2b18ddb5377e8f8dee46667d360bede5d09a5e1d047ae99993d04e4f81840d51

General

Target

0e3f138b3083f07d9c282ead13952414.exe
Size

242KB
MD5

0e3f138b3083f07d9c282ead13952414
SHA1

735ed22fd571500fee32d49a2b25bd72c83a87ae
SHA256

2b18ddb5377e8f8dee46667d360bede5d09a5e1d047ae99993d04e4f81840d51
SHA512

ccb77e566485e037e33fb48630804b826a68c823a61ce738d708405376657b504107d9c1f9ae1c0e7ef9111c93e484e9a465c3ec68500a9619bdfa2751e905ae
SSDEEP

6144:udXRrRvv7YdAh4qIDvzJvPSjGnuopYmK/i2amfD:u7Rvv8dSBIDvzxPOMuo3X2a4D

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\9b7b7593\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
3004	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
336	csrss.exe
2740	X

Loads dropped DLL 2 IoCs

pid	Process
1732	0e3f138b3083f07d9c282ead13952414.exe
1732	0e3f138b3083f07d9c282ead13952414.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 3004	1732	0e3f138b3083f07d9c282ead13952414.exe	29

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{1a74ef5b-e0c8-3427-8f23-6f47e43457d2}	0e3f138b3083f07d9c282ead13952414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1a74ef5b-e0c8-3427-8f23-6f47e43457d2}\u = "71"	0e3f138b3083f07d9c282ead13952414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1a74ef5b-e0c8-3427-8f23-6f47e43457d2}\cid = "3971657687634138720"	0e3f138b3083f07d9c282ead13952414.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1732	0e3f138b3083f07d9c282ead13952414.exe
1732	0e3f138b3083f07d9c282ead13952414.exe
1732	0e3f138b3083f07d9c282ead13952414.exe
1732	0e3f138b3083f07d9c282ead13952414.exe
2740	X

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	0e3f138b3083f07d9c282ead13952414.exe
Token: SeDebugPrivilege	1732	0e3f138b3083f07d9c282ead13952414.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1068	1732	0e3f138b3083f07d9c282ead13952414.exe	14
PID 1732 wrote to memory of 336	1732	0e3f138b3083f07d9c282ead13952414.exe	26
PID 1732 wrote to memory of 2740	1732	0e3f138b3083f07d9c282ead13952414.exe	28
PID 1732 wrote to memory of 2740	1732	0e3f138b3083f07d9c282ead13952414.exe	28
PID 1732 wrote to memory of 2740	1732	0e3f138b3083f07d9c282ead13952414.exe	28
PID 1732 wrote to memory of 2740	1732	0e3f138b3083f07d9c282ead13952414.exe	28
PID 2740 wrote to memory of 1068	2740	X	14
PID 1732 wrote to memory of 3004	1732	0e3f138b3083f07d9c282ead13952414.exe	29
PID 1732 wrote to memory of 3004	1732	0e3f138b3083f07d9c282ead13952414.exe	29
PID 1732 wrote to memory of 3004	1732	0e3f138b3083f07d9c282ead13952414.exe	29
PID 1732 wrote to memory of 3004	1732	0e3f138b3083f07d9c282ead13952414.exe	29
PID 1732 wrote to memory of 3004	1732	0e3f138b3083f07d9c282ead13952414.exe	29
PID 336 wrote to memory of 2872	336	csrss.exe	31
PID 336 wrote to memory of 2872	336	csrss.exe	31
PID 336 wrote to memory of 3000	336	csrss.exe	32
PID 336 wrote to memory of 3000	336	csrss.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1068
- C:\Users\Admin\AppData\Local\Temp\0e3f138b3083f07d9c282ead13952414.exe
  "C:\Users\Admin\AppData\Local\Temp\0e3f138b3083f07d9c282ead13952414.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\9b7b7593\X
    *0*47*c8e1d660*69.64.52.10:53
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:3004

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2872

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\System32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
7ca6d96ae52cecbf0b75dd4ab649ce60

SHA1
0c3ef4381c1aa9fff4991551198fe79161fb6b9d

SHA256
27ab6f2c36236bcf63ac48b110428ded2dc09d2cb5e2eccefdf594f5ef42dcd6

SHA512
24b95dd03d7f92b27c1ec49de995eb132df124e29519db74785ab6a9f22ac3c0d1a6b5a0d28875ec416906b548fd1cbb5a33c2df2fec9b021f88274a861806b9

Download Submit
memory/336-21-0x0000000000E10000-0x0000000000E1B000-memory.dmp

Filesize
44KB

Download
memory/336-41-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/336-16-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/336-20-0x0000000000E10000-0x0000000000E1B000-memory.dmp

Filesize
44KB

Download
memory/1068-36-0x0000000002DB0000-0x0000000002DBB000-memory.dmp

Filesize
44KB

Download
memory/1068-5-0x00000000025F0000-0x00000000025F2000-memory.dmp

Filesize
8KB

Download
memory/1068-32-0x0000000002DB0000-0x0000000002DBB000-memory.dmp

Filesize
44KB

Download
memory/1068-12-0x0000000002B10000-0x0000000002B16000-memory.dmp

Filesize
24KB

Download
memory/1068-37-0x0000000002DC0000-0x0000000002DCB000-memory.dmp

Filesize
44KB

Download
memory/1068-38-0x0000000002DC0000-0x0000000002DCB000-memory.dmp

Filesize
44KB

Download
memory/1068-8-0x0000000002B10000-0x0000000002B16000-memory.dmp

Filesize
24KB

Download
memory/1068-28-0x0000000002DB0000-0x0000000002DBB000-memory.dmp

Filesize
44KB

Download
memory/1068-3-0x0000000002B10000-0x0000000002B16000-memory.dmp

Filesize
24KB

Download
memory/1732-39-0x0000000030670000-0x00000000306C4000-memory.dmp

Filesize
336KB

Download
memory/1732-40-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/1732-2-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/1732-43-0x0000000030670000-0x00000000306C4000-memory.dmp

Filesize
336KB

Download
memory/1732-1-0x0000000030670000-0x00000000306C4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads