Analysis
-
max time kernel
150s -
max time network
202s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 09:00
Static task
static1
Behavioral task
behavioral1
Sample
35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe
Resource
win10v2004-20221111-en
General
-
Target
35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe
-
Size
90KB
-
MD5
db835bba2dafa1729db620b908f5e70f
-
SHA1
5cb5d095875e2d6e46eacc03c12bbc4189c138e2
-
SHA256
35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252
-
SHA512
bcbd75978c152ddbbe72b201e5f68bbd9807690d5f9f839481e53852c36a65cbe804f9845762c363a78cc270eccb6bb5a1a1e7df2800cd205ed0df7dd7c8ca0b
-
SSDEEP
1536:DrhPDpRvH4RqIL8kh3eyT/uWEC7qthGEmOjq5Rj5f:DrBDpRvY+yqqE/j+R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
winlogin.exepid process 544 winlogin.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E winlogin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E\cfg = "{E5307BEB-FB75-4D6D-995D-0211ECF6EC2A}GR }SABDUHNY " winlogin.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 588 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 588 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run winlogin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogin = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\winlogin.exe" winlogin.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 api.ipify.org -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.execmd.exedescription pid process target process PID 828 wrote to memory of 672 828 35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe cmd.exe PID 828 wrote to memory of 672 828 35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe cmd.exe PID 828 wrote to memory of 672 828 35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe cmd.exe PID 828 wrote to memory of 672 828 35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe cmd.exe PID 828 wrote to memory of 588 828 35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe cmd.exe PID 828 wrote to memory of 588 828 35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe cmd.exe PID 828 wrote to memory of 588 828 35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe cmd.exe PID 828 wrote to memory of 588 828 35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe cmd.exe PID 588 wrote to memory of 2032 588 cmd.exe PING.EXE PID 588 wrote to memory of 2032 588 cmd.exe PING.EXE PID 588 wrote to memory of 2032 588 cmd.exe PING.EXE PID 588 wrote to memory of 2032 588 cmd.exe PING.EXE PID 588 wrote to memory of 544 588 cmd.exe winlogin.exe PID 588 wrote to memory of 544 588 cmd.exe winlogin.exe PID 588 wrote to memory of 544 588 cmd.exe winlogin.exe PID 588 wrote to memory of 544 588 cmd.exe winlogin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe"C:\Users\Admin\AppData\Local\Temp\35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.execmd /D /R type "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" > ___ && move /Y ___ "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"2⤵PID:672
-
C:\Windows\SysWOW64\cmd.execmd /D /R ping -n 10 localhost && del "C:\Users\Admin\AppData\Local\Temp\35063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252.exe" && start /B "" "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" && exit2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
PID:2032 -
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:544
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
90KB
MD5db835bba2dafa1729db620b908f5e70f
SHA15cb5d095875e2d6e46eacc03c12bbc4189c138e2
SHA25635063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252
SHA512bcbd75978c152ddbbe72b201e5f68bbd9807690d5f9f839481e53852c36a65cbe804f9845762c363a78cc270eccb6bb5a1a1e7df2800cd205ed0df7dd7c8ca0b
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
90KB
MD5db835bba2dafa1729db620b908f5e70f
SHA15cb5d095875e2d6e46eacc03c12bbc4189c138e2
SHA25635063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252
SHA512bcbd75978c152ddbbe72b201e5f68bbd9807690d5f9f839481e53852c36a65cbe804f9845762c363a78cc270eccb6bb5a1a1e7df2800cd205ed0df7dd7c8ca0b
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
90KB
MD5db835bba2dafa1729db620b908f5e70f
SHA15cb5d095875e2d6e46eacc03c12bbc4189c138e2
SHA25635063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252
SHA512bcbd75978c152ddbbe72b201e5f68bbd9807690d5f9f839481e53852c36a65cbe804f9845762c363a78cc270eccb6bb5a1a1e7df2800cd205ed0df7dd7c8ca0b
-
\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
90KB
MD5db835bba2dafa1729db620b908f5e70f
SHA15cb5d095875e2d6e46eacc03c12bbc4189c138e2
SHA25635063285fbb903f7349685e4263b25d0124fd087ba2a708202f7782de46d8252
SHA512bcbd75978c152ddbbe72b201e5f68bbd9807690d5f9f839481e53852c36a65cbe804f9845762c363a78cc270eccb6bb5a1a1e7df2800cd205ed0df7dd7c8ca0b
-
memory/544-61-0x0000000000000000-mapping.dmp
-
memory/544-63-0x0000000001F30000-0x0000000002070000-memory.dmpFilesize
1.2MB
-
memory/544-64-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/588-57-0x0000000000000000-mapping.dmp
-
memory/672-55-0x0000000000000000-mapping.dmp
-
memory/828-54-0x00000000021D0000-0x0000000002310000-memory.dmpFilesize
1.2MB
-
memory/2032-58-0x0000000000000000-mapping.dmp