b4a027a076dedcf298f7d698247c4e421cd99ee4631968ccd6b3cd95149a9f37

General

Target

255c477720714631ab83f35df3a57e2e.exe
Size

495KB
MD5

255c477720714631ab83f35df3a57e2e
SHA1

4744210bbfe19bbc5f7228b4e082713a74ffdd37
SHA256

b4a027a076dedcf298f7d698247c4e421cd99ee4631968ccd6b3cd95149a9f37
SHA512

4004f30b3b67f97826ddbac4169e85b8b81ad627d39326b218f99e1a55ffc3ea72c42672d522175ca8d7e62f1292ea5d8cd8c1df83aec5ccd82f9821d627e23c
SSDEEP

12288:ON2i+m+iPsCC3uF3Z4mxx9oQkA/F4qaYP:Vm+qsCC+QmX95jf

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3588	255c477720714631ab83f35df3a57e2e.exe
3588	255c477720714631ab83f35df3a57e2e.exe

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS\DllName = "C:\\Windows\\System32\\Systen.dll"	255c477720714631ab83f35df3a57e2e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS\Startup = "ServiceMain"	255c477720714631ab83f35df3a57e2e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS	255c477720714631ab83f35df3a57e2e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	255c477720714631ab83f35df3a57e2e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS	255c477720714631ab83f35df3a57e2e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS\Asynchronous = "1"	255c477720714631ab83f35df3a57e2e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS\Impersonate = "0"	255c477720714631ab83f35df3a57e2e.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Systen.dll	255c477720714631ab83f35df3a57e2e.exe
File created	C:\Windows\SysWOW64\Systen.dll	255c477720714631ab83f35df3a57e2e.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\240667890.dll	255c477720714631ab83f35df3a57e2e.exe
File created	C:\Windows\240670500.bat	255c477720714631ab83f35df3a57e2e.exe
File created	C:\Windows\240671281.bat	255c477720714631ab83f35df3a57e2e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3588	255c477720714631ab83f35df3a57e2e.exe
3588	255c477720714631ab83f35df3a57e2e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	255c477720714631ab83f35df3a57e2e.exe
Token: SeDebugPrivilege	3588	255c477720714631ab83f35df3a57e2e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 632	3588	255c477720714631ab83f35df3a57e2e.exe	3
PID 3588 wrote to memory of 2564	3588	255c477720714631ab83f35df3a57e2e.exe	91
PID 3588 wrote to memory of 2564	3588	255c477720714631ab83f35df3a57e2e.exe	91
PID 3588 wrote to memory of 2564	3588	255c477720714631ab83f35df3a57e2e.exe	91
PID 3588 wrote to memory of 4896	3588	255c477720714631ab83f35df3a57e2e.exe	92
PID 3588 wrote to memory of 4896	3588	255c477720714631ab83f35df3a57e2e.exe	92
PID 3588 wrote to memory of 4896	3588	255c477720714631ab83f35df3a57e2e.exe	92

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632

C:\Users\Admin\AppData\Local\Temp\255c477720714631ab83f35df3a57e2e.exe
"C:\Users\Admin\AppData\Local\Temp\255c477720714631ab83f35df3a57e2e.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\240670500.bat" C:\Windows\240667~1.DLL"
  2⤵
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\240671281.bat" C:\Users\Admin\AppData\Local\Temp\255C47~1.EXE"
  2⤵
  PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\240667890.dll

Filesize
371KB

MD5
24693d9b784480c30e6e644cd13343fd

SHA1
aa39376fd000ac88aa7834dde98b349d4a6dab51

SHA256
03b60e59e252cb9a488c80f73261044bef52974940d7fcd324eb1969215ffad7

SHA512
21e15405a8b807c529f20ca93fc227c479fa2d9eae629cb54f3a82c46d7f23785e65c80167e808d1c93f42eec6f191dbbad219ec9e68d8e4fcdc6aa440c5b495

Download Submit
C:\Windows\240670500.bat

Filesize
55B

MD5
6e8746e34abb1a9fe60e344ccd504f8f

SHA1
2d758f13f47e6e70c526c006ab62f6c54e58fc88

SHA256
e4ad97c9c116b065cc796b301c561878325b66072dcc62ab8019c4060170adea

SHA512
30344a8c73e1c2f456532249b8cd7160aef24b870dd1da53023ab480e2c5f87ef660096d06e1fd589a71115ec280d058b949de42439fe6153cf47334cc2e3e11

Download Submit
memory/3588-12-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/3588-10-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/3588-4-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/3588-5-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/3588-7-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3588-9-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/3588-8-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/3588-15-0x0000000003470000-0x0000000003472000-memory.dmp

Filesize
8KB

Download
memory/3588-14-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/3588-13-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/3588-3-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3588-0-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3588-11-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/3588-16-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3588-17-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/3588-2-0x0000000002270000-0x00000000022C4000-memory.dmp

Filesize
336KB

Download
memory/3588-21-0x0000000003660000-0x00000000036C5000-memory.dmp

Filesize
404KB

Download
memory/3588-32-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/3588-33-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/3588-1-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3588-37-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3588-38-0x0000000003660000-0x00000000036C5000-memory.dmp

Filesize
404KB

Download
memory/3588-39-0x0000000002270000-0x00000000022C4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads