1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883

General

Target

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
Size

169KB
MD5

9b1cbb32f79c298a470528afc224b96f
SHA1

3b4f9f2e1aa296e0c43d7a947a343e206daacf1a
SHA256

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883
SHA512

b74f92125c457d743efab7f4248f5778ace3ecd364481a186d3710c0d4ff1cf7953623095fce2b127db050839ed71ab3bf41ab0343fbde24a08dd099531b0bc7
SSDEEP

3072:7ofKHb2VlN9MzltqZLu/VmJIQNVyztshXOiffa/qQXU:7ofmbENoc2s5yi+qa//E

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe,"	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

Drops file in System32 directory 2 IoCs

Processes:

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
File created	C:\Windows\SysWOW64\ntos.exe	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

pid	process
1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

description pid process

Token: SeDebugPrivilege 1716 1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

description	pid	process
Token: SeDebugPrivilege	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

description	pid	process	target process
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe
PID 1716 wrote to memory of 568	1716	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe	winlogon.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
"C:\Users\Admin\AppData\Local\Temp\1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-182-0x000000003C920000-0x000000003C944000-memory.dmp

Filesize
144KB

Download
memory/568-217-0x000000003CA70000-0x000000003CA94000-memory.dmp

Filesize
144KB

Download
memory/568-142-0x000000003C7A0000-0x000000003C7C4000-memory.dmp

Filesize
144KB

Download
memory/568-147-0x000000003C7D0000-0x000000003C7F4000-memory.dmp

Filesize
144KB

Download
memory/568-152-0x000000003C800000-0x000000003C824000-memory.dmp

Filesize
144KB

Download
memory/568-157-0x000000003C830000-0x000000003C854000-memory.dmp

Filesize
144KB

Download
memory/568-162-0x000000003C860000-0x000000003C884000-memory.dmp

Filesize
144KB

Download
memory/568-172-0x000000003C8C0000-0x000000003C8E4000-memory.dmp

Filesize
144KB

Download
memory/568-227-0x000000003CAD0000-0x000000003CAF4000-memory.dmp

Filesize
144KB

Download
memory/568-137-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/568-167-0x000000003C890000-0x000000003C8B4000-memory.dmp

Filesize
144KB

Download
memory/568-187-0x000000003C950000-0x000000003C974000-memory.dmp

Filesize
144KB

Download
memory/568-192-0x000000003C980000-0x000000003C9A4000-memory.dmp

Filesize
144KB

Download
memory/568-197-0x000000003C9B0000-0x000000003C9D4000-memory.dmp

Filesize
144KB

Download
memory/568-202-0x000000003C9E0000-0x000000003CA04000-memory.dmp

Filesize
144KB

Download
memory/568-207-0x000000003CA10000-0x000000003CA34000-memory.dmp

Filesize
144KB

Download
memory/568-212-0x000000003CA40000-0x000000003CA64000-memory.dmp

Filesize
144KB

Download
memory/568-177-0x000000003C8F0000-0x000000003C914000-memory.dmp

Filesize
144KB

Download
memory/568-222-0x000000003CAA0000-0x000000003CAC4000-memory.dmp

Filesize
144KB

Download
memory/1716-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads