modiloader | 31b67352c4ea2611fe5624d87b0326d72215bd911c4be0aa695d8ea9a5d105a2

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82360730f84bbe5d42f252343b1dbc6c.exe
Size 917KB
Sample240130-mlkavafeap
SHA256 31b67352c4ea2611fe5624d87b0326d72215bd911c4be0aa695d8ea9a5d105a2
MD5 82360730f84bbe5d42f252343b1dbc6c
SHA1 304a952108fa2f02f61ee8d9c95c962029eae789
SHA512 78c1a9833e4e26cd452766a251c303ffd12daf509b99de2f743ff2e2ff40ff4e38c3cdb18ada0a092c617e0102c3d4d3be942cf13f86ac67a2d079ee1a5c6c10
SSDEEP 24576:oYuToG09UYjHa+MOVhi3u4U1IjLuLNuFKX4YH5SMwW+0R:UTn06Zy1IEuFZYtwW+0R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

ModiLoader Second Stage 19 IoCs

resource	yara_rule
behavioral2/memory/368-24-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/368-22-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/368-29-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/368-28-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/368-26-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/368-25-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/368-20-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/368-19-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/368-45-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-93-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-92-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-121-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-122-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-123-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-124-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-125-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-126-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-127-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4868-128-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	82360730f84bbe5d42f252343b1dbc6c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	82360730f84bbe5d42f252343b1dbc6c.exe

Executes dropped EXE 4 IoCs

pid	Process
3120	winlogon.exe
1272	winlogon.exe
4868	winlogon.exe
5108	winlogon.exe

Loads dropped DLL 1 IoCs

pid	Process
4868	winlogon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windows\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	82360730f84bbe5d42f252343b1dbc6c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3940 set thread context of 880	3940	82360730f84bbe5d42f252343b1dbc6c.exe	42
PID 880 set thread context of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 set thread context of 3880	880	82360730f84bbe5d42f252343b1dbc6c.exe	96
PID 3120 set thread context of 1272	3120	winlogon.exe	98
PID 1272 set thread context of 4868	1272	winlogon.exe	102
PID 1272 set thread context of 5108	1272	winlogon.exe	103

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\winlogon.exe	82360730f84bbe5d42f252343b1dbc6c.exe
File opened for modification	C:\Windows\winlogon.exe	82360730f84bbe5d42f252343b1dbc6c.exe
File created	C:\Windows\ntdtcstp.dll	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	368	82360730f84bbe5d42f252343b1dbc6c.exe
Token: SeBackupPrivilege	1808	vssvc.exe
Token: SeRestorePrivilege	1808	vssvc.exe
Token: SeAuditPrivilege	1808	vssvc.exe
Token: SeDebugPrivilege	4868	winlogon.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3940	82360730f84bbe5d42f252343b1dbc6c.exe
3940	82360730f84bbe5d42f252343b1dbc6c.exe
3940	82360730f84bbe5d42f252343b1dbc6c.exe
880	82360730f84bbe5d42f252343b1dbc6c.exe
3120	winlogon.exe
3120	winlogon.exe
3120	winlogon.exe
3880	82360730f84bbe5d42f252343b1dbc6c.exe
3880	82360730f84bbe5d42f252343b1dbc6c.exe
1272	winlogon.exe
5108	winlogon.exe
5108	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 880	3940	82360730f84bbe5d42f252343b1dbc6c.exe	42
PID 3940 wrote to memory of 880	3940	82360730f84bbe5d42f252343b1dbc6c.exe	42
PID 3940 wrote to memory of 880	3940	82360730f84bbe5d42f252343b1dbc6c.exe	42
PID 3940 wrote to memory of 880	3940	82360730f84bbe5d42f252343b1dbc6c.exe	42
PID 3940 wrote to memory of 880	3940	82360730f84bbe5d42f252343b1dbc6c.exe	42
PID 3940 wrote to memory of 880	3940	82360730f84bbe5d42f252343b1dbc6c.exe	42
PID 3940 wrote to memory of 880	3940	82360730f84bbe5d42f252343b1dbc6c.exe	42
PID 3940 wrote to memory of 880	3940	82360730f84bbe5d42f252343b1dbc6c.exe	42
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 880 wrote to memory of 368	880	82360730f84bbe5d42f252343b1dbc6c.exe	93
PID 368 wrote to memory of 3120	368	82360730f84bbe5d42f252343b1dbc6c.exe	101
PID 368 wrote to memory of 3120	368	82360730f84bbe5d42f252343b1dbc6c.exe	101
PID 368 wrote to memory of 3120	368	82360730f84bbe5d42f252343b1dbc6c.exe	101
PID 880 wrote to memory of 3880	880	82360730f84bbe5d42f252343b1dbc6c.exe	96
PID 880 wrote to memory of 3880	880	82360730f84bbe5d42f252343b1dbc6c.exe	96
PID 880 wrote to memory of 3880	880	82360730f84bbe5d42f252343b1dbc6c.exe	96
PID 880 wrote to memory of 3880	880	82360730f84bbe5d42f252343b1dbc6c.exe	96
PID 880 wrote to memory of 3880	880	82360730f84bbe5d42f252343b1dbc6c.exe	96
PID 880 wrote to memory of 3880	880	82360730f84bbe5d42f252343b1dbc6c.exe	96
PID 880 wrote to memory of 3880	880	82360730f84bbe5d42f252343b1dbc6c.exe	96
PID 880 wrote to memory of 3880	880	82360730f84bbe5d42f252343b1dbc6c.exe	96
PID 880 wrote to memory of 4892	880	82360730f84bbe5d42f252343b1dbc6c.exe	100
PID 880 wrote to memory of 4892	880	82360730f84bbe5d42f252343b1dbc6c.exe	100
PID 880 wrote to memory of 4892	880	82360730f84bbe5d42f252343b1dbc6c.exe	100
PID 3120 wrote to memory of 1272	3120	winlogon.exe	98
PID 3120 wrote to memory of 1272	3120	winlogon.exe	98
PID 3120 wrote to memory of 1272	3120	winlogon.exe	98
PID 3120 wrote to memory of 1272	3120	winlogon.exe	98
PID 3120 wrote to memory of 1272	3120	winlogon.exe	98
PID 3120 wrote to memory of 1272	3120	winlogon.exe	98
PID 3120 wrote to memory of 1272	3120	winlogon.exe	98
PID 3120 wrote to memory of 1272	3120	winlogon.exe	98
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 4868	1272	winlogon.exe	102
PID 1272 wrote to memory of 5108	1272	winlogon.exe	103
PID 1272 wrote to memory of 5108	1272	winlogon.exe	103
PID 1272 wrote to memory of 5108	1272	winlogon.exe	103
PID 1272 wrote to memory of 5108	1272	winlogon.exe	103
PID 1272 wrote to memory of 5108	1272	winlogon.exe	103
PID 1272 wrote to memory of 5108	1272	winlogon.exe	103
PID 1272 wrote to memory of 5108	1272	winlogon.exe	103
PID 1272 wrote to memory of 5108	1272	winlogon.exe	103

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe
"C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe
  "C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe
    C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe
    3⤵
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\Windows\winlogon.exe
      "C:\Windows\winlogon.exe" \melt "C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3120
- - C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe
    C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sil.bat
    3⤵
    PID:4892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\winlogon.exe
\melt "C:\Users\Admin\AppData\Local\Temp\82360730f84bbe5d42f252343b1dbc6c.exe"
1⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\winlogon.exe
  C:\Windows\winlogon.exe
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:4868
- C:\Windows\winlogon.exe
  C:\Windows\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sil.bat
  2⤵
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sil.bat

Path C:\Users\Admin\AppData\Local\Temp\sil.bat
Size 374B
SHA256 0b5f3dc48730a04fe98a928c2cbd2b1b2547f64c86afd9c4024e01f44566365a
MD5 879d538110348fe73592ade44b6cf988
SHA1 228f1d0caa7faed7410ea322d5ea2997ff7d1bb4
SHA512 49628ec676c2df7de1e2b51b9162048c190288139cf66eb6f52c37960594dcb70fce58a78a0a3fc00fd91f8d91d23761e389a49431506280213716fd78d09b24
MD5 SHA1 SHA512

