55bd622a18d6d97d9ad2613d6b15991c5ae1444068f2ea1350005699b4cf7073

General

Target

c36aaca55d323b220c51e97403109783.exe
Size

239KB
MD5

c36aaca55d323b220c51e97403109783
SHA1

963ec5739708c8a4663c42b5dec3d7029b086780
SHA256

55bd622a18d6d97d9ad2613d6b15991c5ae1444068f2ea1350005699b4cf7073
SHA512

f2d9654a930faa8425d8b8e7309e6172b704ea9d64b09106eeae602a2fa2fae15f8e0927a5255cf81c3bd9c7a54e1ab1672d7ae01261a43316395509b57550d0
SSDEEP

3072:Ishel/y+zsKfHtI5r6IgIAmG/OCtCgUPa9Ef0zS8By+crMyww+K5iF4oq:Isk/yuV/m5mIpG9tCgQa9KqSBoOZ5oq

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\e2caafb3\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
1736	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
2392	X
336	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
3016	c36aaca55d323b220c51e97403109783.exe
3016	c36aaca55d323b220c51e97403109783.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 1736	3016	c36aaca55d323b220c51e97403109783.exe	28

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{1e7ba21f-f92a-02a3-0350-4ca985f11bff}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1e7ba21f-f92a-02a3-0350-4ca985f11bff}\u = "134"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1e7ba21f-f92a-02a3-0350-4ca985f11bff}\cid = "7191924538345980045"	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2392	X
1736	explorer.exe
1736	explorer.exe
1736	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1736	3016	c36aaca55d323b220c51e97403109783.exe	28
PID 3016 wrote to memory of 1736	3016	c36aaca55d323b220c51e97403109783.exe	28
PID 3016 wrote to memory of 1736	3016	c36aaca55d323b220c51e97403109783.exe	28
PID 3016 wrote to memory of 1736	3016	c36aaca55d323b220c51e97403109783.exe	28
PID 3016 wrote to memory of 1736	3016	c36aaca55d323b220c51e97403109783.exe	28
PID 3016 wrote to memory of 2392	3016	c36aaca55d323b220c51e97403109783.exe	29
PID 3016 wrote to memory of 2392	3016	c36aaca55d323b220c51e97403109783.exe	29
PID 3016 wrote to memory of 2392	3016	c36aaca55d323b220c51e97403109783.exe	29
PID 3016 wrote to memory of 2392	3016	c36aaca55d323b220c51e97403109783.exe	29
PID 2392 wrote to memory of 1204	2392	X	21
PID 1736 wrote to memory of 336	1736	explorer.exe	2
PID 336 wrote to memory of 2316	336	csrss.exe	30
PID 336 wrote to memory of 2316	336	csrss.exe	30
PID 336 wrote to memory of 3024	336	csrss.exe	31
PID 336 wrote to memory of 3024	336	csrss.exe	31

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1204
- C:\Users\Admin\AppData\Local\Temp\c36aaca55d323b220c51e97403109783.exe
  "C:\Users\Admin\AppData\Local\Temp\c36aaca55d323b220c51e97403109783.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\explorer.exe
    000000CC*
    3⤵
    - Deletes itself
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1736
- - C:\Users\Admin\AppData\Local\e2caafb3\X
    193.105.154.210:80
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2392

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2316

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\e2caafb3\@

Filesize
2KB

MD5
defe8eb3e865a537e3d24d95fe09b660

SHA1
80c115edf54cdedd80c4dedaa8fca53ecbc905de

SHA256
85a0ba96fb2eb65bb09bb9a07f604ba0bf2f559249c7b04e3d93a19a7eed4347

SHA512
a3d613d0c8de808b405f143f0dd1d2fa555c9b6e821221eeb18efa5a3ec1fe2a3dbba8391a25d05aa68d18df962386ce1fd27fcf67e99f0efaee98e2dae2ce00

Download Submit
C:\Windows\system32\consrv.DLL

Filesize
31KB

MD5
dafc4a53954b76c5db1d857e955f3805

SHA1
a18fa0d38c6656b4398953e77e87eec3b0209ef3

SHA256
c6c82dde145a2dd9d70b1b539b17571befb663fc4a9ca834ff2a140cc4ebaa0b

SHA512
745e27a4f952e2492dbd12ced396be2c7dc78344ba415ad64b45920f95d7a282e30c7ad2da9266dc195c71e38019809e8183a705f9276c7d178de2f5ef34b633

Download Submit
\Users\Admin\AppData\Local\e2caafb3\X

Filesize
41KB

MD5
686b479b0ee164cf1744a8be359ebb7d

SHA1
8615e8f967276a85110b198d575982a958581a07

SHA256
fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

SHA512
7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
9c38b2021539aeb1dcad45da14a638ac

SHA1
b7a46e90a403d1da2a714431459e0db0e9c3b44f

SHA256
0ba31fb02f19c986deb6bbae6a60b8f54cbc900dc1e25274f21a6d57bdebb8e9

SHA512
82cae54e45320ff736e78a61f8781c0c3154556f72df3105c1b4b7b8229b09d4a723bd46279be64a0451fc59cfcd590775743d109015458a39079384f5be2ef7

Download Submit
memory/336-42-0x0000000000E40000-0x0000000000E4C000-memory.dmp

Filesize
48KB

Download
memory/336-41-0x0000000000E40000-0x0000000000E4C000-memory.dmp

Filesize
48KB

Download
memory/1204-14-0x0000000002D20000-0x0000000002D2B000-memory.dmp

Filesize
44KB

Download
memory/1204-15-0x00000000029D0000-0x00000000029D8000-memory.dmp

Filesize
32KB

Download
memory/1204-22-0x0000000002D20000-0x0000000002D2B000-memory.dmp

Filesize
44KB

Download
memory/1204-30-0x0000000002D20000-0x0000000002D2B000-memory.dmp

Filesize
44KB

Download
memory/1204-34-0x0000000002610000-0x000000000261B000-memory.dmp

Filesize
44KB

Download
memory/1204-43-0x0000000002610000-0x000000000261B000-memory.dmp

Filesize
44KB

Download
memory/1736-25-0x0000000000170000-0x0000000000184000-memory.dmp

Filesize
80KB

Download
memory/1736-11-0x0000000000170000-0x0000000000184000-memory.dmp

Filesize
80KB

Download
memory/1736-35-0x0000000000170000-0x0000000000184000-memory.dmp

Filesize
80KB

Download
memory/1736-3-0x0000000000060000-0x0000000000072000-memory.dmp

Filesize
72KB

Download
memory/3016-12-0x0000000000400000-0x0000000000449184-memory.dmp

Filesize
292KB

Download
memory/3016-1-0x0000000000400000-0x0000000000449184-memory.dmp

Filesize
292KB

Download
memory/3016-2-0x0000000000890000-0x0000000000990000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads