login.exe

Classification: Malicious

login.exe is a malicious file sample (application/x-dosexec, 580.0 KB). Linked to Conti malware. 6 sightings, last seen 2020-12-12.

Detection summary

  • 0 antivirus detections (63% detection ratio)
  • 0 IDS alerts
  • 9 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: CONTI (S0575)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic.Malware Abuse.ch 2020-12-12 00:19:40 2020-12-12 00:19:40 malicious-activity
Conti Abuse.ch 2020-12-12 00:19:40 2020-12-12 00:19:40 malicious-activity S0575 Conti
Gen:Variant.Zusy Hybrid-Analysis 2020-11-16 18:30:15 2020-11-16 18:30:15

Tags

ransomware

Sample information

Filenames
login.exe, b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9.bin
File type
application/x-dosexec
Size
593920 bytes
MD5
1c2e8cb65ebe1702d2ee519d970d7808
SHA-1
0666df78cb4f95a3ba82457ddcccd660888d8b00
SHA-256
b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9
First indexed
2020-11-16 18:30:15
Last updated
2026-10-09 03:50:05

Process list

NameCommand line
login.exe
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{D788DEAE-869B-4966-974B-C1D121FDFD2D}'" delete
WMIC.exeshadowcopy where "ID='{D788DEAE-869B-4966-974B-C1D121FDFD2D}'" delete
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{6EEE7147-1F06-4554-A7E3-EFC640164C2A}'" delete
WMIC.exeshadowcopy where "ID='{6EEE7147-1F06-4554-A7E3-EFC640164C2A}'" delete
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{4F57338A-C848-47CD-BF4E-93AFAA1D2962}'" delete
WMIC.exeshadowcopy where "ID='{4F57338A-C848-47CD-BF4E-93AFAA1D2962}'" delete
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{7BDFF95C-10A1-4A6D-A596-AE1108E0E970}'" delete
WMIC.exeshadowcopy where "ID='{7BDFF95C-10A1-4A6D-A596-AE1108E0E970}'" delete