glupteba | 2565418cd275ea994c4c93ad1b8a737ee0be2aa055fb5babacd8f6c8c6e958f3

Analysis

max time kernel
27s
max time network
135s
platform
windows10_x64
resource
win10-en
submitted
06/09/2021, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Size 4.4MB
Sample210906-sxesdsbcb3
SHA256 2565418cd275ea994c4c93ad1b8a737ee0be2aa055fb5babacd8f6c8c6e958f3
MD5 7d4eb7597f965711925dcdd4d5161578
SHA1 329680e16c9b3cd08f68f20846cd62bf127f68fb
SHA512 438714e9c85eb91021253381fc2908fafb76c65e6c1956289d9ba3b78045d2d457a247a27515e8108f112d5a6a6b8a0e60977800a686d77e0f1002e3478c79b6
MD5 SHA1 SHA512

Score

10^/10

glupteba metasploit backdoor dropper loader trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2396-115-0x0000000002D90000-0x00000000036B7000-memory.dmp	family_glupteba
behavioral2/memory/2396-116-0x0000000000400000-0x0000000002584000-memory.dmp	family_glupteba
behavioral2/memory/3632-118-0x0000000000400000-0x0000000002584000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3592 created 2396	3592	svchost.exe	68

Program crash 37 IoCs

pid	pid_target	Process	procid_target
3272	2396	WerFault.exe	68
1260	2396	WerFault.exe	68
1116	2396	WerFault.exe	68
3108	2396	WerFault.exe	68
2108	2396	WerFault.exe	68
3740	2396	WerFault.exe	68
1444	2396	WerFault.exe	68
1676	2396	WerFault.exe	68
3844	2396	WerFault.exe	68
3752	2396	WerFault.exe	68
3820	2396	WerFault.exe	68
3952	2396	WerFault.exe	68
1200	2396	WerFault.exe	68
744	2396	WerFault.exe	68
2332	2396	WerFault.exe	68
1676	2396	WerFault.exe	68
3264	2396	WerFault.exe	68
3312	2396	WerFault.exe	68
3120	2396	WerFault.exe	68
3952	2396	WerFault.exe	68
1200	2396	WerFault.exe	68
2120	3632	WerFault.exe	100
2636	3632	WerFault.exe	100
2648	3632	WerFault.exe	100
2716	3632	WerFault.exe	100
2644	3632	WerFault.exe	100
2648	3632	WerFault.exe	100
2716	3632	WerFault.exe	100
2644	3632	WerFault.exe	100
3444	3632	WerFault.exe	100
3928	3632	WerFault.exe	100
2684	3632	WerFault.exe	100
4112	3632	WerFault.exe	100
4140	3632	WerFault.exe	100
4164	3632	WerFault.exe	100
4192	3632	WerFault.exe	100
4220	3632	WerFault.exe	100

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-262 = "GMT Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-362 = "GTB Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time"	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
2396	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Token: SeImpersonatePrivilege	2396	Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
Token: SeTcbPrivilege	3592	svchost.exe
Token: SeTcbPrivilege	3592	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 3632	3592	svchost.exe	100
PID 3592 wrote to memory of 3632	3592	svchost.exe	100
PID 3592 wrote to memory of 3632	3592	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
"C:\Users\Admin\AppData\Local\Temp\Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 352
  2⤵
  - Program crash
  PID:3272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 364
  2⤵
  - Program crash
  PID:1260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 400
  2⤵
  - Program crash
  PID:1116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 580
  2⤵
  - Program crash
  PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 656
  2⤵
  - Program crash
  PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 692
  2⤵
  - Program crash
  PID:3740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 624
  2⤵
  - Program crash
  PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 612
  2⤵
  - Program crash
  PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 740
  2⤵
  - Program crash
  PID:3844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 564
  2⤵
  - Program crash
  PID:3752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 628
  2⤵
  - Program crash
  PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 548
  2⤵
  - Program crash
  PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 800
  2⤵
  - Program crash
  PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 712
  2⤵
  - Program crash
  PID:744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 668
  2⤵
  - Program crash
  PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 808
  2⤵
  - Program crash
  PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 840
  2⤵
  - Program crash
  PID:3264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 844
  2⤵
  - Program crash
  PID:3312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 664
  2⤵
  - Program crash
  PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 712
  2⤵
  - Program crash
  PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 740
  2⤵
  - Program crash
  PID:1200
- C:\Users\Admin\AppData\Local\Temp\Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe
  "C:\Users\Admin\AppData\Local\Temp\Your+File+Is+Ready+To+Download-PLND-ALAyNmEhBQUABTwCAEFVGQAMAAJi-eIA.exe"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 316
    3⤵
    - Program crash
    PID:2120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 304
    3⤵
    - Program crash
    PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 332
    3⤵
    - Program crash
    PID:2648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 592
    3⤵
    - Program crash
    PID:2716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 628
    3⤵
    - Program crash
    PID:2644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 664
    3⤵
    - Program crash
    PID:2648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 632
    3⤵
    - Program crash
    PID:2716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 572
    3⤵
    - Program crash
    PID:2644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 704
    3⤵
    - Program crash
    PID:3444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 776
    3⤵
    - Program crash
    PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 608
    3⤵
    - Program crash
    PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 632
    3⤵
    - Program crash
    PID:4112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 572
    3⤵
    - Program crash
    PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 800
    3⤵
    - Program crash
    PID:4164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 896
    3⤵
    - Program crash
    PID:4192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1296
    3⤵
    - Program crash
    PID:4220

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-115-0x0000000002D90000-0x00000000036B7000-memory.dmp

Download

memory/2396-116-0x0000000000400000-0x0000000002584000-memory.dmp

Download

memory/3632-118-0x0000000000400000-0x0000000002584000-memory.dmp

Download