17bd11d86c796ee99b3d1498de8a7991deeb991c89f93cb8017740c34053cb9b

General

Target

162.exe
Size

296KB
MD5

0de3dde9632d7cd81c6faa8935367ee6
SHA1

5d7ad691d002257a36fd4d70a9eca9d5b3f94de3
SHA256

9f5ad1582ee9ffc0ff069462fdc11ee940caee24ba86f7dfac172ff243c3fbe6
SHA512

464fcddd7b0e02ddf1d1596f1eae049d3802b513f05d2578f980b8ecc13195ceb354e7245ba6ac125a3e9a36b39f506c6fc208dff50ac4f788cea6d77fc69aa8
SSDEEP

6144:7TMPJK8pp1EmaiUvxFm91X6KS/foPdlFPN560qcHyWzK:S3pp1EPvsE/CFl56VW+

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\899c4414\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
1556	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
2664	X
336	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
616	162.exe
616	162.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/616-0-0x0000000000400000-0x0000000000462000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 616 set thread context of 1556	616	162.exe	28

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{c96b3a43-c658-568e-e4a7-36c2600cc942}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c96b3a43-c658-568e-e4a7-36c2600cc942}\u = "50"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c96b3a43-c658-568e-e4a7-36c2600cc942}\cid = "3739168933132783259"	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2664	X
1556	explorer.exe
1556	explorer.exe
1556	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	explorer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1556	616	162.exe	28
PID 616 wrote to memory of 1556	616	162.exe	28
PID 616 wrote to memory of 1556	616	162.exe	28
PID 616 wrote to memory of 1556	616	162.exe	28
PID 616 wrote to memory of 1556	616	162.exe	28
PID 616 wrote to memory of 2664	616	162.exe	29
PID 616 wrote to memory of 2664	616	162.exe	29
PID 616 wrote to memory of 2664	616	162.exe	29
PID 616 wrote to memory of 2664	616	162.exe	29
PID 2664 wrote to memory of 1204	2664	X	13
PID 1556 wrote to memory of 336	1556	explorer.exe	6
PID 336 wrote to memory of 2744	336	csrss.exe	30
PID 336 wrote to memory of 2744	336	csrss.exe	30
PID 336 wrote to memory of 2588	336	csrss.exe	31
PID 336 wrote to memory of 2588	336	csrss.exe	31

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1204
- C:\Users\Admin\AppData\Local\Temp\162.exe
  "C:\Users\Admin\AppData\Local\Temp\162.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\explorer.exe
    0000005C*
    3⤵
    - Deletes itself
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1556
- - C:\Users\Admin\AppData\Local\899c4414\X
    193.105.154.210:80
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2664

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2744

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\899c4414\@

Filesize
2KB

MD5
78b6b8a1834e1c0d3a668b327ef6fc22

SHA1
9197063f78c3656d760e135370dcc620052d5224

SHA256
c79c3293702fe43896a3c3ca6157b8ef3d782b8b4ca9b21b6a2943703846e5b0

SHA512
491e2a193975daa881b624805179ff1df8230b6f0619572f501f2f64476f7065324b600103bc7234164bcb2a37767cd472ad2d9b02b6c13121587910248abeef

Download Submit
C:\Windows\system32\consrv.DLL

Filesize
31KB

MD5
dafc4a53954b76c5db1d857e955f3805

SHA1
a18fa0d38c6656b4398953e77e87eec3b0209ef3

SHA256
c6c82dde145a2dd9d70b1b539b17571befb663fc4a9ca834ff2a140cc4ebaa0b

SHA512
745e27a4f952e2492dbd12ced396be2c7dc78344ba415ad64b45920f95d7a282e30c7ad2da9266dc195c71e38019809e8183a705f9276c7d178de2f5ef34b633

Download Submit
\Users\Admin\AppData\Local\899c4414\X

Filesize
41KB

MD5
686b479b0ee164cf1744a8be359ebb7d

SHA1
8615e8f967276a85110b198d575982a958581a07

SHA256
fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

SHA512
7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
1ba7ae8b844f238b6e465e5eb0cc0c08

SHA1
406e7709a8479ec5d0c0d135b5de719bde0e041d

SHA256
dcd72539236d2a6823dac3e0348297540d26cb274de4992c9179388b2e6e9e31

SHA512
589f21c67155915851d231205a5a607020938cc0922ff8dfd3e1827d0aea678bb18f10c52cc65b5344439766d3a1f77309e1f59233ddc60615220ef8a9c53765

Download Submit
memory/336-42-0x0000000000860000-0x000000000086C000-memory.dmp

Filesize
48KB

Download
memory/336-41-0x0000000000860000-0x000000000086C000-memory.dmp

Filesize
48KB

Download
memory/616-1-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/616-2-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/616-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/616-10-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1204-13-0x00000000029F0000-0x00000000029FB000-memory.dmp

Filesize
44KB

Download
memory/1204-30-0x00000000029F0000-0x00000000029FB000-memory.dmp

Filesize
44KB

Download
memory/1204-35-0x0000000002A00000-0x0000000002A0B000-memory.dmp

Filesize
44KB

Download
memory/1204-22-0x00000000029F0000-0x00000000029FB000-memory.dmp

Filesize
44KB

Download
memory/1204-16-0x0000000002260000-0x0000000002268000-memory.dmp

Filesize
32KB

Download
memory/1204-43-0x0000000002A00000-0x0000000002A0B000-memory.dmp

Filesize
44KB

Download
memory/1556-33-0x0000000001B20000-0x0000000001B34000-memory.dmp

Filesize
80KB

Download
memory/1556-25-0x0000000001B20000-0x0000000001B34000-memory.dmp

Filesize
80KB

Download
memory/1556-11-0x0000000001B20000-0x0000000001B34000-memory.dmp

Filesize
80KB

Download
memory/1556-14-0x00000000000E0000-0x00000000000F2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads