753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8

General

Target

753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe
Size

474KB
MD5

ce49656e048c43c60317431abd383dff
SHA1

1f84d9865cfb08aeff1f995bc1eb90a6d87a0d9d
SHA256

753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8
SHA512

070385029413bb7d8ce31e235ae6800d69fe1070596a5886b23e9b65c0eaf26bd70203afdf99ef369e4bab39ed850fcd991eb0bdf74224bf873d47ecde120fdc
SSDEEP

6144:Ezv+ezl2A8GuozDKJDe6VlWT8b9IeArZCh3Z64sgmo9VkGIb3yuaPIPXb:ET+TfWzDKJDPVle8mvrZgmUmVam

Score

10^/10

credential_access persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\TrustedInstaller.exe"	753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Loads dropped DLL 1 IoCs

pid	Process
4680	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\TrustedInstaller.exe	753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe
File opened for modification	C:\Windows\TrustedInstaller.exe	753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe
File created	C:\Windows\xdwd.dll	753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1804	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2436	1404	753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe	87
PID 1404 wrote to memory of 2436	1404	753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe	87
PID 2436 wrote to memory of 1804	2436	CMD.exe	89
PID 2436 wrote to memory of 1804	2436	CMD.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe
"C:\Users\Admin\AppData\Local\Temp\753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "TrustedInstall" /tr "C:\Windows\TrustedInstaller.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "TrustedInstall" /tr "C:\Windows\TrustedInstaller.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Windows Credential Manager

1

T1555.004

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/1404-0-0x0000000000E00000-0x0000000000E7C000-memory.dmp

Filesize
496KB

Download
memory/1404-1-0x00007FFF4C3F3000-0x00007FFF4C3F5000-memory.dmp

Filesize
8KB

Download
memory/1404-37-0x00007FFF4C3F0000-0x00007FFF4CEB1000-memory.dmp

Filesize
10.8MB

Download
memory/1404-97-0x00007FFF4C3F3000-0x00007FFF4C3F5000-memory.dmp

Filesize
8KB

Download
memory/1404-219-0x00007FFF4C3F0000-0x00007FFF4CEB1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads