7cfe55870559fc1834fc0f383001f75c373d701e794bcae2121fa2ca61538f06

General

Target

0308e4b5aea42101bd4694d277279553.exe
Size

247KB
MD5

0308e4b5aea42101bd4694d277279553
SHA1

d0a80d2cc0c60311f59aca22ffb7954342460e2e
SHA256

7cfe55870559fc1834fc0f383001f75c373d701e794bcae2121fa2ca61538f06
SHA512

12ec74eed3ca2152ce55d1bfc8f9943058d69cae61053a6345f2b0fed9217823e968fecfef4faa419e360b57d6b2c097c7c0035d8761b1b5d72df35da491a044
SSDEEP

6144:LLf7GEIC/+gEYMKd1UGg80wcFPnvt7eaxj7WqK:L774CGgBd+zPrhvMo7Wq

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\c1d0fc3f\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
2196	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
2840	X
340	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
1276	0308e4b5aea42101bd4694d277279553.exe
1276	0308e4b5aea42101bd4694d277279553.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 2196	1276	0308e4b5aea42101bd4694d277279553.exe	19

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{a873d410-6fd3-1b1c-08a3-ea6185436e1c}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a873d410-6fd3-1b1c-08a3-ea6185436e1c}\u = "134"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a873d410-6fd3-1b1c-08a3-ea6185436e1c}\cid = "2463796883436466096"	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2840	X
2196	explorer.exe
2196	explorer.exe
2196	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	explorer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1376	Explorer.EXE
1376	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1376	Explorer.EXE
1376	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
340	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2196	1276	0308e4b5aea42101bd4694d277279553.exe	19
PID 1276 wrote to memory of 2196	1276	0308e4b5aea42101bd4694d277279553.exe	19
PID 1276 wrote to memory of 2196	1276	0308e4b5aea42101bd4694d277279553.exe	19
PID 1276 wrote to memory of 2196	1276	0308e4b5aea42101bd4694d277279553.exe	19
PID 1276 wrote to memory of 2196	1276	0308e4b5aea42101bd4694d277279553.exe	19
PID 1276 wrote to memory of 2840	1276	0308e4b5aea42101bd4694d277279553.exe	18
PID 1276 wrote to memory of 2840	1276	0308e4b5aea42101bd4694d277279553.exe	18
PID 1276 wrote to memory of 2840	1276	0308e4b5aea42101bd4694d277279553.exe	18
PID 1276 wrote to memory of 2840	1276	0308e4b5aea42101bd4694d277279553.exe	18
PID 2840 wrote to memory of 1376	2840	X	3
PID 2196 wrote to memory of 340	2196	explorer.exe	28
PID 340 wrote to memory of 2800	340	csrss.exe	30
PID 340 wrote to memory of 2800	340	csrss.exe	30
PID 340 wrote to memory of 1648	340	csrss.exe	31
PID 340 wrote to memory of 1648	340	csrss.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1376
- C:\Users\Admin\AppData\Local\Temp\0308e4b5aea42101bd4694d277279553.exe
  "C:\Users\Admin\AppData\Local\Temp\0308e4b5aea42101bd4694d277279553.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\c1d0fc3f\X
    193.105.154.210:80
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2840
- - C:\Windows\explorer.exe
    000000B8*
    3⤵
    - Deletes itself
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2196

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2800

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\c1d0fc3f\X

Filesize
41KB

MD5
686b479b0ee164cf1744a8be359ebb7d

SHA1
8615e8f967276a85110b198d575982a958581a07

SHA256
fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

SHA512
7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

Download Submit
memory/340-40-0x0000000002380000-0x000000000238C000-memory.dmp

Filesize
48KB

Download
memory/340-41-0x0000000002380000-0x000000000238C000-memory.dmp

Filesize
48KB

Download
memory/1276-42-0x0000000000400000-0x0000000000449688-memory.dmp

Filesize
293KB

Download
memory/1276-3-0x0000000000400000-0x0000000000449688-memory.dmp

Filesize
293KB

Download
memory/1276-10-0x0000000000878000-0x00000000008A9000-memory.dmp

Filesize
196KB

Download
memory/1376-12-0x0000000002960000-0x000000000296B000-memory.dmp

Filesize
44KB

Download
memory/1376-23-0x0000000002960000-0x000000000296B000-memory.dmp

Filesize
44KB

Download
memory/1376-34-0x0000000002970000-0x000000000297B000-memory.dmp

Filesize
44KB

Download
memory/1376-13-0x0000000002950000-0x0000000002958000-memory.dmp

Filesize
32KB

Download
memory/1376-18-0x0000000002960000-0x000000000296B000-memory.dmp

Filesize
44KB

Download
memory/1376-43-0x0000000002970000-0x000000000297B000-memory.dmp

Filesize
44KB

Download
memory/2196-27-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/2196-33-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/2196-9-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/2196-15-0x0000000000060000-0x0000000000072000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads