Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 12:14

General

  • Target

    56c87a1185ed6a8e688dfb9f658b651912c88f30b3001c89887fc7e91514fc8a.exe

  • Size

    245KB

  • MD5

    ec9de179c2f0152454a02bf698482773

  • SHA1

    805b99d72f181a81f2627652cd1a28e4b74d3071

  • SHA256

    56c87a1185ed6a8e688dfb9f658b651912c88f30b3001c89887fc7e91514fc8a

  • SHA512

    a5227355a8d121d2091c95986e87cb3b3d01150b47bd29a06f0071b701865b2a349cd580731f7adc7d528c14ed31da8220022ddfc978c0a6eddc63b8d3518f1c

  • SSDEEP

    6144:O7HI/0S6GcV6yabg0OLe//fRD/uzc+8fJpgY08g:gH6b6GcV6wq/fJ/rDfJpgYE

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56c87a1185ed6a8e688dfb9f658b651912c88f30b3001c89887fc7e91514fc8a.exe
    "C:\Users\Admin\AppData\Local\Temp\56c87a1185ed6a8e688dfb9f658b651912c88f30b3001c89887fc7e91514fc8a.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3320

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\apppatch\svchost.exe

          Filesize

          245KB

          MD5

          f2ec69d5820b6a8643a6c6cd84ef44ef

          SHA1

          9ec1e9ee625cac561bab6c3014f181207a6581cf

          SHA256

          2087c53867ff64fd4bdd0c7e4e47044f62e3f22d86393ca0cdf99e2c7df43d08

          SHA512

          b244c2cd313d2014a0142668d0e16bf70c0f7da598275a130d8e7373fc94354d1560d0ed8d6a5ba1d185485d2c95ab149fb4188c2cb5d89c4432b1796ccb69e4

        • memory/1996-12-0x0000000002200000-0x0000000002267000-memory.dmp

          Filesize

          412KB

        • memory/1996-1-0x0000000000400000-0x000000000046A000-memory.dmp

          Filesize

          424KB

        • memory/1996-0-0x0000000002200000-0x0000000002267000-memory.dmp

          Filesize

          412KB

        • memory/1996-13-0x0000000000400000-0x000000000046A000-memory.dmp

          Filesize

          424KB

        • memory/3320-54-0x00000000025C0000-0x00000000025C1000-memory.dmp

          Filesize

          4KB

        • memory/3320-49-0x00000000025B0000-0x00000000025B1000-memory.dmp

          Filesize

          4KB

        • memory/3320-15-0x0000000002B70000-0x0000000002C00000-memory.dmp

          Filesize

          576KB

        • memory/3320-17-0x0000000002F40000-0x0000000002FDF000-memory.dmp

          Filesize

          636KB

        • memory/3320-22-0x0000000002F40000-0x0000000002FDF000-memory.dmp

          Filesize

          636KB

        • memory/3320-19-0x0000000002F40000-0x0000000002FDF000-memory.dmp

          Filesize

          636KB

        • memory/3320-28-0x0000000002F40000-0x0000000002FDF000-memory.dmp

          Filesize

          636KB

        • memory/3320-57-0x0000000002F40000-0x0000000002FDF000-memory.dmp

          Filesize

          636KB

        • memory/3320-56-0x00000000025E0000-0x00000000025E1000-memory.dmp

          Filesize

          4KB

        • memory/3320-14-0x0000000000400000-0x000000000046A000-memory.dmp

          Filesize

          424KB

        • memory/3320-53-0x00000000025D0000-0x00000000025D1000-memory.dmp

          Filesize

          4KB

        • memory/3320-16-0x0000000000400000-0x000000000046A000-memory.dmp

          Filesize

          424KB

        • memory/3320-47-0x0000000002590000-0x0000000002591000-memory.dmp

          Filesize

          4KB

        • memory/3320-46-0x00000000025A0000-0x00000000025A1000-memory.dmp

          Filesize

          4KB

        • memory/3320-43-0x0000000002590000-0x0000000002591000-memory.dmp

          Filesize

          4KB

        • memory/3320-42-0x0000000002580000-0x0000000002581000-memory.dmp

          Filesize

          4KB

        • memory/3320-40-0x0000000002560000-0x0000000002561000-memory.dmp

          Filesize

          4KB

        • memory/3320-39-0x0000000002570000-0x0000000002571000-memory.dmp

          Filesize

          4KB

        • memory/3320-36-0x0000000002560000-0x0000000002561000-memory.dmp

          Filesize

          4KB

        • memory/3320-35-0x0000000002550000-0x0000000002551000-memory.dmp

          Filesize

          4KB

        • memory/3320-33-0x0000000002530000-0x0000000002531000-memory.dmp

          Filesize

          4KB

        • memory/3320-32-0x0000000002540000-0x0000000002541000-memory.dmp

          Filesize

          4KB

        • memory/3320-31-0x0000000002540000-0x0000000002541000-memory.dmp

          Filesize

          4KB

        • memory/3320-29-0x0000000002530000-0x0000000002531000-memory.dmp

          Filesize

          4KB