d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c

General

Target

d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
Size

448KB
MD5

fa77b7a291ecab87b78575286e022c8c
SHA1

9afa66bcf1a2521f78889b4a104dd72fbd42eed7
SHA256

d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c
SHA512

aed71e5d454c3db79603d3a3feea5bc162aba73c6dc489f4e17157ce6335c7156b68cf0d1d45952b5d26bead88966bab4b766c7874dd20d6c3938a1f9b98ce69
SSDEEP

3072:ONocFcj9+1iVJjtkfeIBStSR2CDyNdYyoHxNTo45cfEpDiODWxJRMdf1pteNU2C2:LcFNz2bzRiJeNU6cue6lw3sDB+0xACr

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\""	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\""	lsass.exe

Executes dropped EXE 2 IoCs

pid	Process
1656	lsass.exe
1716	lsass.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1924	netsh.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1400-56-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1984-57-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1400-60-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1984-61-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1984-62-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-67.dat	upx
behavioral1/files/0x00140000000054ab-68.dat	upx
behavioral1/files/0x00140000000054ab-70.dat	upx
behavioral1/memory/1984-72-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1656-74-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-76.dat	upx
behavioral1/memory/1656-81-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-79.dat	upx
behavioral1/memory/1716-87-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\""	lsass.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\""	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\""	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\""	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	lsass.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1656 set thread context of 1716	1656	lsass.exe	31

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
1656	lsass.exe
1716	lsass.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1400 wrote to memory of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1400 wrote to memory of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1400 wrote to memory of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1400 wrote to memory of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1400 wrote to memory of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1400 wrote to memory of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1400 wrote to memory of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1400 wrote to memory of 1984	1400	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	27
PID 1984 wrote to memory of 1924	1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	28
PID 1984 wrote to memory of 1924	1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	28
PID 1984 wrote to memory of 1924	1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	28
PID 1984 wrote to memory of 1924	1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	28
PID 1984 wrote to memory of 1656	1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	30
PID 1984 wrote to memory of 1656	1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	30
PID 1984 wrote to memory of 1656	1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	30
PID 1984 wrote to memory of 1656	1984	d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe	30
PID 1656 wrote to memory of 1716	1656	lsass.exe	31
PID 1656 wrote to memory of 1716	1656	lsass.exe	31
PID 1656 wrote to memory of 1716	1656	lsass.exe	31
PID 1656 wrote to memory of 1716	1656	lsass.exe	31
PID 1656 wrote to memory of 1716	1656	lsass.exe	31
PID 1656 wrote to memory of 1716	1656	lsass.exe	31
PID 1656 wrote to memory of 1716	1656	lsass.exe	31
PID 1656 wrote to memory of 1716	1656	lsass.exe	31
PID 1656 wrote to memory of 1716	1656	lsass.exe	31

C:\Users\Admin\AppData\Local\Temp\d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
"C:\Users\Admin\AppData\Local\Temp\d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
  "C:\Users\Admin\AppData\Local\Temp\d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\lsass.exe" CityScape Enable
    3⤵
    - Modifies Windows Firewall
    PID:1924
- - C:\Users\Admin\AppData\Roaming\lsass.exe
    /d C:\Users\Admin\AppData\Local\Temp\d37b706f9c9c2cf874a4c66661df1a7b1c03670e8dd46c7211c3d2b240df781c.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Users\Admin\AppData\Roaming\lsass.exe
      "C:\Users\Admin\AppData\Roaming\lsass.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\lsass.exe

Filesize
448KB

MD5
739f2a07d54f9fd8dc1a4fa266c3f3d8

SHA1
51ad2d64fef260525dd705a7ae74c21877c5ff0b

SHA256
d6ed541af390f2c8b1203a3685551b8b0a8c308c85da16481e2fa11e1387fd7b

SHA512
626359f09288dab9a7034de5cb30437d4ba1b020f7848c7e33410ea18cf699371929dc48fba7fd7224ca8097d6ed1b58c4764159d91804d0b235d7509d5a6d6c

Download Submit
C:\Users\Admin\AppData\Roaming\lsass.exe

Filesize
448KB

MD5
739f2a07d54f9fd8dc1a4fa266c3f3d8

SHA1
51ad2d64fef260525dd705a7ae74c21877c5ff0b

SHA256
d6ed541af390f2c8b1203a3685551b8b0a8c308c85da16481e2fa11e1387fd7b

SHA512
626359f09288dab9a7034de5cb30437d4ba1b020f7848c7e33410ea18cf699371929dc48fba7fd7224ca8097d6ed1b58c4764159d91804d0b235d7509d5a6d6c

Download Submit
C:\Users\Admin\AppData\Roaming\lsass.exe

Filesize
448KB

MD5
739f2a07d54f9fd8dc1a4fa266c3f3d8

SHA1
51ad2d64fef260525dd705a7ae74c21877c5ff0b

SHA256
d6ed541af390f2c8b1203a3685551b8b0a8c308c85da16481e2fa11e1387fd7b

SHA512
626359f09288dab9a7034de5cb30437d4ba1b020f7848c7e33410ea18cf699371929dc48fba7fd7224ca8097d6ed1b58c4764159d91804d0b235d7509d5a6d6c

Download Submit
\Users\Admin\AppData\Roaming\lsass.exe

Filesize
448KB

MD5
739f2a07d54f9fd8dc1a4fa266c3f3d8

SHA1
51ad2d64fef260525dd705a7ae74c21877c5ff0b

SHA256
d6ed541af390f2c8b1203a3685551b8b0a8c308c85da16481e2fa11e1387fd7b

SHA512
626359f09288dab9a7034de5cb30437d4ba1b020f7848c7e33410ea18cf699371929dc48fba7fd7224ca8097d6ed1b58c4764159d91804d0b235d7509d5a6d6c

Download Submit
\Users\Admin\AppData\Roaming\lsass.exe

Filesize
448KB

MD5
739f2a07d54f9fd8dc1a4fa266c3f3d8

SHA1
51ad2d64fef260525dd705a7ae74c21877c5ff0b

SHA256
d6ed541af390f2c8b1203a3685551b8b0a8c308c85da16481e2fa11e1387fd7b

SHA512
626359f09288dab9a7034de5cb30437d4ba1b020f7848c7e33410ea18cf699371929dc48fba7fd7224ca8097d6ed1b58c4764159d91804d0b235d7509d5a6d6c

Download Submit
memory/1400-60-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1400-56-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1656-81-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1656-69-0x0000000000000000-mapping.dmp

Download
memory/1656-74-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1716-78-0x000000000041EBC0-mapping.dmp

Download
memory/1716-87-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1924-66-0x0000000000000000-mapping.dmp

Download
memory/1984-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1984-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1984-65-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1984-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1984-58-0x000000000041EBC0-mapping.dmp

Download
memory/1984-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads