a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b

General

Target

a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe
Size

180KB
MD5

387b00428d6a7d8c3a4f7a6c6de2bfcb
SHA1

d8b20edf5fd13249d15c0b5a6210a0601fd33652
SHA256

a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b
SHA512

6599c745b9a90aaf86628c032de5fc55c327be9b95731779ddd723348ee164b879c30f1b9387a2d57f49fd33d17008d64d8e266d6d73b85dec15ea7ee343051c
SSDEEP

3072:7ofKHb2VlNw6zZvQB1aH7lVRwFizDC/exZBVD0S2H8ju1:7ofmbENfznH7lnblz7gb6u1

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe,"	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

Drops file in System32 directory 2 IoCs

Processes:

a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe
File created	C:\Windows\SysWOW64\ntos.exe	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

pid	process
920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe
920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe
920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe
920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

description pid process

Token: SeDebugPrivilege 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

description	pid	process
Token: SeDebugPrivilege	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe

description	pid	process	target process
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe
PID 920 wrote to memory of 592	920	a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe	winlogon.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:592

C:\Users\Admin\AppData\Local\Temp\a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe
"C:\Users\Admin\AppData\Local\Temp\a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-182-0x00000000224F0000-0x0000000022514000-memory.dmp

Filesize
144KB

Download
memory/592-217-0x0000000022640000-0x0000000022664000-memory.dmp

Filesize
144KB

Download
memory/592-142-0x0000000022370000-0x0000000022394000-memory.dmp

Filesize
144KB

Download
memory/592-147-0x00000000223A0000-0x00000000223C4000-memory.dmp

Filesize
144KB

Download
memory/592-152-0x00000000223D0000-0x00000000223F4000-memory.dmp

Filesize
144KB

Download
memory/592-157-0x0000000022400000-0x0000000022424000-memory.dmp

Filesize
144KB

Download
memory/592-162-0x0000000022430000-0x0000000022454000-memory.dmp

Filesize
144KB

Download
memory/592-172-0x0000000022490000-0x00000000224B4000-memory.dmp

Filesize
144KB

Download
memory/592-227-0x00000000226A0000-0x00000000226C4000-memory.dmp

Filesize
144KB

Download
memory/592-137-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/592-167-0x0000000022460000-0x0000000022484000-memory.dmp

Filesize
144KB

Download
memory/592-187-0x0000000022520000-0x0000000022544000-memory.dmp

Filesize
144KB

Download
memory/592-192-0x0000000022550000-0x0000000022574000-memory.dmp

Filesize
144KB

Download
memory/592-197-0x0000000022580000-0x00000000225A4000-memory.dmp

Filesize
144KB

Download
memory/592-202-0x00000000225B0000-0x00000000225D4000-memory.dmp

Filesize
144KB

Download
memory/592-207-0x00000000225E0000-0x0000000022604000-memory.dmp

Filesize
144KB

Download
memory/592-212-0x0000000022610000-0x0000000022634000-memory.dmp

Filesize
144KB

Download
memory/592-177-0x00000000224C0000-0x00000000224E4000-memory.dmp

Filesize
144KB

Download
memory/592-222-0x0000000022670000-0x0000000022694000-memory.dmp

Filesize
144KB

Download
memory/920-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads