xpertrat | 85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a

Analysis

max time kernel
82s
max time network
149s
platform
windows10_x64
resource
win10-en
submitted
20/09/2021, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6200b9b9789794de4a8d78f4ae96d22.exe
Size 292KB
Sample210920-pl66qaggdk
SHA256 85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
MD5 f6200b9b9789794de4a8d78f4ae96d22
SHA1 1d18c71e7e4de5c6216653db5effba586345597c
SHA512 5fd2e93293bf2ebe5b68e747dbed842c2f4fcd74dce883ffa7daa6daf647e41f4b1926fdf2f05048b3024609ef6805fb2a6b501c92335ab37098dfb6d4defa72
MD5 SHA1 SHA512

Score

10^/10

xpertrat test evasion persistence rat trojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

XpertRAT Core Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4764-513-0x0000000000401364-mapping.dmp	xpertrat

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4828-528-0x0000000000411654-mapping.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1600-536-0x0000000000442F04-mapping.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4828-528-0x0000000000411654-mapping.dmp	Nirsoft
behavioral2/memory/1600-536-0x0000000000442F04-mapping.dmp	Nirsoft
behavioral2/memory/1824-545-0x000000000040C2A8-mapping.dmp	Nirsoft

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe"	iexplore.exe

Deletes itself 1 IoCs

pid	Process
1016	notepad.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	f6200b9b9789794de4a8d78f4ae96d22.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f6200b9b9789794de4a8d78f4ae96d22.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1304	4796	WerFault.exe	82
1436	4860	WerFault.exe	86
4884	4876	WerFault.exe	88

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 3388 set thread context of 4720	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	78
PID 4720 set thread context of 4764	4720	f6200b9b9789794de4a8d78f4ae96d22.exe	79
PID 4764 set thread context of 4784	4764	iexplore.exe	81
PID 4764 set thread context of 4796	4764	iexplore.exe	82
PID 4764 set thread context of 4828	4764	iexplore.exe	85
PID 4764 set thread context of 4860	4764	iexplore.exe	86
PID 4764 set thread context of 4876	4764	iexplore.exe	88
PID 4764 set thread context of 1600	4764	iexplore.exe	90
PID 4764 set thread context of 1672	4764	iexplore.exe	91
PID 4764 set thread context of 1824	4764	iexplore.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3888	powershell.exe
3584	powershell.exe
3928	powershell.exe
3584	powershell.exe
3928	powershell.exe
3888	powershell.exe
3888	powershell.exe
3584	powershell.exe
3928	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3388	f6200b9b9789794de4a8d78f4ae96d22.exe
3388	f6200b9b9789794de4a8d78f4ae96d22.exe
3388	f6200b9b9789794de4a8d78f4ae96d22.exe
3388	f6200b9b9789794de4a8d78f4ae96d22.exe
3388	f6200b9b9789794de4a8d78f4ae96d22.exe
3388	f6200b9b9789794de4a8d78f4ae96d22.exe
4720	f6200b9b9789794de4a8d78f4ae96d22.exe
4720	f6200b9b9789794de4a8d78f4ae96d22.exe
4784	iexplore.exe
4784	iexplore.exe
4720	f6200b9b9789794de4a8d78f4ae96d22.exe
4720	f6200b9b9789794de4a8d78f4ae96d22.exe
1600	iexplore.exe
1600	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeIncreaseQuotaPrivilege	3928	powershell.exe
Token: SeSecurityPrivilege	3928	powershell.exe
Token: SeTakeOwnershipPrivilege	3928	powershell.exe
Token: SeLoadDriverPrivilege	3928	powershell.exe
Token: SeSystemProfilePrivilege	3928	powershell.exe
Token: SeSystemtimePrivilege	3928	powershell.exe
Token: SeProfSingleProcessPrivilege	3928	powershell.exe
Token: SeIncBasePriorityPrivilege	3928	powershell.exe
Token: SeCreatePagefilePrivilege	3928	powershell.exe
Token: SeBackupPrivilege	3928	powershell.exe
Token: SeRestorePrivilege	3928	powershell.exe
Token: SeShutdownPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeSystemEnvironmentPrivilege	3928	powershell.exe
Token: SeRemoteShutdownPrivilege	3928	powershell.exe
Token: SeUndockPrivilege	3928	powershell.exe
Token: SeManageVolumePrivilege	3928	powershell.exe
Token: 33	3928	powershell.exe
Token: 34	3928	powershell.exe
Token: 35	3928	powershell.exe
Token: 36	3928	powershell.exe
Token: SeIncreaseQuotaPrivilege	3584	powershell.exe
Token: SeSecurityPrivilege	3584	powershell.exe
Token: SeTakeOwnershipPrivilege	3584	powershell.exe
Token: SeLoadDriverPrivilege	3584	powershell.exe
Token: SeSystemProfilePrivilege	3584	powershell.exe
Token: SeSystemtimePrivilege	3584	powershell.exe
Token: SeProfSingleProcessPrivilege	3584	powershell.exe
Token: SeIncBasePriorityPrivilege	3584	powershell.exe
Token: SeCreatePagefilePrivilege	3584	powershell.exe
Token: SeBackupPrivilege	3584	powershell.exe
Token: SeRestorePrivilege	3584	powershell.exe
Token: SeShutdownPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeSystemEnvironmentPrivilege	3584	powershell.exe
Token: SeRemoteShutdownPrivilege	3584	powershell.exe
Token: SeUndockPrivilege	3584	powershell.exe
Token: SeManageVolumePrivilege	3584	powershell.exe
Token: 33	3584	powershell.exe
Token: 34	3584	powershell.exe
Token: 35	3584	powershell.exe
Token: 36	3584	powershell.exe
Token: SeIncreaseQuotaPrivilege	3888	powershell.exe
Token: SeSecurityPrivilege	3888	powershell.exe
Token: SeTakeOwnershipPrivilege	3888	powershell.exe
Token: SeLoadDriverPrivilege	3888	powershell.exe
Token: SeSystemProfilePrivilege	3888	powershell.exe
Token: SeSystemtimePrivilege	3888	powershell.exe
Token: SeProfSingleProcessPrivilege	3888	powershell.exe
Token: SeIncBasePriorityPrivilege	3888	powershell.exe
Token: SeCreatePagefilePrivilege	3888	powershell.exe
Token: SeBackupPrivilege	3888	powershell.exe
Token: SeRestorePrivilege	3888	powershell.exe
Token: SeShutdownPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeSystemEnvironmentPrivilege	3888	powershell.exe
Token: SeRemoteShutdownPrivilege	3888	powershell.exe
Token: SeUndockPrivilege	3888	powershell.exe
Token: SeManageVolumePrivilege	3888	powershell.exe
Token: 33	3888	powershell.exe
Token: 34	3888	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4720	f6200b9b9789794de4a8d78f4ae96d22.exe
4764	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 3928	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	69
PID 3388 wrote to memory of 3888	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	70
PID 3388 wrote to memory of 3928	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	69
PID 3388 wrote to memory of 3888	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	70
PID 3388 wrote to memory of 3928	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	69
PID 3388 wrote to memory of 3888	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	70
PID 3388 wrote to memory of 3584	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	73
PID 3388 wrote to memory of 3584	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	73
PID 3388 wrote to memory of 3584	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	73
PID 3388 wrote to memory of 3032	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	75
PID 3388 wrote to memory of 3032	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	75
PID 3388 wrote to memory of 3032	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	75
PID 3388 wrote to memory of 4716	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	77
PID 3388 wrote to memory of 4716	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	77
PID 3388 wrote to memory of 4716	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	77
PID 3388 wrote to memory of 4720	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	78
PID 3388 wrote to memory of 4720	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	78
PID 3388 wrote to memory of 4720	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	78
PID 3388 wrote to memory of 4720	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	78
PID 3388 wrote to memory of 4720	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	78
PID 3388 wrote to memory of 4720	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	78
PID 3388 wrote to memory of 4720	3388	f6200b9b9789794de4a8d78f4ae96d22.exe	78
PID 4720 wrote to memory of 4764	4720	f6200b9b9789794de4a8d78f4ae96d22.exe	79
PID 4720 wrote to memory of 4764	4720	f6200b9b9789794de4a8d78f4ae96d22.exe	79
PID 4720 wrote to memory of 4764	4720	f6200b9b9789794de4a8d78f4ae96d22.exe	79
PID 4720 wrote to memory of 4764	4720	f6200b9b9789794de4a8d78f4ae96d22.exe	79
PID 4720 wrote to memory of 4764	4720	f6200b9b9789794de4a8d78f4ae96d22.exe	79
PID 4720 wrote to memory of 4764	4720	f6200b9b9789794de4a8d78f4ae96d22.exe	79
PID 4720 wrote to memory of 4764	4720	f6200b9b9789794de4a8d78f4ae96d22.exe	79
PID 4720 wrote to memory of 4764	4720	f6200b9b9789794de4a8d78f4ae96d22.exe	79
PID 4764 wrote to memory of 1016	4764	iexplore.exe	80
PID 4764 wrote to memory of 1016	4764	iexplore.exe	80
PID 4764 wrote to memory of 1016	4764	iexplore.exe	80
PID 4764 wrote to memory of 1016	4764	iexplore.exe	80
PID 4764 wrote to memory of 4784	4764	iexplore.exe	81
PID 4764 wrote to memory of 4784	4764	iexplore.exe	81
PID 4764 wrote to memory of 4784	4764	iexplore.exe	81
PID 4764 wrote to memory of 4784	4764	iexplore.exe	81
PID 4764 wrote to memory of 4784	4764	iexplore.exe	81
PID 4764 wrote to memory of 4784	4764	iexplore.exe	81
PID 4764 wrote to memory of 4784	4764	iexplore.exe	81
PID 4764 wrote to memory of 4784	4764	iexplore.exe	81
PID 4764 wrote to memory of 4796	4764	iexplore.exe	82
PID 4764 wrote to memory of 4796	4764	iexplore.exe	82
PID 4764 wrote to memory of 4796	4764	iexplore.exe	82
PID 4764 wrote to memory of 4796	4764	iexplore.exe	82
PID 4764 wrote to memory of 4796	4764	iexplore.exe	82
PID 4764 wrote to memory of 4796	4764	iexplore.exe	82
PID 4764 wrote to memory of 4796	4764	iexplore.exe	82
PID 4764 wrote to memory of 4796	4764	iexplore.exe	82
PID 4764 wrote to memory of 4796	4764	iexplore.exe	82
PID 4764 wrote to memory of 4828	4764	iexplore.exe	85
PID 4764 wrote to memory of 4828	4764	iexplore.exe	85
PID 4764 wrote to memory of 4828	4764	iexplore.exe	85
PID 4764 wrote to memory of 4828	4764	iexplore.exe	85
PID 4764 wrote to memory of 4828	4764	iexplore.exe	85
PID 4764 wrote to memory of 4828	4764	iexplore.exe	85
PID 4764 wrote to memory of 4828	4764	iexplore.exe	85
PID 4764 wrote to memory of 4828	4764	iexplore.exe	85
PID 4764 wrote to memory of 4828	4764	iexplore.exe	85
PID 4764 wrote to memory of 4860	4764	iexplore.exe	86
PID 4764 wrote to memory of 4860	4764	iexplore.exe	86
PID 4764 wrote to memory of 4860	4764	iexplore.exe	86
PID 4764 wrote to memory of 4860	4764	iexplore.exe	86

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
"C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.facebook.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.twitter.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
  C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
  2⤵
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
  C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
  2⤵
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4720
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
    3⤵
    - Adds policy Run key to start application
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      4⤵
      Deletes itself
      PID:1016
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck0.txt"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4784
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck1.txt"
      4⤵
      PID:4796
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 92
        5⤵
        Program crash
        
        PID:1304
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck1.txt"
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck2.txt"
      4⤵
      PID:4860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 92
        5⤵
        Program crash
        
        PID:1436
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck2.txt"
      4⤵
      PID:4876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 92
        5⤵
        Program crash
        
        PID:4884
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck2.txt"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1600
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck3.txt"
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck4.txt"
      4⤵
      PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-455-0x0000000001033000-0x0000000001034000-memory.dmp

Download

memory/3032-413-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/3032-415-0x0000000001032000-0x0000000001033000-memory.dmp

Download

memory/3388-505-0x0000000006F10000-0x0000000006F56000-memory.dmp

Download

memory/3388-119-0x0000000004B70000-0x0000000004B71000-memory.dmp

Download

memory/3388-115-0x00000000002E0000-0x00000000002E1000-memory.dmp

Download

memory/3388-506-0x0000000005010000-0x0000000005040000-memory.dmp

Download

memory/3388-120-0x0000000004B00000-0x0000000004B01000-memory.dmp

Download

memory/3388-118-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/3388-117-0x0000000005040000-0x0000000005041000-memory.dmp

Download

memory/3584-139-0x0000000006B40000-0x0000000006B41000-memory.dmp

Download

memory/3584-154-0x0000000007A10000-0x0000000007A11000-memory.dmp

Download

memory/3584-151-0x0000000007580000-0x0000000007581000-memory.dmp

Download

memory/3584-144-0x0000000000E52000-0x0000000000E53000-memory.dmp

Download

memory/3584-138-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/3584-209-0x0000000000E53000-0x0000000000E54000-memory.dmp

Download

memory/3888-208-0x0000000006BA3000-0x0000000006BA4000-memory.dmp

Download

memory/3888-142-0x0000000006BA2000-0x0000000006BA3000-memory.dmp

Download

memory/3888-160-0x00000000082E0000-0x00000000082E1000-memory.dmp

Download

memory/3888-136-0x0000000006BA0000-0x0000000006BA1000-memory.dmp

Download

memory/3888-148-0x0000000007A90000-0x0000000007A91000-memory.dmp

Download

memory/3888-145-0x00000000079B0000-0x00000000079B1000-memory.dmp

Download

memory/3928-157-0x00000000089F0000-0x00000000089F1000-memory.dmp

Download

memory/3928-133-0x0000000007940000-0x0000000007941000-memory.dmp

Download

memory/3928-210-0x0000000007303000-0x0000000007304000-memory.dmp

Download

memory/3928-205-0x000000000A9D0000-0x000000000A9D1000-memory.dmp

Download

memory/3928-137-0x0000000007300000-0x0000000007301000-memory.dmp

Download

memory/3928-143-0x0000000007302000-0x0000000007303000-memory.dmp

Download

memory/3928-171-0x00000000098B0000-0x00000000098B1000-memory.dmp

Download

memory/3928-176-0x00000000095A0000-0x00000000095A1000-memory.dmp

Download

memory/3928-179-0x00000000095C0000-0x00000000095C1000-memory.dmp

Download

memory/3928-130-0x0000000004D80000-0x0000000004D81000-memory.dmp

Download

memory/4720-507-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4720-511-0x0000000000400000-0x000000000042C000-memory.dmp

Download