Analysis
-
max time kernel
177s -
max time network
217s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe
Resource
win10v2004-20220812-en
General
-
Target
7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe
-
Size
142KB
-
MD5
2f8697713eeec7784863c1bf21e00d08
-
SHA1
be7506a336bbc08e65c4fbb006a56826e5411da9
-
SHA256
7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004
-
SHA512
ebe0b892f8816a5c38a874b442a9e9f8dd81969b94ef63a611fe8b1bf0af6ff59c78065cce48d3e07bc2d844c0609823e61068acd576cb5b4a4338705ce1f2e3
-
SSDEEP
1536:BseyxDJOye1B5t64B8VzI7CKok/3e97SNsLUyq3B8l9wntZTBbEDSrX95fR:BseytJOygmqpo97SwlSnvTBbv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
winlogin.exepid process 1196 winlogin.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E winlogin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E\cfg = "{0C1E812C-3A70-471E-BF8A-474B4CF90813}SERV }ZERMMMDR " winlogin.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 848 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 848 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run winlogin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogin = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\winlogin.exe" winlogin.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org 6 api.ipify.org -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.execmd.exedescription pid process target process PID 272 wrote to memory of 1448 272 7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe cmd.exe PID 272 wrote to memory of 1448 272 7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe cmd.exe PID 272 wrote to memory of 1448 272 7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe cmd.exe PID 272 wrote to memory of 1448 272 7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe cmd.exe PID 272 wrote to memory of 848 272 7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe cmd.exe PID 272 wrote to memory of 848 272 7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe cmd.exe PID 272 wrote to memory of 848 272 7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe cmd.exe PID 272 wrote to memory of 848 272 7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe cmd.exe PID 848 wrote to memory of 1760 848 cmd.exe PING.EXE PID 848 wrote to memory of 1760 848 cmd.exe PING.EXE PID 848 wrote to memory of 1760 848 cmd.exe PING.EXE PID 848 wrote to memory of 1760 848 cmd.exe PING.EXE PID 848 wrote to memory of 1196 848 cmd.exe winlogin.exe PID 848 wrote to memory of 1196 848 cmd.exe winlogin.exe PID 848 wrote to memory of 1196 848 cmd.exe winlogin.exe PID 848 wrote to memory of 1196 848 cmd.exe winlogin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe"C:\Users\Admin\AppData\Local\Temp\7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\SysWOW64\cmd.execmd /D /R type "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" > ___ && move /Y ___ "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"2⤵PID:1448
-
C:\Windows\SysWOW64\cmd.execmd /D /R ping -n 10 localhost && del "C:\Users\Admin\AppData\Local\Temp\7a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004.exe" && start /B "" "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" && exit2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
PID:1760 -
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1196
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
142KB
MD52f8697713eeec7784863c1bf21e00d08
SHA1be7506a336bbc08e65c4fbb006a56826e5411da9
SHA2567a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004
SHA512ebe0b892f8816a5c38a874b442a9e9f8dd81969b94ef63a611fe8b1bf0af6ff59c78065cce48d3e07bc2d844c0609823e61068acd576cb5b4a4338705ce1f2e3
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
142KB
MD52f8697713eeec7784863c1bf21e00d08
SHA1be7506a336bbc08e65c4fbb006a56826e5411da9
SHA2567a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004
SHA512ebe0b892f8816a5c38a874b442a9e9f8dd81969b94ef63a611fe8b1bf0af6ff59c78065cce48d3e07bc2d844c0609823e61068acd576cb5b4a4338705ce1f2e3
-
\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
142KB
MD52f8697713eeec7784863c1bf21e00d08
SHA1be7506a336bbc08e65c4fbb006a56826e5411da9
SHA2567a2984a582274d97b3eb24b6548865f3549813c606982610a121292671aa5004
SHA512ebe0b892f8816a5c38a874b442a9e9f8dd81969b94ef63a611fe8b1bf0af6ff59c78065cce48d3e07bc2d844c0609823e61068acd576cb5b4a4338705ce1f2e3
-
memory/272-54-0x0000000001ED0000-0x0000000001FD1000-memory.dmpFilesize
1.0MB
-
memory/848-57-0x0000000000000000-mapping.dmp
-
memory/1196-60-0x0000000000000000-mapping.dmp
-
memory/1196-62-0x0000000001D80000-0x0000000001E81000-memory.dmpFilesize
1.0MB
-
memory/1196-63-0x0000000075811000-0x0000000075813000-memory.dmpFilesize
8KB
-
memory/1448-55-0x0000000000000000-mapping.dmp
-
memory/1760-58-0x0000000000000000-mapping.dmp