928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3

General

Target

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
Size

253KB
MD5

60e0f60835d02027536ec7428ba4e1f1
SHA1

1e32a9c911cbfb039774e62d9280be0a8c67b8cf
SHA256

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3
SHA512

29ea1b8656d3d8ec4931f80ed82cbaf976497b436c0c759bffedfa3c0a281196a84b8dd0b654cb0d4c8224cdf2f9c84c05ff7d4525cd421977b06740576b1398
SSDEEP

6144:7ofmbENRmu5AVce2UJJbJFZvkO1zjxBtdMl8erwhFfmT:YFdScSHkO1rtd4rwhVmT

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe,"	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

Drops file in System32 directory 2 IoCs

Processes:

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
File created	C:\Windows\SysWOW64\ntos.exe	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

pid	process
2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

description pid process

Token: SeDebugPrivilege 2252 928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

description	pid	process
Token: SeDebugPrivilege	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

description	pid	process	target process
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe
PID 2252 wrote to memory of 600	2252	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe	winlogon.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:600

C:\Users\Admin\AppData\Local\Temp\928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
"C:\Users\Admin\AppData\Local\Temp\928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/600-182-0x00000000355B0000-0x00000000355D4000-memory.dmp

Filesize
144KB

Download
memory/600-217-0x0000000035700000-0x0000000035724000-memory.dmp

Filesize
144KB

Download
memory/600-142-0x0000000035430000-0x0000000035454000-memory.dmp

Filesize
144KB

Download
memory/600-147-0x0000000035460000-0x0000000035484000-memory.dmp

Filesize
144KB

Download
memory/600-152-0x0000000035490000-0x00000000354B4000-memory.dmp

Filesize
144KB

Download
memory/600-157-0x00000000354C0000-0x00000000354E4000-memory.dmp

Filesize
144KB

Download
memory/600-162-0x00000000354F0000-0x0000000035514000-memory.dmp

Filesize
144KB

Download
memory/600-172-0x0000000035550000-0x0000000035574000-memory.dmp

Filesize
144KB

Download
memory/600-227-0x0000000035760000-0x0000000035784000-memory.dmp

Filesize
144KB

Download
memory/600-137-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/600-167-0x0000000035520000-0x0000000035544000-memory.dmp

Filesize
144KB

Download
memory/600-187-0x00000000355E0000-0x0000000035604000-memory.dmp

Filesize
144KB

Download
memory/600-192-0x0000000035610000-0x0000000035634000-memory.dmp

Filesize
144KB

Download
memory/600-197-0x0000000035640000-0x0000000035664000-memory.dmp

Filesize
144KB

Download
memory/600-202-0x0000000035670000-0x0000000035694000-memory.dmp

Filesize
144KB

Download
memory/600-207-0x00000000356A0000-0x00000000356C4000-memory.dmp

Filesize
144KB

Download
memory/600-212-0x00000000356D0000-0x00000000356F4000-memory.dmp

Filesize
144KB

Download
memory/600-177-0x0000000035580000-0x00000000355A4000-memory.dmp

Filesize
144KB

Download
memory/600-222-0x0000000035730000-0x0000000035754000-memory.dmp

Filesize
144KB

Download
memory/2252-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads