10cdd823e426c28b37517482c4ddb608faef7834ffd32e48354a4b8e9399e939

General

Target

2ca1618545eb11ef6acb9b63b058ec83.exe
Size

47KB
MD5

2ca1618545eb11ef6acb9b63b058ec83
SHA1

70c6dd788adc1891dd3e314f1737f455a96f4224
SHA256

10cdd823e426c28b37517482c4ddb608faef7834ffd32e48354a4b8e9399e939
SHA512

f0e16e90256c5f8eb6f8f56f143c9179deaa8b63089654f7819d8cad71f89d02dcfafd2cb4ac0d486d109a4bb1dfb2451c60c960a577c05d8cb40e49706056c9
SSDEEP

768:dyLXJPmMEzQxH9fW6QVYl5hXf6MM/vTAO7n0LnF86jZw:dyLXs3IH9foSl5hXfjM/vTR7n0u6jZw

Score

7^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0004000000004ed7-5.dat	acprotect

Deletes itself 1 IoCs

pid	Process
2668	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2668	svchost.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0004000000004ed7-5.dat	upx
behavioral1/memory/2668-8-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2668-9-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2668-10-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2668-13-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2668-16-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2668-17-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	2ca1618545eb11ef6acb9b63b058ec83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr	2ca1618545eb11ef6acb9b63b058ec83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\DLLName = "sysfldr.dll"	2ca1618545eb11ef6acb9b63b058ec83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\Startup = "Startup"	2ca1618545eb11ef6acb9b63b058ec83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\Srv = "ZHh4fDYjI35paGdjfyJvY2Ej"	2ca1618545eb11ef6acb9b63b058ec83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\SrvUp = "ZHh4fDYjI35paGdjfyJvY2Ej"	2ca1618545eb11ef6acb9b63b058ec83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\ver = "15"	2ca1618545eb11ef6acb9b63b058ec83.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr	2ca1618545eb11ef6acb9b63b058ec83.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sysfldr.dll	2ca1618545eb11ef6acb9b63b058ec83.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2596 set thread context of 2668	2596	2ca1618545eb11ef6acb9b63b058ec83.exe	29

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2668	2596	2ca1618545eb11ef6acb9b63b058ec83.exe	29
PID 2596 wrote to memory of 2668	2596	2ca1618545eb11ef6acb9b63b058ec83.exe	29
PID 2596 wrote to memory of 2668	2596	2ca1618545eb11ef6acb9b63b058ec83.exe	29
PID 2596 wrote to memory of 2668	2596	2ca1618545eb11ef6acb9b63b058ec83.exe	29
PID 2596 wrote to memory of 2668	2596	2ca1618545eb11ef6acb9b63b058ec83.exe	29

C:\Users\Admin\AppData\Local\Temp\2ca1618545eb11ef6acb9b63b058ec83.exe
"C:\Users\Admin\AppData\Local\Temp\2ca1618545eb11ef6acb9b63b058ec83.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sysfldr.dll

Filesize
12KB

MD5
9781e334e4e2e4388f6f4e64d9a78edd

SHA1
fa5ab99f507af9f99907496e7471ac923b7300b8

SHA256
17c16775ddbdbb5345a9e8158dccbdeb9c2ef55f4f6b95df638cfec4c266a298

SHA512
690e098d231b87d99dac3755b7e4c37343c778fb4037ff1dd5668baaaee1dee74d5a6391e87114db29eaefe6b8f87c67e09c4cdbf67c39162ca5af1997cc1f3d

Download Submit
memory/2596-0-0x0000000013120000-0x000000001315A000-memory.dmp

Filesize
232KB

Download
memory/2596-4-0x0000000013120000-0x000000001315A000-memory.dmp

Filesize
232KB

Download
memory/2668-2-0x0000000013140000-0x000000001314C000-memory.dmp

Filesize
48KB

Download
memory/2668-6-0x0000000013140000-0x000000001314C000-memory.dmp

Filesize
48KB

Download
memory/2668-8-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2668-9-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2668-10-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2668-13-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2668-16-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2668-17-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads