asyncrat | 41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd

Analysis

max time kernel
155s
max time network
160s
platform
windows7_x64
resource
win7v20210408
submitted
31/08/2021, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe
Size 799KB
Sample210831-4c3gef4was
SHA256 41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd
MD5 0c9d4bd0d22065563920ced480065b24
SHA1 62613a91b25ba4f6a0160b82bc9da0177085fe60
SHA512 c9ad317fd124c6d4467a2139e5fbb286075f3ad9eaaff3b7412fdec567a3c01b4e76b72552a6ce2d2003af722c08c15f9ad456225b87649fcec0a3d6f5db9634
MD5 SHA1 SHA512

Score

10^/10

asyncrat macro persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

null:null

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
dDhvNMBYIS0cSEdqEZsTWnat4JCbi1fh
anti_detection
false
autorun
true
bdos
false
delay
ASE_2
host
null
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
https://aa.larinax999.repl.co
port
null
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/files/0x00040000000130d8-62.dat	asyncrat
behavioral1/files/0x00040000000130d8-64.dat	asyncrat
behavioral1/files/0x00040000000130d8-65.dat	asyncrat
behavioral1/files/0x00030000000130e4-84.dat	asyncrat
behavioral1/files/0x00030000000130e4-85.dat	asyncrat
behavioral1/files/0x00030000000130e4-87.dat	asyncrat

Executes dropped EXE 3 IoCs

pid	Process
1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe
1960	Synaptics.exe
1940	MsMpEng.exe

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource	yara_rule
behavioral1/files/0x00030000000130e9-90.dat	office_macros

Loads dropped DLL 4 IoCs

pid	Process
684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe
684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe
684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe
1748	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SS CRACK RETRIX = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
820	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1056	timeout.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	MsMpEng.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Synaptics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Synaptics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1620	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe
Token: SeDebugPrivilege	1940	MsMpEng.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1620	EXCEL.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 1176	684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	26
PID 684 wrote to memory of 1176	684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	26
PID 684 wrote to memory of 1176	684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	26
PID 684 wrote to memory of 1176	684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	26
PID 684 wrote to memory of 1960	684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	27
PID 684 wrote to memory of 1960	684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	27
PID 684 wrote to memory of 1960	684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	27
PID 684 wrote to memory of 1960	684	41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	27
PID 1176 wrote to memory of 988	1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	32
PID 1176 wrote to memory of 988	1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	32
PID 1176 wrote to memory of 988	1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	32
PID 1176 wrote to memory of 988	1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	32
PID 1176 wrote to memory of 1748	1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	34
PID 1176 wrote to memory of 1748	1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	34
PID 1176 wrote to memory of 1748	1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	34
PID 1176 wrote to memory of 1748	1176	._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe	34
PID 988 wrote to memory of 820	988	cmd.exe	36
PID 988 wrote to memory of 820	988	cmd.exe	36
PID 988 wrote to memory of 820	988	cmd.exe	36
PID 988 wrote to memory of 820	988	cmd.exe	36
PID 1748 wrote to memory of 1056	1748	cmd.exe	37
PID 1748 wrote to memory of 1056	1748	cmd.exe	37
PID 1748 wrote to memory of 1056	1748	cmd.exe	37
PID 1748 wrote to memory of 1056	1748	cmd.exe	37
PID 1748 wrote to memory of 1940	1748	cmd.exe	38
PID 1748 wrote to memory of 1940	1748	cmd.exe	38
PID 1748 wrote to memory of 1940	1748	cmd.exe	38
PID 1748 wrote to memory of 1940	1748	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe
"C:\Users\Admin\AppData\Local\Temp\41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Local\Temp\._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "MsMpEng" /tr '"C:\Users\Admin\AppData\Roaming\MsMpEng.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "MsMpEng" /tr '"C:\Users\Admin\AppData\Roaming\MsMpEng.exe"'
      4⤵
      Creates scheduled task(s)
      PID:820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB319.tmp.bat""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1056
  - - C:\Users\Admin\AppData\Roaming\MsMpEng.exe
      "C:\Users\Admin\AppData\Roaming\MsMpEng.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:1940
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:1960

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-60-0x0000000075C71000-0x0000000075C73000-memory.dmp

Download

memory/684-61-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/1176-75-0x0000000004C30000-0x0000000004C31000-memory.dmp

Download

memory/1176-71-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/1620-77-0x000000006EAC1000-0x000000006EAC3000-memory.dmp

Download

memory/1620-83-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1620-76-0x000000002FBE1000-0x000000002FBE4000-memory.dmp

Download

memory/1940-88-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download

memory/1940-92-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Download

memory/1960-73-0x0000000000220000-0x0000000000221000-memory.dmp

Download