777e5668ddbca7ac83cd060c7d439b77ac2c478d56ea4e54a495f035466b5e8b

General

Target

0d3864ad40a03d360c6d8cd3d576683e.exe
Size

243KB
MD5

0d3864ad40a03d360c6d8cd3d576683e
SHA1

75c107e3d60e4092fd6b615a306276da2896ee91
SHA256

777e5668ddbca7ac83cd060c7d439b77ac2c478d56ea4e54a495f035466b5e8b
SHA512

f27592b9128ec74f3d7d39d196f08c996dc23a1b4d41407b89442b7fcda2faf4fe66b39d99f51067ce22a9556977ea0bf8471bb4036f924b75d10b9b7fb42b0c
SSDEEP

6144:K0sL59fW/FhMzWxK35o4PGMlYZWe9wz2ZHOSNUknAlsHMT2XlW:K0srfiFlxK35o4PGMEWjzwHnUH+lW

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\3a800af5\\X"	Explorer.EXE

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1060 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

csrss.exeX

pid process

336 csrss.exe
2668 X
Loads dropped DLL 2 IoCs

Processes:

0d3864ad40a03d360c6d8cd3d576683e.exe

pid process

1664 0d3864ad40a03d360c6d8cd3d576683e.exe
1664 0d3864ad40a03d360c6d8cd3d576683e.exe
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 69.64.52.10
Destination IP 69.64.52.10
Destination IP 69.64.52.10
Destination IP 69.64.52.10
Destination IP 69.64.52.10
Suspicious use of SetThreadContext 1 IoCs

Processes:

0d3864ad40a03d360c6d8cd3d576683e.exe

description pid process target process

PID 1664 set thread context of 1060 1664 0d3864ad40a03d360c6d8cd3d576683e.exe cmd.exe

pid	process
1060	cmd.exe

pid	process
336	csrss.exe
2668	X

description	ioc
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10

description	pid	process	target process
PID 1664 set thread context of 1060	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	cmd.exe

Modifies registry class 3 IoCs

Processes:

0d3864ad40a03d360c6d8cd3d576683e.exe

description	ioc	process
Key created	\registry\machine\Software\Classes\Interface\{717112e1-f980-f90b-05d8-7bcbd5430dc8}	0d3864ad40a03d360c6d8cd3d576683e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{717112e1-f980-f90b-05d8-7bcbd5430dc8}\u = "71"	0d3864ad40a03d360c6d8cd3d576683e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{717112e1-f980-f90b-05d8-7bcbd5430dc8}\cid = "16544501993602162455"	0d3864ad40a03d360c6d8cd3d576683e.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

0d3864ad40a03d360c6d8cd3d576683e.exeX

pid	process
1664	0d3864ad40a03d360c6d8cd3d576683e.exe
1664	0d3864ad40a03d360c6d8cd3d576683e.exe
1664	0d3864ad40a03d360c6d8cd3d576683e.exe
1664	0d3864ad40a03d360c6d8cd3d576683e.exe
2668	X

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0d3864ad40a03d360c6d8cd3d576683e.exe

description pid process

Token: SeDebugPrivilege 1664 0d3864ad40a03d360c6d8cd3d576683e.exe
Token: SeDebugPrivilege 1664 0d3864ad40a03d360c6d8cd3d576683e.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

csrss.exe

pid process

336 csrss.exe

description	pid	process
Token: SeDebugPrivilege	1664	0d3864ad40a03d360c6d8cd3d576683e.exe
Token: SeDebugPrivilege	1664	0d3864ad40a03d360c6d8cd3d576683e.exe

pid	process
336	csrss.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

0d3864ad40a03d360c6d8cd3d576683e.exeXcsrss.exe

description	pid	process	target process
PID 1664 wrote to memory of 1240	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	Explorer.EXE
PID 1664 wrote to memory of 336	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	csrss.exe
PID 1664 wrote to memory of 2668	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	X
PID 1664 wrote to memory of 2668	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	X
PID 1664 wrote to memory of 2668	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	X
PID 1664 wrote to memory of 2668	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	X
PID 2668 wrote to memory of 1240	2668	X	Explorer.EXE
PID 336 wrote to memory of 2596	336	csrss.exe	WMIADAP.EXE
PID 336 wrote to memory of 2596	336	csrss.exe	WMIADAP.EXE
PID 336 wrote to memory of 2672	336	csrss.exe	wmiprvse.exe
PID 336 wrote to memory of 2672	336	csrss.exe	wmiprvse.exe
PID 1664 wrote to memory of 1060	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	cmd.exe
PID 1664 wrote to memory of 1060	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	cmd.exe
PID 1664 wrote to memory of 1060	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	cmd.exe
PID 1664 wrote to memory of 1060	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	cmd.exe
PID 1664 wrote to memory of 1060	1664	0d3864ad40a03d360c6d8cd3d576683e.exe	cmd.exe

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1240

C:\Users\Admin\AppData\Local\Temp\0d3864ad40a03d360c6d8cd3d576683e.exe
"C:\Users\Admin\AppData\Local\Temp\0d3864ad40a03d360c6d8cd3d576683e.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664

C:\Users\Admin\AppData\Local\3a800af5\X
*0*47*1a661f17*69.64.52.10:53
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Deletes itself
PID:1060

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2596

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2672

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll
Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\Users\Admin\AppData\Local\3a800af5\X
Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
Filesize
2KB

MD5
6d951e3060a4230faed02de1efbb3633

SHA1
af0ae41a50d315cc2d568e02cde637b99965afd0

SHA256
7c080c5c7017d7a18393a384a8997062fca72d87f060f61ad436359a485fd17c

SHA512
29efa6077e9a2f3ea43d724d7a94971717df3f4846850b380ad689a98e06164e85a434b96eb6b5bd341310d0ebcafc746bf0ff4b5c76d3a89e0fee1682b9168a

Download Submit
memory/336-20-0x00000000021F0000-0x00000000021F2000-memory.dmp

Filesize
8KB

Download
memory/336-43-0x00000000021F0000-0x00000000021F2000-memory.dmp

Filesize
8KB

Download
memory/336-26-0x0000000000AB0000-0x0000000000ABB000-memory.dmp

Filesize
44KB

Download
memory/336-18-0x0000000000AB0000-0x0000000000ABB000-memory.dmp

Filesize
44KB

Download
memory/1240-28-0x0000000002560000-0x000000000256B000-memory.dmp

Filesize
44KB

Download
memory/1240-37-0x0000000002560000-0x000000000256B000-memory.dmp

Filesize
44KB

Download
memory/1240-3-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/1240-45-0x00000000021E0000-0x00000000021EB000-memory.dmp

Filesize
44KB

Download
memory/1240-29-0x0000000002200000-0x0000000002208000-memory.dmp

Filesize
32KB

Download
memory/1240-7-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/1240-33-0x0000000002560000-0x000000000256B000-memory.dmp

Filesize
44KB

Download
memory/1240-12-0x00000000021F0000-0x00000000021F2000-memory.dmp

Filesize
8KB

Download
memory/1240-39-0x00000000021E0000-0x00000000021EB000-memory.dmp

Filesize
44KB

Download
memory/1240-11-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/1664-41-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download
memory/1664-40-0x0000000030670000-0x00000000306C6000-memory.dmp

Filesize
344KB

Download
memory/1664-44-0x0000000030670000-0x00000000306C6000-memory.dmp

Filesize
344KB

Download
memory/1664-1-0x0000000030670000-0x00000000306C6000-memory.dmp

Filesize
344KB

Download
memory/1664-2-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads