Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-06-2021 08:04
Static task
static1
Behavioral task
behavioral1
Sample
939a42faab70585cf4aed59c73425492.exe
Resource
win7v20210410
General
-
Target
939a42faab70585cf4aed59c73425492.exe
-
Size
472KB
-
MD5
939a42faab70585cf4aed59c73425492
-
SHA1
ccc57ed7de341f637e1ba6e671105ec304bd2c4b
-
SHA256
06febadb1cc71ef3987c339b7c862ea4cd32656c372c4f266cd1af68c355a0c0
-
SHA512
04a845f4b4db9f8fb923a10db65a1cac6cce46f52aa46eaa124b7aa710e7d063555e93f93e26dfb9fa3c28425297d080f69025fcbc73801825154cbf659abe00
Malware Config
Extracted
xpertrat
3.0.10
special X
mertrerfeyy.duckdns.org:8494
gwtruwhgw.duckdns.org:8494
dfgrttuutii.duckdns.org:8494
J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4
Signatures
-
XpertRAT Core Payload 38 IoCs
Processes:
resource yara_rule behavioral2/memory/1264-128-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral2/memory/1264-129-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2100-132-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/1928-134-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2004-136-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/4000-138-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/3200-140-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/3936-142-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/696-144-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/4016-146-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/816-148-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/1520-150-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/1248-152-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/188-154-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/1856-156-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2736-158-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/580-160-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2196-162-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/3240-164-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/672-166-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/3884-168-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/772-170-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/3168-172-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/1844-174-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/60-176-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2232-178-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2096-180-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/1676-182-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/3632-184-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2236-186-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/1312-188-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2304-190-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/1276-192-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/1572-194-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/4032-196-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/3580-198-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2296-200-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2500-202-0x0000000000401364-mapping.dmp xpertrat -
Processes:
939a42faab70585cf4aed59c73425492.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 939a42faab70585cf4aed59c73425492.exe -
Processes:
939a42faab70585cf4aed59c73425492.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 939a42faab70585cf4aed59c73425492.exe -
Program crash 37 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2256 1264 WerFault.exe iexplore.exe 3856 2100 WerFault.exe iexplore.exe 3896 1928 WerFault.exe iexplore.exe 3976 2004 WerFault.exe iexplore.exe 2224 4000 WerFault.exe iexplore.exe 3404 3200 WerFault.exe iexplore.exe 1844 3936 WerFault.exe iexplore.exe 1812 696 WerFault.exe iexplore.exe 2264 4016 WerFault.exe iexplore.exe 1524 816 WerFault.exe iexplore.exe 2068 1520 WerFault.exe iexplore.exe 820 1248 WerFault.exe iexplore.exe 1816 188 WerFault.exe iexplore.exe 3680 1856 WerFault.exe iexplore.exe 1156 2736 WerFault.exe iexplore.exe 3612 580 WerFault.exe iexplore.exe 2316 2196 WerFault.exe iexplore.exe 2116 3240 WerFault.exe iexplore.exe 1316 672 WerFault.exe iexplore.exe 4004 3884 WerFault.exe iexplore.exe 416 772 WerFault.exe iexplore.exe 2892 3168 WerFault.exe iexplore.exe 1216 1844 WerFault.exe iexplore.exe 824 60 WerFault.exe iexplore.exe 504 2232 WerFault.exe iexplore.exe 2756 2096 WerFault.exe iexplore.exe 1536 1676 WerFault.exe iexplore.exe 1896 3632 WerFault.exe iexplore.exe 2348 2236 WerFault.exe iexplore.exe 2480 1312 WerFault.exe iexplore.exe 2540 2304 WerFault.exe iexplore.exe 3172 1276 WerFault.exe iexplore.exe 1128 1572 WerFault.exe iexplore.exe 3880 4032 WerFault.exe iexplore.exe 3976 3580 WerFault.exe iexplore.exe 2224 2296 WerFault.exe iexplore.exe 2892 2500 WerFault.exe iexplore.exe -
Suspicious use of SetThreadContext 38 IoCs
Processes:
939a42faab70585cf4aed59c73425492.exe939a42faab70585cf4aed59c73425492.exedescription pid process target process PID 636 set thread context of 3504 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 3504 set thread context of 1264 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2100 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 1928 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2004 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 4000 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 3200 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 3936 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 696 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 4016 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 816 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 1520 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 1248 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 188 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 1856 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2736 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 580 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2196 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 3240 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 672 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 3884 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 772 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 3168 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 1844 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 60 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2232 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2096 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 1676 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 3632 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2236 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 1312 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2304 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 1276 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 1572 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 4032 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 3580 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2296 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 set thread context of 2500 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
939a42faab70585cf4aed59c73425492.exe939a42faab70585cf4aed59c73425492.exepid process 636 939a42faab70585cf4aed59c73425492.exe 636 939a42faab70585cf4aed59c73425492.exe 636 939a42faab70585cf4aed59c73425492.exe 636 939a42faab70585cf4aed59c73425492.exe 636 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe 3504 939a42faab70585cf4aed59c73425492.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
939a42faab70585cf4aed59c73425492.exedescription pid process Token: SeDebugPrivilege 636 939a42faab70585cf4aed59c73425492.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
939a42faab70585cf4aed59c73425492.exepid process 3504 939a42faab70585cf4aed59c73425492.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
939a42faab70585cf4aed59c73425492.exe939a42faab70585cf4aed59c73425492.exedescription pid process target process PID 636 wrote to memory of 2720 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 636 wrote to memory of 2720 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 636 wrote to memory of 2720 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 636 wrote to memory of 3504 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 636 wrote to memory of 3504 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 636 wrote to memory of 3504 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 636 wrote to memory of 3504 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 636 wrote to memory of 3504 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 636 wrote to memory of 3504 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 636 wrote to memory of 3504 636 939a42faab70585cf4aed59c73425492.exe 939a42faab70585cf4aed59c73425492.exe PID 3504 wrote to memory of 1264 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1264 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1264 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1264 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1264 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1264 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1264 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1264 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2100 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2100 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2100 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2100 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2100 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2100 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2100 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2100 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1928 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1928 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1928 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1928 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1928 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1928 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1928 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 1928 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2004 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2004 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2004 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2004 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2004 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2004 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2004 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 2004 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 4000 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 4000 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 4000 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 4000 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 4000 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 4000 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 4000 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 4000 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3200 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3200 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3200 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3200 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3200 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3200 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3200 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3200 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3936 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3936 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3936 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3936 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3936 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe PID 3504 wrote to memory of 3936 3504 939a42faab70585cf4aed59c73425492.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
939a42faab70585cf4aed59c73425492.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 939a42faab70585cf4aed59c73425492.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe"C:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 188 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 244⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\939a42faab70585cf4aed59c73425492.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 244⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/60-176-0x0000000000401364-mapping.dmp
-
memory/188-154-0x0000000000401364-mapping.dmp
-
memory/580-160-0x0000000000401364-mapping.dmp
-
memory/636-123-0x00000000075F0000-0x000000000761E000-memory.dmpFilesize
184KB
-
memory/636-117-0x00000000058C0000-0x00000000058C1000-memory.dmpFilesize
4KB
-
memory/636-120-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/636-121-0x00000000090E0000-0x00000000090E2000-memory.dmpFilesize
8KB
-
memory/636-122-0x0000000007420000-0x000000000749D000-memory.dmpFilesize
500KB
-
memory/636-116-0x0000000005DC0000-0x0000000005DC1000-memory.dmpFilesize
4KB
-
memory/636-118-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/636-119-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/636-114-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/672-166-0x0000000000401364-mapping.dmp
-
memory/696-144-0x0000000000401364-mapping.dmp
-
memory/772-170-0x0000000000401364-mapping.dmp
-
memory/816-148-0x0000000000401364-mapping.dmp
-
memory/1248-152-0x0000000000401364-mapping.dmp
-
memory/1264-129-0x0000000000401364-mapping.dmp
-
memory/1264-128-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1276-192-0x0000000000401364-mapping.dmp
-
memory/1312-188-0x0000000000401364-mapping.dmp
-
memory/1520-150-0x0000000000401364-mapping.dmp
-
memory/1572-194-0x0000000000401364-mapping.dmp
-
memory/1676-182-0x0000000000401364-mapping.dmp
-
memory/1844-174-0x0000000000401364-mapping.dmp
-
memory/1856-156-0x0000000000401364-mapping.dmp
-
memory/1928-134-0x0000000000401364-mapping.dmp
-
memory/2004-136-0x0000000000401364-mapping.dmp
-
memory/2096-180-0x0000000000401364-mapping.dmp
-
memory/2100-132-0x0000000000401364-mapping.dmp
-
memory/2196-162-0x0000000000401364-mapping.dmp
-
memory/2232-178-0x0000000000401364-mapping.dmp
-
memory/2236-186-0x0000000000401364-mapping.dmp
-
memory/2296-200-0x0000000000401364-mapping.dmp
-
memory/2304-190-0x0000000000401364-mapping.dmp
-
memory/2500-202-0x0000000000401364-mapping.dmp
-
memory/2736-158-0x0000000000401364-mapping.dmp
-
memory/3168-172-0x0000000000401364-mapping.dmp
-
memory/3200-140-0x0000000000401364-mapping.dmp
-
memory/3240-164-0x0000000000401364-mapping.dmp
-
memory/3504-124-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3504-125-0x00000000004010B8-mapping.dmp
-
memory/3504-130-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3580-198-0x0000000000401364-mapping.dmp
-
memory/3632-184-0x0000000000401364-mapping.dmp
-
memory/3884-168-0x0000000000401364-mapping.dmp
-
memory/3936-142-0x0000000000401364-mapping.dmp
-
memory/4000-138-0x0000000000401364-mapping.dmp
-
memory/4016-146-0x0000000000401364-mapping.dmp
-
memory/4032-196-0x0000000000401364-mapping.dmp