dfaceba3c3270c15a1ccc040a0e94e60ae0e9f7f5147e6b34f744ad3dc2b028a

General

Target

NEAS.3818c107f33a83e67d6aa1c187e68330.exe
Size

209KB
MD5

3818c107f33a83e67d6aa1c187e68330
SHA1

dda53fe23153da45d10bc9687402875b1eeb4679
SHA256

dfaceba3c3270c15a1ccc040a0e94e60ae0e9f7f5147e6b34f744ad3dc2b028a
SHA512

913a5d74c61116fc312ea777d751cd0cbea703eadc3bba8cee6972a76e78f23cf1dfdc1a5287729b43d7c7af0a5dcab31b883f256e3e21257fcf1a33b3facafa
SSDEEP

3072:AQcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e:AQh9tVRm2kh34hdeCkcG7DEALLlnN

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4328	svchost.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2956-1-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/2956-12-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/4328-13-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/4328-23-0x0000000000400000-0x0000000000469000-memory.dmp	upx

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\1bf2c89c = "C:\\Windows\\apppatch\\svchost.exe"	NEAS.3818c107f33a83e67d6aa1c187e68330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\1bf2c89c = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	NEAS.3818c107f33a83e67d6aa1c187e68330.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	NEAS.3818c107f33a83e67d6aa1c187e68330.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	svchost.exe
4328	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2956	NEAS.3818c107f33a83e67d6aa1c187e68330.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4328	2956	NEAS.3818c107f33a83e67d6aa1c187e68330.exe	86
PID 2956 wrote to memory of 4328	2956	NEAS.3818c107f33a83e67d6aa1c187e68330.exe	86
PID 2956 wrote to memory of 4328	2956	NEAS.3818c107f33a83e67d6aa1c187e68330.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.3818c107f33a83e67d6aa1c187e68330.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3818c107f33a83e67d6aa1c187e68330.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\apppatch\svchost.exe

Filesize
209KB

MD5
be7847e9cb121bafe89aa7f290892efa

SHA1
03862e2bebe15e86d4b01e44185caf96d011f1c2

SHA256
919497124139f9d4a6b003f26a4f8b4bcc9ae376ee2edd73b2cda83e89453d2a

SHA512
f8cf60ee0f9499dd2434cd3638e01d52d8f3b2bce4c43bafaa400de2bf91cb79b149a85ec0b4c01dc3fead36fff5a9e4c5a51171c942d905f6db224b2c86ba9a

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
209KB

MD5
be7847e9cb121bafe89aa7f290892efa

SHA1
03862e2bebe15e86d4b01e44185caf96d011f1c2

SHA256
919497124139f9d4a6b003f26a4f8b4bcc9ae376ee2edd73b2cda83e89453d2a

SHA512
f8cf60ee0f9499dd2434cd3638e01d52d8f3b2bce4c43bafaa400de2bf91cb79b149a85ec0b4c01dc3fead36fff5a9e4c5a51171c942d905f6db224b2c86ba9a

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
209KB

MD5
be7847e9cb121bafe89aa7f290892efa

SHA1
03862e2bebe15e86d4b01e44185caf96d011f1c2

SHA256
919497124139f9d4a6b003f26a4f8b4bcc9ae376ee2edd73b2cda83e89453d2a

SHA512
f8cf60ee0f9499dd2434cd3638e01d52d8f3b2bce4c43bafaa400de2bf91cb79b149a85ec0b4c01dc3fead36fff5a9e4c5a51171c942d905f6db224b2c86ba9a

Download Submit
memory/2956-11-0x00000000021E0000-0x0000000002238000-memory.dmp

Filesize
352KB

Download
memory/2956-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2956-12-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2956-0-0x00000000021E0000-0x0000000002238000-memory.dmp

Filesize
352KB

Download
memory/4328-13-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4328-14-0x0000000002A00000-0x0000000002A8A000-memory.dmp

Filesize
552KB

Download
memory/4328-15-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download
memory/4328-17-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download
memory/4328-18-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download
memory/4328-19-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download
memory/4328-22-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download
memory/4328-23-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads