e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b

General

Target

e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe
Size

230KB
MD5

559334a0652c9a9515646d53f162c74a
SHA1

af776b529d366b8ede32cdf89f6b6c9ee244cf4d
SHA256

e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b
SHA512

3d75339c9d8beefc220dd9237195d2fd231325382c3864efe787aaf30b707096bfc2171a6f0ecb02c62de265d7d2556a2095b7ac835e4fc40b2295fa311abc2d
SSDEEP

3072:baSYvUVNpjftP8S4MDdfjKoskYWIqGrVbWHAQXEpQoRhqd9tsWtZbd+t0fqKi3Hu:bh9f5GSfEiTtsWTx0HHAQdZEe

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

winlogin.exe

pid process

4408 winlogin.exe

pid	process
4408	winlogin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\winlogin.exe\" -autorun"	winlogin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

winlogin.exe

pid process

4408 winlogin.exe
4408 winlogin.exe
4408 winlogin.exe
4408 winlogin.exe

pid	process
4408	winlogin.exe
4408	winlogin.exe
4408	winlogin.exe
4408	winlogin.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.execmd.exewinlogin.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1704 wrote to memory of 3708	1704	e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe	cmd.exe
PID 1704 wrote to memory of 3708	1704	e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe	cmd.exe
PID 1704 wrote to memory of 3708	1704	e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe	cmd.exe
PID 3708 wrote to memory of 4028	3708	cmd.exe	attrib.exe
PID 3708 wrote to memory of 4028	3708	cmd.exe	attrib.exe
PID 3708 wrote to memory of 4028	3708	cmd.exe	attrib.exe
PID 1704 wrote to memory of 4408	1704	e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe	winlogin.exe
PID 1704 wrote to memory of 4408	1704	e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe	winlogin.exe
PID 1704 wrote to memory of 4408	1704	e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe	winlogin.exe
PID 4408 wrote to memory of 2492	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 2492	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 2492	4408	winlogin.exe	cmd.exe
PID 2492 wrote to memory of 2756	2492	cmd.exe	attrib.exe
PID 2492 wrote to memory of 2756	2492	cmd.exe	attrib.exe
PID 2492 wrote to memory of 2756	2492	cmd.exe	attrib.exe
PID 4408 wrote to memory of 4592	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 4592	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 4592	4408	winlogin.exe	cmd.exe
PID 4592 wrote to memory of 3388	4592	cmd.exe	attrib.exe
PID 4592 wrote to memory of 3388	4592	cmd.exe	attrib.exe
PID 4592 wrote to memory of 3388	4592	cmd.exe	attrib.exe
PID 4408 wrote to memory of 3376	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 3376	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 3376	4408	winlogin.exe	cmd.exe
PID 3376 wrote to memory of 2052	3376	cmd.exe	attrib.exe
PID 3376 wrote to memory of 2052	3376	cmd.exe	attrib.exe
PID 3376 wrote to memory of 2052	3376	cmd.exe	attrib.exe
PID 4408 wrote to memory of 3300	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 3300	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 3300	4408	winlogin.exe	cmd.exe
PID 3300 wrote to memory of 4212	3300	cmd.exe	attrib.exe
PID 3300 wrote to memory of 4212	3300	cmd.exe	attrib.exe
PID 3300 wrote to memory of 4212	3300	cmd.exe	attrib.exe
PID 4408 wrote to memory of 3444	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 3444	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 3444	4408	winlogin.exe	cmd.exe
PID 3444 wrote to memory of 2980	3444	cmd.exe	attrib.exe
PID 3444 wrote to memory of 2980	3444	cmd.exe	attrib.exe
PID 3444 wrote to memory of 2980	3444	cmd.exe	attrib.exe
PID 4408 wrote to memory of 3868	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 3868	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 3868	4408	winlogin.exe	cmd.exe
PID 3868 wrote to memory of 2244	3868	cmd.exe	attrib.exe
PID 3868 wrote to memory of 2244	3868	cmd.exe	attrib.exe
PID 3868 wrote to memory of 2244	3868	cmd.exe	attrib.exe
PID 4408 wrote to memory of 4452	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 4452	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 4452	4408	winlogin.exe	cmd.exe
PID 4452 wrote to memory of 1652	4452	cmd.exe	attrib.exe
PID 4452 wrote to memory of 1652	4452	cmd.exe	attrib.exe
PID 4452 wrote to memory of 1652	4452	cmd.exe	attrib.exe
PID 4408 wrote to memory of 1416	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 1416	4408	winlogin.exe	cmd.exe
PID 4408 wrote to memory of 1416	4408	winlogin.exe	cmd.exe
PID 1416 wrote to memory of 4252	1416	cmd.exe	attrib.exe
PID 1416 wrote to memory of 4252	1416	cmd.exe	attrib.exe
PID 1416 wrote to memory of 4252	1416	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 9 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

2052 attrib.exe
1652 attrib.exe
3388 attrib.exe
2756 attrib.exe
4212 attrib.exe
2980 attrib.exe
2244 attrib.exe
4252 attrib.exe
4028 attrib.exe

pid	process
2052	attrib.exe
1652	attrib.exe
3388	attrib.exe
2756	attrib.exe
4212	attrib.exe
2980	attrib.exe
2244	attrib.exe
4252	attrib.exe
4028	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe
"C:\Users\Admin\AppData\Local\Temp\e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h "C:\Users\Admin\AppData\Local\Temp\e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windows\SysWOW64\attrib.exe
attrib +h "C:\Users\Admin\AppData\Local\Temp\e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b.exe"
3⤵
- Views/modifies file attributes
PID:4028

C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe
"C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\attrib.exe
attrib +h "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"
4⤵
- Views/modifies file attributes
PID:2756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\SysWOW64\attrib.exe
attrib +h "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"
4⤵
- Views/modifies file attributes
PID:3388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h "C:\Users\Admin\AppData\Roaming\Windows\config.ini"
3⤵
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\SysWOW64\attrib.exe
attrib +h "C:\Users\Admin\AppData\Roaming\Windows\config.ini"
4⤵
- Views/modifies file attributes
PID:2052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h "C:\Users\Admin\AppData\Roaming\Windows\cfg"
3⤵
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\SysWOW64\attrib.exe
attrib +h "C:\Users\Admin\AppData\Roaming\Windows\cfg"
4⤵
- Views/modifies file attributes
PID:4212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h "."
3⤵
- Suspicious use of WriteProcessMemory
PID:3444

C:\Windows\SysWOW64\attrib.exe
attrib +h "."
4⤵
- Views/modifies file attributes
PID:2980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h ".."
3⤵
- Suspicious use of WriteProcessMemory
PID:3868

C:\Windows\SysWOW64\attrib.exe
attrib +h ".."
4⤵
- Views/modifies file attributes
PID:2244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h "config.ini"
3⤵
- Suspicious use of WriteProcessMemory
PID:4452

C:\Windows\SysWOW64\attrib.exe
attrib +h "config.ini"
4⤵
- Views/modifies file attributes
PID:1652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h "winlogin.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\attrib.exe
attrib +h "winlogin.exe"
4⤵
- Views/modifies file attributes
PID:4252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windows\config.ini

Filesize
23B

MD5
3686ce48884a1cfe6d8baf44e718983e

SHA1
ec7cac48f16c7123435570a99226c5bbe42f9d61

SHA256
9dad5b913773a0736ff50ea369c59d616b123dd284d7b3399f20920229a6e9a2

SHA512
b256487c217c698d2bef6fd389b399fe88b5d91e08bbf2467c92e08468f9f63419adfb6c28157a9309a952fb75c01b6621ba85318b1a3b692ffe24931f129528

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
230KB

MD5
559334a0652c9a9515646d53f162c74a

SHA1
af776b529d366b8ede32cdf89f6b6c9ee244cf4d

SHA256
e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b

SHA512
3d75339c9d8beefc220dd9237195d2fd231325382c3864efe787aaf30b707096bfc2171a6f0ecb02c62de265d7d2556a2095b7ac835e4fc40b2295fa311abc2d

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
230KB

MD5
559334a0652c9a9515646d53f162c74a

SHA1
af776b529d366b8ede32cdf89f6b6c9ee244cf4d

SHA256
e7daacd1cfee0b8454ee1c79b031e3f9500c55a41742d4b697f2cea891b21e3b

SHA512
3d75339c9d8beefc220dd9237195d2fd231325382c3864efe787aaf30b707096bfc2171a6f0ecb02c62de265d7d2556a2095b7ac835e4fc40b2295fa311abc2d

Download Submit
memory/1416-153-0x0000000000000000-mapping.dmp

Download
memory/1652-152-0x0000000000000000-mapping.dmp

Download
memory/2052-143-0x0000000000000000-mapping.dmp

Download
memory/2244-150-0x0000000000000000-mapping.dmp

Download
memory/2492-138-0x0000000000000000-mapping.dmp

Download
memory/2756-139-0x0000000000000000-mapping.dmp

Download
memory/2980-148-0x0000000000000000-mapping.dmp

Download
memory/3300-145-0x0000000000000000-mapping.dmp

Download
memory/3376-142-0x0000000000000000-mapping.dmp

Download
memory/3388-141-0x0000000000000000-mapping.dmp

Download
memory/3444-147-0x0000000000000000-mapping.dmp

Download
memory/3708-133-0x0000000000000000-mapping.dmp

Download
memory/3868-149-0x0000000000000000-mapping.dmp

Download
memory/4028-134-0x0000000000000000-mapping.dmp

Download
memory/4212-146-0x0000000000000000-mapping.dmp

Download
memory/4252-154-0x0000000000000000-mapping.dmp

Download
memory/4408-135-0x0000000000000000-mapping.dmp

Download
memory/4452-151-0x0000000000000000-mapping.dmp

Download
memory/4592-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing