Analysis
- max time kernel
150s - max time network
146s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
11/11/2024, 16:50
General
- Target 1a10550d0149c2f9d716346efc0c12210a4965a3.exe
- Size 237KB
- Sample241111-vb93hssbnd
- SHA256 b19a22e002033220539de5970500c87800b4b64c7bbc583249862cffd27d4a5c
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Modifies WinLogon 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a10550d0149c2f9d716346efc0c12210a4965a3.exe"C:\Users\Admin\AppData\Local\Temp\1a10550d0149c2f9d716346efc0c12210a4965a3.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
memory/2196-0-0x0000000000310000-0x0000000000375000-memory.dmp
memory/2196-1-0x0000000000400000-0x0000000000467000-memory.dmp
memory/2196-17-0x0000000000400000-0x0000000000467000-memory.dmp
memory/2196-16-0x0000000000310000-0x0000000000375000-memory.dmp
memory/2808-79-0x0000000003CC0000-0x0000000003CC1000-memory.dmp
memory/2808-72-0x0000000003C90000-0x0000000003C91000-memory.dmp
memory/2808-22-0x0000000002250000-0x00000000022DC000-memory.dmp
memory/2808-28-0x0000000002250000-0x00000000022DC000-memory.dmp
memory/2808-30-0x0000000002250000-0x00000000022DC000-memory.dmp
memory/2808-24-0x0000000002250000-0x00000000022DC000-memory.dmp
memory/2808-31-0x0000000000400000-0x0000000000467000-memory.dmp
memory/2808-26-0x0000000002250000-0x00000000022DC000-memory.dmp
memory/2808-20-0x0000000002250000-0x00000000022DC000-memory.dmp
memory/2808-32-0x0000000002890000-0x000000000292B000-memory.dmp
memory/2808-36-0x0000000002890000-0x000000000292B000-memory.dmp
memory/2808-39-0x0000000002890000-0x000000000292B000-memory.dmp
memory/2808-34-0x0000000002890000-0x000000000292B000-memory.dmp
memory/2808-82-0x0000000003CF0000-0x0000000003CF1000-memory.dmp
memory/2808-81-0x0000000003CE0000-0x0000000003CE1000-memory.dmp
memory/2808-18-0x0000000000400000-0x0000000000467000-memory.dmp
memory/2808-78-0x0000000003CD0000-0x0000000003CD1000-memory.dmp
memory/2808-75-0x0000000003CC0000-0x0000000003CC1000-memory.dmp
memory/2808-74-0x0000000003CB0000-0x0000000003CB1000-memory.dmp
memory/2808-19-0x0000000000400000-0x0000000000467000-memory.dmp
memory/2808-71-0x0000000003CA0000-0x0000000003CA1000-memory.dmp
memory/2808-68-0x0000000003C90000-0x0000000003C91000-memory.dmp
memory/2808-67-0x0000000003C80000-0x0000000003C81000-memory.dmp
memory/2808-65-0x0000000003C60000-0x0000000003C61000-memory.dmp
memory/2808-64-0x0000000003C70000-0x0000000003C71000-memory.dmp
memory/2808-60-0x0000000003C50000-0x0000000003C51000-memory.dmp
memory/2808-58-0x0000000003C30000-0x0000000003C31000-memory.dmp
memory/2808-57-0x0000000003C40000-0x0000000003C41000-memory.dmp
memory/2808-54-0x0000000003C30000-0x0000000003C31000-memory.dmp
memory/2808-53-0x0000000003520000-0x0000000003521000-memory.dmp
memory/2808-51-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/2808-50-0x0000000002AF0000-0x0000000002AF1000-memory.dmp
memory/2808-47-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/2808-46-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/2808-44-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/2808-43-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/2808-42-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/2808-40-0x00000000029B0000-0x00000000029B1000-memory.dmp