a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b

General

Target

a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
Size

105KB
MD5

e181b0d9994f856d1baeb04db7474a4c
SHA1

afd4ded500179268141d2dffb51b26c8f02c9f9f
SHA256

a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b
SHA512

274ae3513b5dc958748229b41e18f56cf9e081725b807f8366a45993300b12eda51ef57e1b20428f8a7316b99b9502882d5cbe2b001eddcf6c1a080e719e6917
SSDEEP

3072:eYQP3z/bvx/rm24FmIr0C8Z8qEcj3Jq+ianM1Hgye+sJC:NmW08q7j3Jqh42HgybsE

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

pid process

3416 a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

pid	process
3416	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\profslo = "rundll32 \"C:\\Users\\Admin\\AppData\\Local\\profslo.dll\",profslo"	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\profslo\Impersonate = "1"	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\profslo\Asynchronous = "1"	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\profslo\MaxWait = "1"	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\profslo\sekivmde = 369785d8db5c1662b6b9	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\profslo\DllName = "C:\\Users\\Admin\\AppData\\Local\\profslo.dll"	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\profslo\Startup = "profslo"	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\profslo	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

description	pid	process	target process
PID 1884 set thread context of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

pid	process
1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

description	pid	process	target process
PID 1884 wrote to memory of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
PID 1884 wrote to memory of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
PID 1884 wrote to memory of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
PID 1884 wrote to memory of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
PID 1884 wrote to memory of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
PID 1884 wrote to memory of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
PID 1884 wrote to memory of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
PID 1884 wrote to memory of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
PID 1884 wrote to memory of 3416	1884	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe	a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe

C:\Users\Admin\AppData\Local\Temp\a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
"C:\Users\Admin\AppData\Local\Temp\a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884

C:\Users\Admin\AppData\Local\Temp\a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
C:\Users\Admin\AppData\Local\Temp\a6ae5732f76c1617346603ee00d04db16183318120e6ed2410efd4d36806995b.exe
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
PID:3416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\profslo.dll

Filesize
14KB

MD5
d01b51ab4cd3edf3c2264be8890ef1fa

SHA1
5238c736eb305eaf2bc19d801cf5bc80fc5c8615

SHA256
93be9757ef0287e70f904c8ebcd9745906594c5732b89f3233b632db032549a5

SHA512
ec0be8be36fad8d2ced0554565627a6e28b0af4c5c5e0b1e49dfa225b773d54130c84794608bb93c84555bf0598edfa1bf27774c432713efb3f03ace9244e769

Download Submit
memory/1884-134-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/3416-132-0x0000000000000000-mapping.dmp

Download
memory/3416-133-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3416-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3416-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3416-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads