2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118

General

Target

2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe
Size

205KB
MD5

5606221828ac5cf18128132f9c24c312
SHA1

e13a6c52a29337fe209bec43360cca9ef32288d8
SHA256

2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118
SHA512

b612ec04672cc2edf247958b6a032f7d43b0ec020696c4ebc3f92ab856413aee46c5a48a68d02ba28a44d834b9d340e0499c1f91fd4603056974fcf478955670
SSDEEP

3072:7ofKHb2VlNTmV4/ORoRkU9wLZWbzsPH90t7lye7/ASWYBncS:7ofmbENTma/OlLZWbTEqncS

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe,"	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

Drops file in System32 directory 2 IoCs

Processes:

2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe
File created	C:\Windows\SysWOW64\ntos.exe	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

pid	process
2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe
2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe
2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe
2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

description pid process

Token: SeDebugPrivilege 2760 2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

description	pid	process
Token: SeDebugPrivilege	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe

description	pid	process	target process
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe
PID 2760 wrote to memory of 604	2760	2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe	winlogon.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604

C:\Users\Admin\AppData\Local\Temp\2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe
"C:\Users\Admin\AppData\Local\Temp\2950cbee6c343e8640e1c0cfc4ea6dcec773f36ee365a19e4758aa4beed05118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-178-0x0000000031250000-0x0000000031274000-memory.dmp

Filesize
144KB

Download
memory/604-148-0x0000000031130000-0x0000000031154000-memory.dmp

Filesize
144KB

Download
memory/604-228-0x0000000031430000-0x0000000031454000-memory.dmp

Filesize
144KB

Download
memory/604-188-0x00000000312B0000-0x00000000312D4000-memory.dmp

Filesize
144KB

Download
memory/604-183-0x0000000031280000-0x00000000312A4000-memory.dmp

Filesize
144KB

Download
memory/604-153-0x0000000031160000-0x0000000031184000-memory.dmp

Filesize
144KB

Download
memory/604-158-0x0000000031190000-0x00000000311B4000-memory.dmp

Filesize
144KB

Download
memory/604-163-0x00000000311C0000-0x00000000311E4000-memory.dmp

Filesize
144KB

Download
memory/604-168-0x00000000311F0000-0x0000000031214000-memory.dmp

Filesize
144KB

Download
memory/604-173-0x0000000031220000-0x0000000031244000-memory.dmp

Filesize
144KB

Download
memory/604-138-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/604-223-0x0000000031400000-0x0000000031424000-memory.dmp

Filesize
144KB

Download
memory/604-143-0x0000000031100000-0x0000000031124000-memory.dmp

Filesize
144KB

Download
memory/604-193-0x00000000312E0000-0x0000000031304000-memory.dmp

Filesize
144KB

Download
memory/604-198-0x0000000031310000-0x0000000031334000-memory.dmp

Filesize
144KB

Download
memory/604-203-0x0000000031340000-0x0000000031364000-memory.dmp

Filesize
144KB

Download
memory/604-208-0x0000000031370000-0x0000000031394000-memory.dmp

Filesize
144KB

Download
memory/604-213-0x00000000313A0000-0x00000000313C4000-memory.dmp

Filesize
144KB

Download
memory/604-218-0x00000000313D0000-0x00000000313F4000-memory.dmp

Filesize
144KB

Download
memory/2760-133-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2760-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads