863bc4b2312d434765e5f6139a78aef5d1129f7b5993743dd3ebe575b717a23a

Analysis

max time kernel
182s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

599ca8f5851b74665fe15d98671d1158.exe
Size

156KB
MD5

599ca8f5851b74665fe15d98671d1158
SHA1

30ceb0fb944446500e183c37d8f856c8cfa7a4ae
SHA256

863bc4b2312d434765e5f6139a78aef5d1129f7b5993743dd3ebe575b717a23a
SHA512

914922a3b279cd0190e591f8e31b8b8e8c7a5d8c4ca41c95de753dd147525109d2617cec6b32b4eeb06adb9cdb5c07c7266937223a82d2893001140a46d99a85
SSDEEP

3072:JYtZ4CBsZb283TRqEba572VGQfjAdQPY+QF4YO+Lh:Jlm6TRqEba57DQfMdQAT5X

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\sdra64.exe,"	599ca8f5851b74665fe15d98671d1158.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	599ca8f5851b74665fe15d98671d1158.exe

Disables Task Manager via registry modification
evasion

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sdra64.exe	599ca8f5851b74665fe15d98671d1158.exe
File created	C:\Windows\SysWOW64\sdra64.exe	599ca8f5851b74665fe15d98671d1158.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 3992	2220	599ca8f5851b74665fe15d98671d1158.exe	94

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3992	599ca8f5851b74665fe15d98671d1158.exe
3992	599ca8f5851b74665fe15d98671d1158.exe
3992	599ca8f5851b74665fe15d98671d1158.exe
3992	599ca8f5851b74665fe15d98671d1158.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3992	599ca8f5851b74665fe15d98671d1158.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2220	599ca8f5851b74665fe15d98671d1158.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 3992	2220	599ca8f5851b74665fe15d98671d1158.exe	94
PID 2220 wrote to memory of 3992	2220	599ca8f5851b74665fe15d98671d1158.exe	94
PID 2220 wrote to memory of 3992	2220	599ca8f5851b74665fe15d98671d1158.exe	94
PID 2220 wrote to memory of 3992	2220	599ca8f5851b74665fe15d98671d1158.exe	94
PID 2220 wrote to memory of 3992	2220	599ca8f5851b74665fe15d98671d1158.exe	94
PID 2220 wrote to memory of 3992	2220	599ca8f5851b74665fe15d98671d1158.exe	94
PID 2220 wrote to memory of 3992	2220	599ca8f5851b74665fe15d98671d1158.exe	94
PID 2220 wrote to memory of 3992	2220	599ca8f5851b74665fe15d98671d1158.exe	94
PID 2220 wrote to memory of 2580	2220	599ca8f5851b74665fe15d98671d1158.exe	95
PID 2220 wrote to memory of 2580	2220	599ca8f5851b74665fe15d98671d1158.exe	95
PID 2220 wrote to memory of 2580	2220	599ca8f5851b74665fe15d98671d1158.exe	95
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 2580 wrote to memory of 1104	2580	net.exe	97
PID 2580 wrote to memory of 1104	2580	net.exe	97
PID 2580 wrote to memory of 1104	2580	net.exe	97
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3
PID 3992 wrote to memory of 612	3992	599ca8f5851b74665fe15d98671d1158.exe	3

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Users\Admin\AppData\Local\Temp\599ca8f5851b74665fe15d98671d1158.exe
"C:\Users\Admin\AppData\Local\Temp\599ca8f5851b74665fe15d98671d1158.exe"
1⤵
- Disables RegEdit via registry modification
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\599ca8f5851b74665fe15d98671d1158.exe
  C:\Users\Admin\AppData\Local\Temp\599ca8f5851b74665fe15d98671d1158.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3992
- C:\Windows\SysWOW64\net.exe
  net stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sharedaccess
    3⤵
    PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-16-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/612-21-0x000000000C6D0000-0x000000000C6E9000-memory.dmp

Filesize
100KB

Download
memory/612-26-0x000000000C6F0000-0x000000000C709000-memory.dmp

Filesize
100KB

Download
memory/612-31-0x000000000C710000-0x000000000C729000-memory.dmp

Filesize
100KB

Download
memory/612-36-0x000000000C730000-0x000000000C749000-memory.dmp

Filesize
100KB

Download
memory/612-41-0x000000000C750000-0x000000000C769000-memory.dmp

Filesize
100KB

Download
memory/612-46-0x000000000C770000-0x000000000C789000-memory.dmp

Filesize
100KB

Download
memory/612-51-0x000000000C790000-0x000000000C7A9000-memory.dmp

Filesize
100KB

Download
memory/612-56-0x000000000C7B0000-0x000000000C7C9000-memory.dmp

Filesize
100KB

Download
memory/612-61-0x000000000C7D0000-0x000000000C7E9000-memory.dmp

Filesize
100KB

Download
memory/612-66-0x000000000C7F0000-0x000000000C809000-memory.dmp

Filesize
100KB

Download
memory/612-71-0x000000000C810000-0x000000000C829000-memory.dmp

Filesize
100KB

Download
memory/612-76-0x000000000C830000-0x000000000C849000-memory.dmp

Filesize
100KB

Download
memory/612-81-0x000000000C850000-0x000000000C869000-memory.dmp

Filesize
100KB

Download
memory/612-86-0x000000000C870000-0x000000000C889000-memory.dmp

Filesize
100KB

Download
memory/612-91-0x000000000C890000-0x000000000C8A9000-memory.dmp

Filesize
100KB

Download
memory/612-101-0x000000000C8D0000-0x000000000C8E9000-memory.dmp

Filesize
100KB

Download
memory/612-96-0x000000000C8B0000-0x000000000C8C9000-memory.dmp

Filesize
100KB

Download
memory/612-106-0x000000000C8F0000-0x000000000C909000-memory.dmp

Filesize
100KB

Download
memory/612-116-0x000000000C930000-0x000000000C949000-memory.dmp

Filesize
100KB

Download
memory/612-121-0x000000000C950000-0x000000000C969000-memory.dmp

Filesize
100KB

Download
memory/612-126-0x000000000C970000-0x000000000C989000-memory.dmp

Filesize
100KB

Download
memory/612-111-0x000000000C910000-0x000000000C929000-memory.dmp

Filesize
100KB

Download
memory/612-131-0x000000000C990000-0x000000000C9A9000-memory.dmp

Filesize
100KB

Download
memory/612-141-0x000000000C9D0000-0x000000000C9E9000-memory.dmp

Filesize
100KB

Download
memory/612-146-0x000000000C9F0000-0x000000000CA09000-memory.dmp

Filesize
100KB

Download
memory/612-151-0x000000000CA10000-0x000000000CA29000-memory.dmp

Filesize
100KB

Download
memory/612-136-0x000000000C9B0000-0x000000000C9C9000-memory.dmp

Filesize
100KB

Download
memory/612-156-0x000000000CA30000-0x000000000CA49000-memory.dmp

Filesize
100KB

Download
memory/612-161-0x000000000CA50000-0x000000000CA69000-memory.dmp

Filesize
100KB

Download
memory/612-166-0x000000000CA70000-0x000000000CA89000-memory.dmp

Filesize
100KB

Download
memory/612-176-0x000000000CAB0000-0x000000000CAC9000-memory.dmp

Filesize
100KB

Download
memory/612-181-0x000000000CAD0000-0x000000000CAE9000-memory.dmp

Filesize
100KB

Download
memory/612-186-0x000000000CAF0000-0x000000000CB09000-memory.dmp

Filesize
100KB

Download
memory/612-191-0x000000000CB10000-0x000000000CB29000-memory.dmp

Filesize
100KB

Download
memory/612-196-0x000000000CB30000-0x000000000CB49000-memory.dmp

Filesize
100KB

Download
memory/612-201-0x000000000CB50000-0x000000000CB69000-memory.dmp

Filesize
100KB

Download
memory/612-171-0x000000000CA90000-0x000000000CAA9000-memory.dmp

Filesize
100KB

Download
memory/612-211-0x000000000CB90000-0x000000000CBA9000-memory.dmp

Filesize
100KB

Download
memory/612-216-0x000000000CBB0000-0x000000000CBC9000-memory.dmp

Filesize
100KB

Download
memory/612-206-0x000000000CB70000-0x000000000CB89000-memory.dmp

Filesize
100KB

Download
memory/612-226-0x000000000CBF0000-0x000000000CC09000-memory.dmp

Filesize
100KB

Download
memory/612-231-0x000000000CC10000-0x000000000CC29000-memory.dmp

Filesize
100KB

Download
memory/612-221-0x000000000CBD0000-0x000000000CBE9000-memory.dmp

Filesize
100KB

Download
memory/612-241-0x000000000CC50000-0x000000000CC69000-memory.dmp

Filesize
100KB

Download
memory/612-246-0x000000000CC70000-0x000000000CC89000-memory.dmp

Filesize
100KB

Download
memory/612-251-0x000000000CC90000-0x000000000CCA9000-memory.dmp

Filesize
100KB

Download
memory/612-261-0x000000000CCD0000-0x000000000CCE9000-memory.dmp

Filesize
100KB

Download
memory/612-266-0x000000000CCF0000-0x000000000CD09000-memory.dmp

Filesize
100KB

Download
memory/612-271-0x000000000CD10000-0x000000000CD29000-memory.dmp

Filesize
100KB

Download
memory/612-276-0x000000000CD30000-0x000000000CD49000-memory.dmp

Filesize
100KB

Download
memory/612-281-0x000000000CD50000-0x000000000CD69000-memory.dmp

Filesize
100KB

Download
memory/612-256-0x000000000CCB0000-0x000000000CCC9000-memory.dmp

Filesize
100KB

Download
memory/612-286-0x000000000CD70000-0x000000000CD89000-memory.dmp

Filesize
100KB

Download
memory/612-291-0x000000000CD90000-0x000000000CDA9000-memory.dmp

Filesize
100KB

Download
memory/612-301-0x000000000CDD0000-0x000000000CDE9000-memory.dmp

Filesize
100KB

Download
memory/612-306-0x000000000CDF0000-0x000000000CE09000-memory.dmp

Filesize
100KB

Download
memory/612-311-0x000000000CE10000-0x000000000CE29000-memory.dmp

Filesize
100KB

Download
memory/612-296-0x000000000CDB0000-0x000000000CDC9000-memory.dmp

Filesize
100KB

Download
memory/612-236-0x000000000CC30000-0x000000000CC49000-memory.dmp

Filesize
100KB

Download
memory/3992-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3992-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3992-6-0x0000000000580000-0x0000000000593000-memory.dmp

Filesize
76KB

Download
memory/3992-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3992-3151-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download