9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048

General

Target

9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
Size

63KB
MD5

8b717d8de3dcc7e0e9958637cc1cd9d2
SHA1

bd17a236cceb84054dd7a202ce5b25bb141618bd
SHA256

9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048
SHA512

fcc6eb881305b3fcfc17daa2dc04f368d464a7c6aaad1f8652bfa12f5edadf0125e7cb9b9fb3447c78bfa49a5d11982c7dc1eb3db8c90293bdaaffa7b133bbd2
SSDEEP

768:pG9r4iGhVLbNxSKoiyhovjdcEDB53qn5x0WSwuLcNz8RYYTqeghrP6pcR:pG9GhVlxjO4jdf05IrYaCYwic

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1408-60-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1408-62-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1408-63-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1408-65-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

pid process

1408 9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

pid	process
1408	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\cbecytc = "rundll32 \"C:\\Users\\Admin\\AppData\\Local\\cbecytc.dll\",cbecytc"	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbecytc\Startup = "cbecytc"	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbecytc	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbecytc\Impersonate = "1"	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbecytc\Asynchronous = "1"	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbecytc\MaxWait = "1"	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbecytc\ortwefvb = df117c407d47f001fa8e	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbecytc\DllName = "C:\\Users\\Admin\\AppData\\Local\\cbecytc.dll"	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

description	pid	process	target process
PID 1460 set thread context of 1408	1460	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

description	pid	process	target process
PID 1460 wrote to memory of 1408	1460	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
PID 1460 wrote to memory of 1408	1460	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
PID 1460 wrote to memory of 1408	1460	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
PID 1460 wrote to memory of 1408	1460	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
PID 1460 wrote to memory of 1408	1460	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
PID 1460 wrote to memory of 1408	1460	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
PID 1460 wrote to memory of 1408	1460	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
PID 1460 wrote to memory of 1408	1460	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe	9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe

C:\Users\Admin\AppData\Local\Temp\9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
"C:\Users\Admin\AppData\Local\Temp\9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1460

C:\Users\Admin\AppData\Local\Temp\9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe
"C:\Users\Admin\AppData\Local\Temp\9bdca7c851c0367daa64a38159e7632670a140d3e2d94aa7b9fb14396b0a1048.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
PID:1408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\cbecytc.dll
Filesize
23KB

MD5
690a1ffe9d119cccc991f48559a650fb

SHA1
c542f054ae77cd3ca93abe64d49da97acb8c1530

SHA256
a66c11819c37990dd527db992cd182e2566dc3540b498d8e17f6cb5ca7e4f456

SHA512
e12cd3cafd19159aa501e1c4030d6e3f47a76902cf8629ae82eb2d42b557655b8d1e725a39aad3b2b4a393471d0abcd71b252544334d909924fe720f805169cd

Download Submit
memory/1408-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1408-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1408-59-0x000000000041E180-mapping.dmp

Download
memory/1408-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1408-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1408-61-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1408-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1408-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1408-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads