ec93dd2c8432d31d3be69a3538a20fd344090246dd7289a2db829d9048ce9b5e

General

Target

40c4b11105db1386e30bc870183a6499.exe
Size

354KB
MD5

40c4b11105db1386e30bc870183a6499
SHA1

c91b01612d0a67a9200a6f0780d554a5c1e321fd
SHA256

ec93dd2c8432d31d3be69a3538a20fd344090246dd7289a2db829d9048ce9b5e
SHA512

70fb8f93c6c48cd890990ccb3a8ae85851ba44e94c294cf4aa1760bcdc20daae3e77ad381fbb699e1eb473223643d518f0c47a8955d9f1d700ace5128a575c59
SSDEEP

6144:I2pRrUqddTQZokHv1rQJvnRIAYjY35AiZkpoks5UF1Sf5jGPW2LdMgDbq6nk1/3i:IqUudBkP1UJZIIJpkDrF1SoP/dTBk1/3

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\899c4414\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
1100	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
336	csrss.exe
2736	X

Loads dropped DLL 2 IoCs

pid	Process
2436	40c4b11105db1386e30bc870183a6499.exe
2436	40c4b11105db1386e30bc870183a6499.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2436 set thread context of 1100	2436	40c4b11105db1386e30bc870183a6499.exe	31

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{c96b3a43-c658-568e-e4a7-36c2600cc942}	40c4b11105db1386e30bc870183a6499.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c96b3a43-c658-568e-e4a7-36c2600cc942}\u = "73"	40c4b11105db1386e30bc870183a6499.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c96b3a43-c658-568e-e4a7-36c2600cc942}\cid = "7465635361227439653"	40c4b11105db1386e30bc870183a6499.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2436	40c4b11105db1386e30bc870183a6499.exe
2436	40c4b11105db1386e30bc870183a6499.exe
2436	40c4b11105db1386e30bc870183a6499.exe
2436	40c4b11105db1386e30bc870183a6499.exe
2736	X

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	40c4b11105db1386e30bc870183a6499.exe
Token: SeDebugPrivilege	2436	40c4b11105db1386e30bc870183a6499.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1272	2436	40c4b11105db1386e30bc870183a6499.exe	16
PID 2436 wrote to memory of 336	2436	40c4b11105db1386e30bc870183a6499.exe	1
PID 336 wrote to memory of 2716	336	csrss.exe	28
PID 336 wrote to memory of 2716	336	csrss.exe	28
PID 336 wrote to memory of 2680	336	csrss.exe	29
PID 336 wrote to memory of 2680	336	csrss.exe	29
PID 2436 wrote to memory of 2736	2436	40c4b11105db1386e30bc870183a6499.exe	30
PID 2436 wrote to memory of 2736	2436	40c4b11105db1386e30bc870183a6499.exe	30
PID 2436 wrote to memory of 2736	2436	40c4b11105db1386e30bc870183a6499.exe	30
PID 2436 wrote to memory of 2736	2436	40c4b11105db1386e30bc870183a6499.exe	30
PID 2736 wrote to memory of 1272	2736	X	16
PID 2436 wrote to memory of 1100	2436	40c4b11105db1386e30bc870183a6499.exe	31
PID 2436 wrote to memory of 1100	2436	40c4b11105db1386e30bc870183a6499.exe	31
PID 2436 wrote to memory of 1100	2436	40c4b11105db1386e30bc870183a6499.exe	31
PID 2436 wrote to memory of 1100	2436	40c4b11105db1386e30bc870183a6499.exe	31
PID 2436 wrote to memory of 1100	2436	40c4b11105db1386e30bc870183a6499.exe	31

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1272
- C:\Users\Admin\AppData\Local\Temp\40c4b11105db1386e30bc870183a6499.exe
  "C:\Users\Admin\AppData\Local\Temp\40c4b11105db1386e30bc870183a6499.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Users\Admin\AppData\Local\899c4414\X
    176.53.17.23:80
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1100

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2716

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\899c4414\@

Filesize
2KB

MD5
07b881dd4b7648b78671e15221d5f4a3

SHA1
d27183d32a5e18b6580af5922c2217dd31280a6b

SHA256
d0a323c0edf7a82cb13089ecc3f5e8d30c4506da23df340f28845e841f29e5fc

SHA512
99c368f6b7f05f023309dc9a2c5fbdd5ded2e9b87b41e89386a0c5b6c80145f61585605e42602c1c4a23c9847562f55f17ae8f7cdde7a019345b6595b227c403

Download Submit
\Users\Admin\AppData\Local\899c4414\X

Filesize
41KB

MD5
686b479b0ee164cf1744a8be359ebb7d

SHA1
8615e8f967276a85110b198d575982a958581a07

SHA256
fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

SHA512
7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

Download Submit
\Windows\System32\consrv.dll

Filesize
31KB

MD5
dafc4a53954b76c5db1d857e955f3805

SHA1
a18fa0d38c6656b4398953e77e87eec3b0209ef3

SHA256
c6c82dde145a2dd9d70b1b539b17571befb663fc4a9ca834ff2a140cc4ebaa0b

SHA512
745e27a4f952e2492dbd12ced396be2c7dc78344ba415ad64b45920f95d7a282e30c7ad2da9266dc195c71e38019809e8183a705f9276c7d178de2f5ef34b633

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
17d0965c79a3343117c6fbee55f41896

SHA1
4b52d08815f293e2bab458b494ce8819943677b5

SHA256
f5f63222ae7af6e011aa450283bd389943acf33cce14a0536e8d7ce0d8ebc0a6

SHA512
412ab8d83aa9ff26638cfa69d3d09a88f6f1e9f5ac2d5465e49ffd15db2592231f2913d4b6d3c1ed22bb72f6325a92a5afb74154a51553d23467825763ec5ea1

Download Submit
memory/336-30-0x0000000000730000-0x000000000073C000-memory.dmp

Filesize
48KB

Download
memory/336-38-0x00000000029B0000-0x00000000029B2000-memory.dmp

Filesize
8KB

Download
memory/336-28-0x0000000000730000-0x000000000073C000-memory.dmp

Filesize
48KB

Download
memory/336-29-0x00000000029B0000-0x00000000029B2000-memory.dmp

Filesize
8KB

Download
memory/1272-54-0x0000000002A50000-0x0000000002A5B000-memory.dmp

Filesize
44KB

Download
memory/1272-20-0x00000000029B0000-0x00000000029B2000-memory.dmp

Filesize
8KB

Download
memory/1272-23-0x0000000002A50000-0x0000000002A56000-memory.dmp

Filesize
24KB

Download
memory/1272-57-0x0000000002A70000-0x0000000002A7B000-memory.dmp

Filesize
44KB

Download
memory/1272-12-0x0000000002A50000-0x0000000002A56000-memory.dmp

Filesize
24KB

Download
memory/1272-16-0x0000000002A50000-0x0000000002A56000-memory.dmp

Filesize
24KB

Download
memory/1272-55-0x0000000002A70000-0x0000000002A7B000-memory.dmp

Filesize
44KB

Download
memory/1272-50-0x0000000002A50000-0x0000000002A5B000-memory.dmp

Filesize
44KB

Download
memory/1272-45-0x0000000002A50000-0x0000000002A5B000-memory.dmp

Filesize
44KB

Download
memory/1272-46-0x00000000029A0000-0x00000000029A8000-memory.dmp

Filesize
32KB

Download
memory/1272-62-0x0000000002A70000-0x0000000002A7B000-memory.dmp

Filesize
44KB

Download
memory/2436-19-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/2436-35-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/2436-34-0x0000000000370000-0x00000000003A3000-memory.dmp

Filesize
204KB

Download
memory/2436-32-0x00000000007D0000-0x00000000008D0000-memory.dmp

Filesize
1024KB

Download
memory/2436-31-0x0000000000400000-0x0000000000466244-memory.dmp

Filesize
408KB

Download
memory/2436-1-0x0000000000400000-0x0000000000466244-memory.dmp

Filesize
408KB

Download
memory/2436-17-0x0000000000370000-0x00000000003A3000-memory.dmp

Filesize
204KB

Download
memory/2436-9-0x0000000000370000-0x00000000003A3000-memory.dmp

Filesize
204KB

Download
memory/2436-6-0x0000000000370000-0x00000000003A3000-memory.dmp

Filesize
204KB

Download
memory/2436-58-0x0000000000400000-0x0000000000466244-memory.dmp

Filesize
408KB

Download
memory/2436-60-0x0000000000370000-0x00000000003A3000-memory.dmp

Filesize
204KB

Download
memory/2436-61-0x0000000000400000-0x0000000000466244-memory.dmp

Filesize
408KB

Download
memory/2436-3-0x0000000000370000-0x00000000003A3000-memory.dmp

Filesize
204KB

Download
memory/2436-2-0x00000000007D0000-0x00000000008D0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads