c56958d6c830691eaa48747c599d30b156e44f3a37c6b176858fb9b9e582c793

General

Target

82bc795e5e45aca8ff440a1e12267c90N.exe
Size

349KB
MD5

82bc795e5e45aca8ff440a1e12267c90
SHA1

16446fed3b711a32821f87ecd63c72cc871e425b
SHA256

c56958d6c830691eaa48747c599d30b156e44f3a37c6b176858fb9b9e582c793
SHA512

7bb75300937660e1aea90403c663cefd4265a28f9f619cb5bf644ed274c7012e5d52f58f005be5fac5580fa0dd6d81bea5ca55d4f4fa513d37912643fb66469d
SSDEEP

6144:fVTQDSiexKAK4y6UvcZSeNH49qQQOH+ym4LLIoTqHSMaxzL:sSiOK4yjNQOGzoTCSMG

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3064	svchost.exe

Loads dropped DLL 5 IoCs

pid	Process
2192	82bc795e5e45aca8ff440a1e12267c90N.exe
2192	82bc795e5e45aca8ff440a1e12267c90N.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\20b3064 = "C:\\Windows\\apppatch\\svchost.exe"	82bc795e5e45aca8ff440a1e12267c90N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\20b3064 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	82bc795e5e45aca8ff440a1e12267c90N.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	82bc795e5e45aca8ff440a1e12267c90N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	3064	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82bc795e5e45aca8ff440a1e12267c90N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3064	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2192	82bc795e5e45aca8ff440a1e12267c90N.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3064	2192	82bc795e5e45aca8ff440a1e12267c90N.exe	30
PID 2192 wrote to memory of 3064	2192	82bc795e5e45aca8ff440a1e12267c90N.exe	30
PID 2192 wrote to memory of 3064	2192	82bc795e5e45aca8ff440a1e12267c90N.exe	30
PID 2192 wrote to memory of 3064	2192	82bc795e5e45aca8ff440a1e12267c90N.exe	30
PID 3064 wrote to memory of 2668	3064	svchost.exe	31
PID 3064 wrote to memory of 2668	3064	svchost.exe	31
PID 3064 wrote to memory of 2668	3064	svchost.exe	31
PID 3064 wrote to memory of 2668	3064	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\82bc795e5e45aca8ff440a1e12267c90N.exe
"C:\Users\Admin\AppData\Local\Temp\82bc795e5e45aca8ff440a1e12267c90N.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 348
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\AppPatch\svchost.exe

Filesize
349KB

MD5
86a8ebd3530081f06533ec5bf29c375c

SHA1
a44ccf6d17d139af4555c7fd96e875f72328bdc0

SHA256
f1401cc98cc786f5ca1eac632b993695213574e7659e6ed012a674df754815c1

SHA512
e5c40c356b8fdfcbe7c4b376fb582fad2123a5fa4945d486078e03cffca6628309457f8f5493fa3badbef92a0646b4684055782f7a952bc40370e1a3a87263d9

Download Submit
memory/2192-13-0x00000000011C0000-0x0000000001229000-memory.dmp

Filesize
420KB

Download
memory/3064-14-0x00000000004B0000-0x00000000004FA000-memory.dmp

Filesize
296KB

Download
memory/3064-22-0x00000000004B0000-0x00000000004FA000-memory.dmp

Filesize
296KB

Download
memory/3064-20-0x00000000004B0000-0x00000000004FA000-memory.dmp

Filesize
296KB

Download
memory/3064-18-0x00000000004B0000-0x00000000004FA000-memory.dmp

Filesize
296KB

Download
memory/3064-16-0x00000000004B0000-0x00000000004FA000-memory.dmp

Filesize
296KB

Download
memory/3064-23-0x0000000000550000-0x00000000005A8000-memory.dmp

Filesize
352KB

Download
memory/3064-27-0x0000000000550000-0x00000000005A8000-memory.dmp

Filesize
352KB

Download
memory/3064-25-0x0000000000550000-0x00000000005A8000-memory.dmp

Filesize
352KB

Download
memory/3064-34-0x0000000000550000-0x00000000005A8000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads