Analysis
-
max time kernel
85s -
max time network
88s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:49
Static task
static1
Behavioral task
behavioral1
Sample
99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe
Resource
win10v2004-20220812-en
General
-
Target
99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe
-
Size
114KB
-
MD5
96c35c7c7400091b667a05e866ffaaa2
-
SHA1
0b1162c6f335230aed6d9ba7d53b966715c5b2d1
-
SHA256
99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d
-
SHA512
9d38f9be19a82578bb90669ade4b7dd9e3c999f8f9beb055ffcb6db2da0da1d619be677ab17a0d1b2c83a63c2b502b5f4ef87af0468891c21d9e4069899f0396
-
SSDEEP
1536:hEXXNdOiJcGd+9p70W7hG7K8ftvGpnezu33O0anXhQDD82Fm77777772PKJDYC+c:OqGd+XD7yK3+QvXFm7777777/D1gJ1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
winlogin.exepid process 1648 winlogin.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E winlogin.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E\cfg = "{1BB0413F-DD71-462C-AEB2-65C5C45D677A}SERV }RYNKSFQE " winlogin.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1388 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1388 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run winlogin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogin = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\winlogin.exe" winlogin.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org 6 api.ipify.org -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.execmd.exedescription pid process target process PID 1468 wrote to memory of 1688 1468 99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe cmd.exe PID 1468 wrote to memory of 1688 1468 99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe cmd.exe PID 1468 wrote to memory of 1688 1468 99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe cmd.exe PID 1468 wrote to memory of 1688 1468 99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe cmd.exe PID 1468 wrote to memory of 1388 1468 99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe cmd.exe PID 1468 wrote to memory of 1388 1468 99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe cmd.exe PID 1468 wrote to memory of 1388 1468 99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe cmd.exe PID 1468 wrote to memory of 1388 1468 99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe cmd.exe PID 1388 wrote to memory of 584 1388 cmd.exe PING.EXE PID 1388 wrote to memory of 584 1388 cmd.exe PING.EXE PID 1388 wrote to memory of 584 1388 cmd.exe PING.EXE PID 1388 wrote to memory of 584 1388 cmd.exe PING.EXE PID 1388 wrote to memory of 1648 1388 cmd.exe winlogin.exe PID 1388 wrote to memory of 1648 1388 cmd.exe winlogin.exe PID 1388 wrote to memory of 1648 1388 cmd.exe winlogin.exe PID 1388 wrote to memory of 1648 1388 cmd.exe winlogin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe"C:\Users\Admin\AppData\Local\Temp\99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /D /R type "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" > ___ && move /Y ___ "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /D /R ping -n 10 localhost && del "C:\Users\Admin\AppData\Local\Temp\99f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d.exe" && start /B "" "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" && exit2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
114KB
MD596c35c7c7400091b667a05e866ffaaa2
SHA10b1162c6f335230aed6d9ba7d53b966715c5b2d1
SHA25699f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d
SHA5129d38f9be19a82578bb90669ade4b7dd9e3c999f8f9beb055ffcb6db2da0da1d619be677ab17a0d1b2c83a63c2b502b5f4ef87af0468891c21d9e4069899f0396
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
114KB
MD596c35c7c7400091b667a05e866ffaaa2
SHA10b1162c6f335230aed6d9ba7d53b966715c5b2d1
SHA25699f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d
SHA5129d38f9be19a82578bb90669ade4b7dd9e3c999f8f9beb055ffcb6db2da0da1d619be677ab17a0d1b2c83a63c2b502b5f4ef87af0468891c21d9e4069899f0396
-
\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
114KB
MD596c35c7c7400091b667a05e866ffaaa2
SHA10b1162c6f335230aed6d9ba7d53b966715c5b2d1
SHA25699f0539fa46d95a1e59e3a21fc5f8b8c4eded28af12153129ed8aaa88c6aa37d
SHA5129d38f9be19a82578bb90669ade4b7dd9e3c999f8f9beb055ffcb6db2da0da1d619be677ab17a0d1b2c83a63c2b502b5f4ef87af0468891c21d9e4069899f0396
-
memory/584-59-0x0000000000000000-mapping.dmp
-
memory/1388-58-0x0000000000000000-mapping.dmp
-
memory/1468-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1468-55-0x0000000002140000-0x0000000002214000-memory.dmpFilesize
848KB
-
memory/1648-61-0x0000000000000000-mapping.dmp
-
memory/1648-64-0x00000000021E0000-0x00000000022B4000-memory.dmpFilesize
848KB
-
memory/1688-56-0x0000000000000000-mapping.dmp