Analysis
-
max time kernel
200s -
max time network
208s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe
Resource
win10v2004-20220812-en
General
-
Target
5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe
-
Size
219KB
-
MD5
d9fc38c11b88c277922a1af48cdaebf6
-
SHA1
12630cf78f29e2c81a3b757cbc48b95793f05301
-
SHA256
5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd
-
SHA512
a9d4a93a8546eda7003ec45ec903e01701e457aeefa6d0fd9ce6a9d4638f05d4e5fe76fd40c3b070a6d513cb817a4344574bb78c26ece80efe6ee1ed9b0d8b6a
-
SSDEEP
6144:oAI9wC8bgvTAPGAAGWd1AOeo+m1D/cY8VDfy0:oABDgvTA+AAGWd14zm5/cYeq0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
winlogin.exepid process 1128 winlogin.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E\cfg = "{D36E26B3-735F-481F-8BA4-C673F0B4E144}SERV }SABDUHNY " winlogin.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E winlogin.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 636 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 636 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run winlogin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogin = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\winlogin.exe" winlogin.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org 9 api.ipify.org -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.execmd.exedescription pid process target process PID 772 wrote to memory of 320 772 5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe cmd.exe PID 772 wrote to memory of 320 772 5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe cmd.exe PID 772 wrote to memory of 320 772 5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe cmd.exe PID 772 wrote to memory of 320 772 5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe cmd.exe PID 772 wrote to memory of 636 772 5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe cmd.exe PID 772 wrote to memory of 636 772 5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe cmd.exe PID 772 wrote to memory of 636 772 5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe cmd.exe PID 772 wrote to memory of 636 772 5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe cmd.exe PID 636 wrote to memory of 536 636 cmd.exe PING.EXE PID 636 wrote to memory of 536 636 cmd.exe PING.EXE PID 636 wrote to memory of 536 636 cmd.exe PING.EXE PID 636 wrote to memory of 536 636 cmd.exe PING.EXE PID 636 wrote to memory of 1128 636 cmd.exe winlogin.exe PID 636 wrote to memory of 1128 636 cmd.exe winlogin.exe PID 636 wrote to memory of 1128 636 cmd.exe winlogin.exe PID 636 wrote to memory of 1128 636 cmd.exe winlogin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe"C:\Users\Admin\AppData\Local\Temp\5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\cmd.execmd /D /R type "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" > ___ && move /Y ___ "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"2⤵PID:320
-
C:\Windows\SysWOW64\cmd.execmd /D /R ping -n 10 localhost && del "C:\Users\Admin\AppData\Local\Temp\5cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd.exe" && start /B "" "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" && exit2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
PID:536 -
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
219KB
MD5d9fc38c11b88c277922a1af48cdaebf6
SHA112630cf78f29e2c81a3b757cbc48b95793f05301
SHA2565cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd
SHA512a9d4a93a8546eda7003ec45ec903e01701e457aeefa6d0fd9ce6a9d4638f05d4e5fe76fd40c3b070a6d513cb817a4344574bb78c26ece80efe6ee1ed9b0d8b6a
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
219KB
MD5d9fc38c11b88c277922a1af48cdaebf6
SHA112630cf78f29e2c81a3b757cbc48b95793f05301
SHA2565cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd
SHA512a9d4a93a8546eda7003ec45ec903e01701e457aeefa6d0fd9ce6a9d4638f05d4e5fe76fd40c3b070a6d513cb817a4344574bb78c26ece80efe6ee1ed9b0d8b6a
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
219KB
MD5d9fc38c11b88c277922a1af48cdaebf6
SHA112630cf78f29e2c81a3b757cbc48b95793f05301
SHA2565cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd
SHA512a9d4a93a8546eda7003ec45ec903e01701e457aeefa6d0fd9ce6a9d4638f05d4e5fe76fd40c3b070a6d513cb817a4344574bb78c26ece80efe6ee1ed9b0d8b6a
-
\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
219KB
MD5d9fc38c11b88c277922a1af48cdaebf6
SHA112630cf78f29e2c81a3b757cbc48b95793f05301
SHA2565cfbc395d95347350e85fafb3d15e811350b18dce1e2abfe981ed59449c5ecdd
SHA512a9d4a93a8546eda7003ec45ec903e01701e457aeefa6d0fd9ce6a9d4638f05d4e5fe76fd40c3b070a6d513cb817a4344574bb78c26ece80efe6ee1ed9b0d8b6a
-
memory/320-55-0x0000000000000000-mapping.dmp
-
memory/536-58-0x0000000000000000-mapping.dmp
-
memory/636-57-0x0000000000000000-mapping.dmp
-
memory/772-54-0x0000000002240000-0x0000000002365000-memory.dmpFilesize
1.1MB
-
memory/1128-61-0x0000000000000000-mapping.dmp
-
memory/1128-63-0x00000000023F0000-0x0000000002515000-memory.dmpFilesize
1.1MB
-
memory/1128-64-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB