
PID 2712 wrote to memory of 3468	2712	winlogin.exe	91
PID 2712 wrote to memory of 3468	2712	winlogin.exe	91
PID 2712 wrote to memory of 3468	2712	winlogin.exe	91
PID 2712 wrote to memory of 3468	2712	winlogin.exe	91
PID 2712 wrote to memory of 3468	2712	winlogin.exe	91

C:\Users\Admin\AppData\Local\Temp\e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
"C:\Users\Admin\AppData\Local\Temp\e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
  C:\Users\Admin\AppData\Local\Temp\e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /D /R type "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" > ___ && move /Y ___ "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"
    3⤵
    PID:3724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /D /R ping -n 10 localhost && del "C:\Users\Admin\AppData\Local\Temp\e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b.exe" && start /B "" "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" && exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:4788
  - - C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe
      "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe
        
        C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogin.exe

Path C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe
Size 84KB
SHA256 e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b
MD5 05220cd76d99c8a788ebc2ab3629704d
SHA1 cc68f677f6115e62092b87adf1b67b006ab8a17f
SHA512 cdc74816f7df23707e85cf8e5b80897794874c5e3cd20c0d7d10268a9d6569cad21ace3dc14a1992a79a97202cb1374e8b0815ebbdd896453fcc2736227d0e9e
SSDEEP 768:FL/PergAj31Mive10cuPoVbHaIkGahawzsCR0UWmKCmkfXSl6GXgGTfbvEE:FbPSpjlMbl9KGEawz/R05U7fe64bt
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogin.exe

Path C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe
Size 84KB
SHA256 e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b
MD5 05220cd76d99c8a788ebc2ab3629704d
SHA1 cc68f677f6115e62092b87adf1b67b006ab8a17f
SHA512 cdc74816f7df23707e85cf8e5b80897794874c5e3cd20c0d7d10268a9d6569cad21ace3dc14a1992a79a97202cb1374e8b0815ebbdd896453fcc2736227d0e9e
SSDEEP 768:FL/PergAj31Mive10cuPoVbHaIkGahawzsCR0UWmKCmkfXSl6GXgGTfbvEE:FbPSpjlMbl9KGEawz/R05U7fe64bt
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogin.exe

Path C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe
Size 84KB
SHA256 e46ca6126627653d6da815f335b8f6dfd4ac8f21d45e1c932047de049513891b
MD5 05220cd76d99c8a788ebc2ab3629704d
SHA1 cc68f677f6115e62092b87adf1b67b006ab8a17f
SHA512 cdc74816f7df23707e85cf8e5b80897794874c5e3cd20c0d7d10268a9d6569cad21ace3dc14a1992a79a97202cb1374e8b0815ebbdd896453fcc2736227d0e9e
SSDEEP 768:FL/PergAj31Mive10cuPoVbHaIkGahawzsCR0UWmKCmkfXSl6GXgGTfbvEE:FbPSpjlMbl9KGEawz/R05U7fe64bt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3468-151-0x0000000070000000-0x0000000070005000-memory.dmp

Download

memory/3468-152-0x0000000070000000-0x0000000070005000-memory.dmp

Download

memory/4664-137-0x0000000070000000-0x0000000070005000-memory.dmp

Download

memory/4664-140-0x0000000070000000-0x0000000070005000-memory.dmp

Download

memory/4664-136-0x0000000070000000-0x0000000070005000-memory.dmp

Download

memory/4664-142-0x0000000070000000-0x0000000070005000-memory.dmp

Download

memory/4664-133-0x0000000070000000-0x0000000070005000-memory.dmp

Download

memory/4912-134-0x0000000003970000-0x0000000003974000-memory.dmp

Download