610571eae93db4fb3d49a218f3aa0d8858c42166d3c59e978f15914f2e9b31a7

General

Target

ba21ddf17174ba3973c5c0b75fbe158e.exe
Size

26KB
MD5

ba21ddf17174ba3973c5c0b75fbe158e
SHA1

3d6b8a1834be8f21b0a19bc1d5a9fca0c968ba1f
SHA256

610571eae93db4fb3d49a218f3aa0d8858c42166d3c59e978f15914f2e9b31a7
SHA512

aba346985e1feb96c8dc94011321bdf510d89372e6442b018b7ef7722dfe227c3f2d7a792d653ebd02bfc67ec534695d7fe14a05ce0c62663768c22706b48c4b
SSDEEP

384:CnxaqTnZITvA5iw3VxwFMEo7utiZ9Lr0yCcZ19yeM6YYWx0x0BSQ:LoI05iw3VxwQa+ILc+VYWx0xmSQ

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
2392	winlogon.exe
2012	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1760	ba21ddf17174ba3973c5c0b75fbe158e.exe
1760	ba21ddf17174ba3973c5c0b75fbe158e.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1760-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1760-8-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/files/0x000d000000012267-9.dat	upx
behavioral1/memory/2392-11-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-13-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2392-15-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-16-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-17-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-19-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-20-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-21-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-22-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-23-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-24-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-25-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-26-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-27-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-28-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-29-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2012-30-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SYSTEM\winlogon.exe	ba21ddf17174ba3973c5c0b75fbe158e.exe
File opened for modification	C:\Windows\SYSTEM\winlogon.exe	ba21ddf17174ba3973c5c0b75fbe158e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2392	1760	ba21ddf17174ba3973c5c0b75fbe158e.exe	28
PID 1760 wrote to memory of 2392	1760	ba21ddf17174ba3973c5c0b75fbe158e.exe	28
PID 1760 wrote to memory of 2392	1760	ba21ddf17174ba3973c5c0b75fbe158e.exe	28
PID 1760 wrote to memory of 2392	1760	ba21ddf17174ba3973c5c0b75fbe158e.exe	28

C:\Users\Admin\AppData\Local\Temp\ba21ddf17174ba3973c5c0b75fbe158e.exe
"C:\Users\Admin\AppData\Local\Temp\ba21ddf17174ba3973c5c0b75fbe158e.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SYSTEM\winlogon.exe
  C:\Windows\SYSTEM\winlogon.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  PID:2392

C:\Windows\SYSTEM\winlogon.exe
C:\Windows\SYSTEM\winlogon.exe
1⤵
- Executes dropped EXE
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\winlogon.exe

Filesize
26KB

MD5
ba21ddf17174ba3973c5c0b75fbe158e

SHA1
3d6b8a1834be8f21b0a19bc1d5a9fca0c968ba1f

SHA256
610571eae93db4fb3d49a218f3aa0d8858c42166d3c59e978f15914f2e9b31a7

SHA512
aba346985e1feb96c8dc94011321bdf510d89372e6442b018b7ef7722dfe227c3f2d7a792d653ebd02bfc67ec534695d7fe14a05ce0c62663768c22706b48c4b

Download Submit
memory/1760-18-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1760-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1760-10-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1760-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-19-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-27-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-16-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-30-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-20-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-21-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-22-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-23-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-24-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-25-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-26-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-29-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-28-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2392-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2392-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing