610571eae93db4fb3d49a218f3aa0d8858c42166d3c59e978f15914f2e9b31a7

Analysis

max time kernel
142s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba21ddf17174ba3973c5c0b75fbe158e.exe
Size

26KB
MD5

ba21ddf17174ba3973c5c0b75fbe158e
SHA1

3d6b8a1834be8f21b0a19bc1d5a9fca0c968ba1f
SHA256

610571eae93db4fb3d49a218f3aa0d8858c42166d3c59e978f15914f2e9b31a7
SHA512

aba346985e1feb96c8dc94011321bdf510d89372e6442b018b7ef7722dfe227c3f2d7a792d653ebd02bfc67ec534695d7fe14a05ce0c62663768c22706b48c4b
SSDEEP

384:CnxaqTnZITvA5iw3VxwFMEo7utiZ9Lr0yCcZ19yeM6YYWx0x0BSQ:LoI05iw3VxwQa+ILc+VYWx0xmSQ

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
932	winlogon.exe
3224	winlogon.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4388-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/files/0x000300000001e9a0-3.dat	upx
behavioral2/memory/4388-5-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/932-6-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/932-9-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-10-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-11-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-12-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-13-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-14-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-15-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-16-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-17-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-18-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-19-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-20-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-21-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-22-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3224-23-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SYSTEM\winlogon.exe	ba21ddf17174ba3973c5c0b75fbe158e.exe
File opened for modification	C:\Windows\SYSTEM\winlogon.exe	ba21ddf17174ba3973c5c0b75fbe158e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 932	4388	ba21ddf17174ba3973c5c0b75fbe158e.exe	89
PID 4388 wrote to memory of 932	4388	ba21ddf17174ba3973c5c0b75fbe158e.exe	89
PID 4388 wrote to memory of 932	4388	ba21ddf17174ba3973c5c0b75fbe158e.exe	89

C:\Users\Admin\AppData\Local\Temp\ba21ddf17174ba3973c5c0b75fbe158e.exe
"C:\Users\Admin\AppData\Local\Temp\ba21ddf17174ba3973c5c0b75fbe158e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SYSTEM\winlogon.exe
  C:\Windows\SYSTEM\winlogon.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  PID:932

C:\Windows\SYSTEM\winlogon.exe
C:\Windows\SYSTEM\winlogon.exe
1⤵
- Executes dropped EXE
PID:3224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\winlogon.exe

Filesize
26KB

MD5
ba21ddf17174ba3973c5c0b75fbe158e

SHA1
3d6b8a1834be8f21b0a19bc1d5a9fca0c968ba1f

SHA256
610571eae93db4fb3d49a218f3aa0d8858c42166d3c59e978f15914f2e9b31a7

SHA512
aba346985e1feb96c8dc94011321bdf510d89372e6442b018b7ef7722dfe227c3f2d7a792d653ebd02bfc67ec534695d7fe14a05ce0c62663768c22706b48c4b

Download Submit
memory/932-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/932-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-23-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-14-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-22-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-16-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-18-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-19-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-20-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3224-21-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4388-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4388-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download