ramnit | 61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24

General

Target

61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
Size

84KB
MD5

d8ce8e59dc1b438493939ab9753807d0
SHA1

fa3ec7549a6f496749762cbed1038a2cb1951dca
SHA256

61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24
SHA512

7ff83c93e3b9f17a2fae2a14a5a0ddfc498cc3d7cec5dffda45936383b3c2c2ee2aa62719b2165d74b1bf676a71b55191e45702b576cc059fa6af24ba74ae954

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe:*:enabled:@shell32.dll,-1"	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1852 created 3924 1852 WerFault.exe 61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

description	pid	process	target process
PID 1852 created 3924	1852	WerFault.exe	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3924-115-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px2512.tmp	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1852 3924 WerFault.exe 61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

pid	pid_target	process	target process
1852	3924	WerFault.exe	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exeWerFault.exe

pid	process
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe

Suspicious behavior: MapViewOfSection 59 IoCs

Processes:

61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

pid	process
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
Token: SeRestorePrivilege	1852	WerFault.exe
Token: SeBackupPrivilege	1852	WerFault.exe
Token: SeDebugPrivilege	1852	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe

description	pid	process	target process
PID 3924 wrote to memory of 548	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	winlogon.exe
PID 3924 wrote to memory of 548	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	winlogon.exe
PID 3924 wrote to memory of 548	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	winlogon.exe
PID 3924 wrote to memory of 548	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	winlogon.exe
PID 3924 wrote to memory of 548	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	winlogon.exe
PID 3924 wrote to memory of 548	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	winlogon.exe
PID 3924 wrote to memory of 628	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	lsass.exe
PID 3924 wrote to memory of 628	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	lsass.exe
PID 3924 wrote to memory of 628	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	lsass.exe
PID 3924 wrote to memory of 628	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	lsass.exe
PID 3924 wrote to memory of 628	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	lsass.exe
PID 3924 wrote to memory of 628	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	lsass.exe
PID 3924 wrote to memory of 708	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 708	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 708	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 708	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 708	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 708	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 716	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 716	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 716	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 716	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 716	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 716	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	fontdrvhost.exe
PID 3924 wrote to memory of 724	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 724	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 724	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 724	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 724	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 724	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 792	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 792	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 792	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 792	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 792	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 792	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 836	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 836	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 836	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 836	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 836	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 836	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 884	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 884	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 884	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 884	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 884	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 884	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 972	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	dwm.exe
PID 3924 wrote to memory of 972	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	dwm.exe
PID 3924 wrote to memory of 972	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	dwm.exe
PID 3924 wrote to memory of 972	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	dwm.exe
PID 3924 wrote to memory of 972	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	dwm.exe
PID 3924 wrote to memory of 972	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	dwm.exe
PID 3924 wrote to memory of 68	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 68	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 68	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 68	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 68	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 68	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 360	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 360	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 360	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe
PID 3924 wrote to memory of 360	3924	61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:628

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:548

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:716

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:972

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:724

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:836

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:884

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:792

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
2⤵
PID:3248

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
2⤵
PID:3264

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3480

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3704

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:1780

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
2⤵
PID:3028

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:360

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:676

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1036

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1064

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1148

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1184

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1224

c:\windows\system32\sihost.exe
sihost.exe
2⤵
PID:2336

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1452

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1976

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1828

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1672

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1616

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc
2⤵
PID:2268

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2148

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1532

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1480

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1472

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1296

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2356

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2432

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2444

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2624

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2612

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2668

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2724

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:4056

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2852

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3036

C:\Users\Admin\AppData\Local\Temp\61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe
"C:\Users\Admin\AppData\Local\Temp\61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24.exe"
2⤵
- Modifies firewall policy service
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 564
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:3684

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:3224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:3976

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-114-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/3924-115-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads