Analysis
-
max time kernel
93s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 09:00
Static task
static1
Behavioral task
behavioral1
Sample
1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe
Resource
win10v2004-20220812-en
General
-
Target
1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe
-
Size
146KB
-
MD5
0ae67b36cd78c74bb60d34cf1a65de04
-
SHA1
8823c6de3811fb7c084da3dbdce1a2ac4488f184
-
SHA256
1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad
-
SHA512
2ac14f13dff9cf7a95f85f8fb3325e8cd990e94410f1bf85f6c08217a9c80c49adde0b14728369352e92ce0321d194af8d41557cf4738d3282b2bcf0884d7436
-
SSDEEP
3072:fPhayOqCDdmepdL+8SbZDN1nheDtg48yJ40UGG8fehxHvuy7kHEqKTJ5apyoX5zJ:fPklDok9+8MHheDtt8U4JvlK4R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
winlogin.exepid process 1252 winlogin.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E winlogin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\05F16C88-71D3-42C1-BB4F-E9BAF7DB4A9E\cfg = "{17B6EF18-FCFC-4681-AF19-1EFFE015E2E7}SERV }XZIOFAVD " winlogin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winlogin.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run winlogin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogin = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\winlogin.exe" winlogin.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 36 api.ipify.org 35 api.ipify.org -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.execmd.exedescription pid process target process PID 2868 wrote to memory of 4812 2868 1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe cmd.exe PID 2868 wrote to memory of 4812 2868 1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe cmd.exe PID 2868 wrote to memory of 4812 2868 1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe cmd.exe PID 2868 wrote to memory of 4496 2868 1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe cmd.exe PID 2868 wrote to memory of 4496 2868 1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe cmd.exe PID 2868 wrote to memory of 4496 2868 1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe cmd.exe PID 4496 wrote to memory of 3512 4496 cmd.exe PING.EXE PID 4496 wrote to memory of 3512 4496 cmd.exe PING.EXE PID 4496 wrote to memory of 3512 4496 cmd.exe PING.EXE PID 4496 wrote to memory of 1252 4496 cmd.exe winlogin.exe PID 4496 wrote to memory of 1252 4496 cmd.exe winlogin.exe PID 4496 wrote to memory of 1252 4496 cmd.exe winlogin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe"C:\Users\Admin\AppData\Local\Temp\1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /D /R type "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" > ___ && move /Y ___ "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /D /R ping -n 10 localhost && del "C:\Users\Admin\AppData\Local\Temp\1abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad.exe" && start /B "" "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" && exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
146KB
MD50ae67b36cd78c74bb60d34cf1a65de04
SHA18823c6de3811fb7c084da3dbdce1a2ac4488f184
SHA2561abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad
SHA5122ac14f13dff9cf7a95f85f8fb3325e8cd990e94410f1bf85f6c08217a9c80c49adde0b14728369352e92ce0321d194af8d41557cf4738d3282b2bcf0884d7436
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
146KB
MD50ae67b36cd78c74bb60d34cf1a65de04
SHA18823c6de3811fb7c084da3dbdce1a2ac4488f184
SHA2561abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad
SHA5122ac14f13dff9cf7a95f85f8fb3325e8cd990e94410f1bf85f6c08217a9c80c49adde0b14728369352e92ce0321d194af8d41557cf4738d3282b2bcf0884d7436
-
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exeFilesize
146KB
MD50ae67b36cd78c74bb60d34cf1a65de04
SHA18823c6de3811fb7c084da3dbdce1a2ac4488f184
SHA2561abfe66059db90e41ab278abf43cea737ac76acc8159bf7806e2d41e1467baad
SHA5122ac14f13dff9cf7a95f85f8fb3325e8cd990e94410f1bf85f6c08217a9c80c49adde0b14728369352e92ce0321d194af8d41557cf4738d3282b2bcf0884d7436
-
memory/1252-137-0x0000000000000000-mapping.dmp
-
memory/1252-140-0x0000000003AD0000-0x0000000003B9E000-memory.dmpFilesize
824KB
-
memory/2868-132-0x0000000003AA0000-0x0000000003B6E000-memory.dmpFilesize
824KB
-
memory/3512-136-0x0000000000000000-mapping.dmp
-
memory/4496-135-0x0000000000000000-mapping.dmp
-
memory/4812-133-0x0000000000000000-mapping.dmp