Submit Download

sil.bat

Path C:\Users\Admin\AppData\Local\Temp\sil.bat
Size 234B
SHA256 91c8e0f27af93041b4738c40887be2a05ee94d04318f7abcad29c3209a09374e
MD5 586b58f5e7ac9e5e68b9173a840d259f
SHA1 862cbfc276294ee87ae70571df63dc3f1610295c
SHA512 c3da8a1817fbe86287cf299e22a86a57cda81d8850c4ba8c6efc4d93581dee287725eaa8c7a6feaa7c8f7ad5165f84d1d7d3347fa80bb77b0f9925e3251328a8
MD5 SHA1 SHA512

Submit Download

who.txt

Path C:\Users\Admin\AppData\Local\Temp\who.txt
Size 246B
SHA256 2f92e83823f5b63c0683d9ff2adc426662405bf5695f9512be36d78efe3ed0c6
MD5 ac8b92e31784cedbda910ee0059195c9
SHA1 be9167826c073a55e8286674959704c729717915
SHA512 ea1e9c5c78924c767e626c1963d194c177a74395a1f20fa4058957d1f4dabb5be70a654bc9433e6183e4428c6663831b82681b7dc4f8f6ccf781580727abfe7c
MD5 SHA1 SHA512

Submit Download

ntdtcstp.dll

Path C:\Windows\ntdtcstp.dll
Size 40KB
SHA256 003eb1ba56dc99c6a6d4e8f35233edcee64aa8001ac5f7289369cae2325ff019
MD5 3f689ab34ba20ffbc647f3c4ce7c9c92
SHA1 0275be6c5d43a4916f4b6b2b4aa06398e193206f
SHA512 5336b3d410c21746a81a67c1b0da791d5592d4dc42fe559bc9b12a89b6bc6aef04b385a1566e55a7599c2489741ee7b0953f9cb0b3b5b9a9feb006678e2bdbce
SSDEEP 768:JYTpEMMLAEWGsxX/M1DXCslms9/8oMUr:JYTpEMMLD8UDXCiFmoMM
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\winlogon.exe
Size 187KB
SHA256 267ef5a22fce77569a3a032091502d99c5de9306b5095d5610541b219242f6e0
MD5 5d316eda8a5ecadd5ab7c1c5634c009d
SHA1 f287cacf3408abb3911e27a5b31b61510a431f74
SHA512 0fd3704105744776c64d874eae5db43607fda7dc24c16972dd40b1368ddf2973f7ce804c6cba65363d014c0673675faf9942d328551c121929de01c5b05a1540
SSDEEP 3072:WMsPZyn4bP26TbSnpKruoByI6N5bH2VBsXbfPSqVo+OYZMd1TToKPx0XWxN:/kPfunpOPyIgWTsXbfKqGRkKPtv
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\winlogon.exe
Size 280KB
SHA256 f896a299e64876c4e09dff25897c8204d87f4d9a4f65ca2eacaea579f9b4f4dd
MD5 0c7d92037bb7f30bb892b096a043781d
SHA1 9e5f13e704ac98231edc98856c23926f45143651
SHA512 137fcdb4885b11922dc4d937c7af465e3861d6c26df706212380487cb6800623f4a4bd1226c8119fcdf903a2210a1db3114474f1ab5f361ad48c83242eb1eaea
SSDEEP 6144:/kPfunpOPyIgWTsXbfKqGRkKPt6pZZYr56Tl2:oRPyIlTofKqGiSt6lY0E
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\winlogon.exe
Size 457KB
SHA256 5bc5aa713b1a6da3710a80a75c4ea7bb43c9e5143ae70d9cf2ff2d5558a788df
MD5 999b663846a666fd6cd3aecfa83f08c7
SHA1 43accf398f19518733ccbae97cd859f23e190a6a
SHA512 c8204ba7f4608316e06bf41d5cb1f23905f274b6502bc17bc9ea92eae3f0738dca28316faa022e3a640fb0475e99028db79ca804e5a2e68d2f5925ac013e929b
SSDEEP 12288:oRPyIlTofKqGiSt6lY0pbzLKV6ymjHENQCSMV:oYuToG09UYjHa+MV
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\winlogon.exe
Size 393KB
SHA256 95e4d16cd3e9d2e15e6da4ff793133d9f7735f2e5037e91925f121853d195f56
MD5 b111801937f45ac7b4ceba3f2b73e1d8
SHA1 e511cb8dea7c8b635892ed80c2c92728ce84c056
SHA512 2d524e6b77f2367e2cf35bc593c153ce709fd88f48da2fd61e4388d20ebb126c814287a95951c272c2dd97be8a9af19c845a7b381d8d7a48614a8173272d89bc
SSDEEP 6144:/kPfunpOPyIgWTsXbfKqGRkKPt6pZZYr56TlM2xmqbUgx3/zKV6UDndm4GU:oRPyIlTofKqGiSt6lY0pbzLKV6ymjU
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\winlogon.exe
Size 223KB
SHA256 92dca3164ad851a85aa973abe4dda97ee3fc989912209ead4a046d4ad2c68a9a
MD5 5abd6625608dd1a96d472884516483df
SHA1 e6abbb706ebfd15ffd8a393ed8083600d2155a22
SHA512 235aececc99f327b08d07156284ee09873099ba7453ea5d9c946939ce99a841cbd68331d2348119f4c24f4d58261427bd129197f60055df1686de5818ebe8c9d
SSDEEP 3072:WMsPZyn4bP26TbSnpKruoByI6N5bH2VBsXbfPSqVo+OYZMd1TToKPx0XWxYp58gf:/kPfunpOPyIgWTsXbfKqGRkKPt6pZZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\winlogon.exe
Size 235KB
SHA256 7ab9435e099964c945bd102ebfc4ff6feb24a7281e50b3df7a425f9a079ec099
MD5 39b990a6abc9c69b67ea5ec7107ecbef
SHA1 1c8810997b3a5b32b69e2c81171f079c20aa38ab
SHA512 c52aa3905af4e78a43d43ca0216b3800dcaa98965c10610ada71ee8c1c770cba560d4cafaea0af51886b64429c51e799cff87dc03cb2025cc87524d091a32697
SSDEEP 3072:WMsPZyn4bP26TbSnpKruoByI6N5bH2VBsXbfPSqVo+OYZMd1TToKPx0XWxYp58g5:/kPfunpOPyIgWTsXbfKqGRkKPt6pZZYO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-28-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/368-43-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/368-24-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/368-22-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/368-29-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/368-26-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/368-25-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/368-20-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/368-19-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/368-45-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/880-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/880-61-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/880-11-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/1272-108-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/3120-72-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3120-58-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3120-56-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3120-50-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3120-44-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3120-42-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3120-47-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3120-51-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3120-60-0x00000000037B0000-0x00000000038A0000-memory.dmp

Download

memory/3880-46-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3880-77-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3880-76-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3880-75-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3880-49-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3880-74-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3880-120-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3880-55-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3940-3-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3940-2-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3940-7-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3940-5-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3940-4-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3940-14-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3940-10-0x0000000003840000-0x0000000003930000-memory.dmp

Download

memory/3940-9-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3940-1-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/3940-0-0x0000000000400000-0x00000000007C2029-memory.dmp

Download

memory/4868-93-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4868-124-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4868-128-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4868-127-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4868-126-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4868-125-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4868-98-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/4868-123-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4868-92-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4868-97-0x0000000000720000-0x0000000000721000-memory.dmp

Download

memory/4868-121-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4868-122-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/5108-114-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/5108-113-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/5108-115-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/5108-117-0x0000000002AB0000-0x0000000002AEC000-memory.dmp

Download

memory/5108-118-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/5108-116-0x0000000002230000-0x0000000002231000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads