46b5c6cb45a40435525accc5a1c769207a7586860741bd434d5cba8bc1639aa1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7518f584e1731ba3df2a3c743d5e1bae.exe
Size

8KB
MD5

7518f584e1731ba3df2a3c743d5e1bae
SHA1

aa519cc1e0daa9559797f9e0d7e1c5a4b6313d3e
SHA256

46b5c6cb45a40435525accc5a1c769207a7586860741bd434d5cba8bc1639aa1
SHA512

54c3e1b1ae9768fb6ba5d534ffb45ceb1071a6a0eddf10b5c0d38fa0101c15f8627b57a126ff9c7d7f4f00c84efbb62db5016b84694e8532b7c3fa41f2ea10dc
SSDEEP

96:eTMO+PNrOhw8etUiVduw6uQ7zxxpP6FMl/xCZFRrhebvgxE9fETmnJjMxuvI1vg5:s+1rOG8I/6fXdPJl/onzkHlJGuAq4du

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

conime.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Program Files\\Internet Explorer\\SIGNUP\\conime.exe"	conime.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2148-4-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/3044-7-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2148-8-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2148-21-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

conime.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\urlmon.dll	conime.exe
File opened for modification	C:\Windows\SysWOW64\down.dll	conime.exe

Drops file in Windows directory 1 IoCs

Processes:

conime.exe

description ioc process

File created C:\Windows\inf\ver.inf conime.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

7518f584e1731ba3df2a3c743d5e1bae.exe

pid process

3044 7518f584e1731ba3df2a3c743d5e1bae.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

7518f584e1731ba3df2a3c743d5e1bae.execonime.exe

pid process

3044 7518f584e1731ba3df2a3c743d5e1bae.exe
2148 conime.exe

description	ioc	process
File created	C:\Windows\inf\ver.inf	conime.exe

pid	process
3044	7518f584e1731ba3df2a3c743d5e1bae.exe

pid	process
3044	7518f584e1731ba3df2a3c743d5e1bae.exe
2148	conime.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7518f584e1731ba3df2a3c743d5e1bae.exe

description	pid	process	target process
PID 3044 wrote to memory of 2148	3044	7518f584e1731ba3df2a3c743d5e1bae.exe	conime.exe
PID 3044 wrote to memory of 2148	3044	7518f584e1731ba3df2a3c743d5e1bae.exe	conime.exe
PID 3044 wrote to memory of 2148	3044	7518f584e1731ba3df2a3c743d5e1bae.exe	conime.exe
PID 3044 wrote to memory of 2148	3044	7518f584e1731ba3df2a3c743d5e1bae.exe	conime.exe

C:\Users\Admin\AppData\Local\Temp\7518f584e1731ba3df2a3c743d5e1bae.exe
"C:\Users\Admin\AppData\Local\Temp\7518f584e1731ba3df2a3c743d5e1bae.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044

C:\Program Files\Internet Explorer\SIGNUP\conime.exe
"C:\Program Files\Internet Explorer\SIGNUP\conime.exe"
2⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2148-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2148-21-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3044-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3044-3-0x00000000001C0000-0x00000000001CB000-memory.dmp

Filesize
44KB

Download
memory/3044-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download