2318595eccffdb23829c8a3f4b440b4bfb879e11904a71a32324aabc694b5269

General

Target

df4a88843738526b36460bff3ddf6155.exe
Size

56KB
MD5

df4a88843738526b36460bff3ddf6155
SHA1

d11ce2473a0e807d7d21156fac69382a483b3d5b
SHA256

2318595eccffdb23829c8a3f4b440b4bfb879e11904a71a32324aabc694b5269
SHA512

13db31b35cb8e5e00af955fd8ca794a9bd126bbdf56fd327ba456bee02ecc4cc5d3eed5648e0a9199334528b24e7ebd1101e19b515b1e552741de2256be4d709
SSDEEP

1536:wDk+6AzCeHkZQ9VOZa2xSOXoH82QMM7ZZLHD52+H:wQpAzCgPMZamSOYH8TdPH

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\msagente\\TXPlatform.exe"	df4a88843738526b36460bff3ddf6155.exe

Executes dropped EXE 3 IoCs

pid	Process
1900	wscntfy.exe
2532	conime.exe
2608	TXPlatform.exe

Loads dropped DLL 6 IoCs

pid	Process
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
2532	conime.exe
2532	conime.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msagente\instcard.ini	conime.exe
File created	C:\Windows\msagente\wscntfy.exe	df4a88843738526b36460bff3ddf6155.exe
File created	C:\Windows\msagente\conime.exe	df4a88843738526b36460bff3ddf6155.exe
File opened for modification	C:\Windows\msagente\instcard.ini	df4a88843738526b36460bff3ddf6155.exe
File created	C:\Windows\msagente\system.wav	df4a88843738526b36460bff3ddf6155.exe
File created	C:\Windows\msagente\TXPlatform.exe	conime.exe
File opened for modification	C:\Windows\msagente\TXPlatform.exe	conime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
948	df4a88843738526b36460bff3ddf6155.exe
1900	wscntfy.exe
1900	wscntfy.exe
2532	conime.exe
2608	TXPlatform.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1900	948	df4a88843738526b36460bff3ddf6155.exe	28
PID 948 wrote to memory of 1900	948	df4a88843738526b36460bff3ddf6155.exe	28
PID 948 wrote to memory of 1900	948	df4a88843738526b36460bff3ddf6155.exe	28
PID 948 wrote to memory of 1900	948	df4a88843738526b36460bff3ddf6155.exe	28
PID 948 wrote to memory of 2532	948	df4a88843738526b36460bff3ddf6155.exe	29
PID 948 wrote to memory of 2532	948	df4a88843738526b36460bff3ddf6155.exe	29
PID 948 wrote to memory of 2532	948	df4a88843738526b36460bff3ddf6155.exe	29
PID 948 wrote to memory of 2532	948	df4a88843738526b36460bff3ddf6155.exe	29
PID 2532 wrote to memory of 2608	2532	conime.exe	30
PID 2532 wrote to memory of 2608	2532	conime.exe	30
PID 2532 wrote to memory of 2608	2532	conime.exe	30
PID 2532 wrote to memory of 2608	2532	conime.exe	30

C:\Users\Admin\AppData\Local\Temp\df4a88843738526b36460bff3ddf6155.exe
"C:\Users\Admin\AppData\Local\Temp\df4a88843738526b36460bff3ddf6155.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\msagente\wscntfy.exe
  "C:\Windows\msagente\wscntfy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1900
- C:\Windows\msagente\conime.exe
  "C:\Windows\msagente\conime.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\msagente\TXPlatform.exe
    "C:\Windows\msagente\TXPlatform.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\msagente\instcard.ini

Filesize
166B

MD5
c828ba36c71ea15297cf4da67c9e6abe

SHA1
30b258a84bd1d3b601cacffc153ece4e6d30dfc6

SHA256
0e3ad4631bddff89d696b48ba6afa84f6afc41017580899d277b5cdc3504aa9b

SHA512
e5a993fe5710bb30ea5a5ba657561205aa5420743ed35b54da4837aa8cf9b67d0983a7f97044a50b787ee653445eee38679fc2a289823e8d7aac0b3161af6d18

Download Submit
\Windows\msagente\TXPlatform.exe

Filesize
56KB

MD5
df4a88843738526b36460bff3ddf6155

SHA1
d11ce2473a0e807d7d21156fac69382a483b3d5b

SHA256
2318595eccffdb23829c8a3f4b440b4bfb879e11904a71a32324aabc694b5269

SHA512
13db31b35cb8e5e00af955fd8ca794a9bd126bbdf56fd327ba456bee02ecc4cc5d3eed5648e0a9199334528b24e7ebd1101e19b515b1e552741de2256be4d709

Download Submit
\Windows\msagente\conime.exe

Filesize
20KB

MD5
96c137bd5bff92957b9aae0b6d8da56a

SHA1
5ec0d063dfe4a18762a22350874a441e64930890

SHA256
a9aac3fdb23c03bacc4b4c0b04da03ce5c58379951184a053e958f8cbe33ac06

SHA512
05244dec6fed8f2d7b010627e99b78af1a939cec46365ac0af6dce1f076d7bcec94abbf9fe1491752e7a7ac7464d546f940f6e39d97f275217945cc595ae1724

Download Submit
\Windows\msagente\wscntfy.exe

Filesize
20KB

MD5
74f26f093254b6cf1be2d9f22616d8fa

SHA1
790058850214484574a6a9114669a7220cffc42f

SHA256
5c43d54ed80b3fa54f982445d3bc3be2cb1dd0296953e1f6375cac85c68a50f0

SHA512
be23f2355c5b4b8791c6f644411fa36bc989ff8e2dcea23e9dc69cdf21acd5c123b1b8bd098ae7c10ac5867fd250801037125e8f583a1296fae58e5d459bfe02

Download Submit
memory/948-33-0x0000000000400000-0x0000000000573000-memory.dmp

Filesize
1.4MB

Download
memory/2608-32-0x0000000000400000-0x0000000000573000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads