neshta | 09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8

General

Target

09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exe
Size

786KB
MD5

1cdf8fa8ddae20c8c6a302e67f1f4acb
SHA1

b0dc15105131707ce20039df436463549fb4b913
SHA256

09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8
SHA512

27e160208c212d7cbbe3293233c7bd6301eb0d6a54191560017af3a2ae90d286f369cd4180d7959de4071effc621f84996e4ae4f7ec02dfc45851755d4411a75

Score

10^/10

neshta netwire botnet persistence rat spyware stealer

Malware Config

Extracted

Family

netwire

C2

cctv-home.ddns.me:3360

cctv-home.serveftp.com:3360

Attributes

activex_autorun
true
activex_key
{R5Q8L480-V2I5-AA1A-5GR0-RGV5X2101O0D}
copy_executable
true
delete_original
false
host_id
Money
install_path
%AppData%\Microcoft\operas.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
YwkrXNoi
offline_keylogger
true
password
dick
registry_autorun
true
startup_name
BrowsersPriv
use_mutex
true

Signatures

Detect Neshta Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Host.exe	family_neshta
C:\Users\Admin\AppData\Local\Temp\Host.exe	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1042

Processes:

Host.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Host.exe
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Host.exe

NetWire RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Host.exe	netwire
C:\Users\Admin\AppData\Local\Temp\Host.exe	netwire
C:\Users\Admin\AppData\Local\Temp\3582-490\Host.exe	netwire
C:\Users\Admin\AppData\Local\Temp\3582-490\Host.exe	netwire
C:\Users\Admin\AppData\Roaming\Microcoft\operas.exe	netwire
C:\Users\Admin\AppData\Roaming\Microcoft\operas.exe	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3692 created 2292 3692 WerFault.exe Paypal Valid Email Checker By X-SLAYER.exe
Executes dropped EXE 4 IoCs

Processes:

Host.exePaypal Valid Email Checker By X-SLAYER.exeHost.exeoperas.exe

pid process

2992 Host.exe
2292 Paypal Valid Email Checker By X-SLAYER.exe
3936 Host.exe
2612 operas.exe
Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

description	pid	process	target process
PID 3692 created 2292	3692	WerFault.exe	Paypal Valid Email Checker By X-SLAYER.exe

pid	process
2992	Host.exe
2292	Paypal Valid Email Checker By X-SLAYER.exe
3936	Host.exe
2612	operas.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exeHost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Host.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

operas.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BrowsersPriv = "C:\\Users\\Admin\\AppData\\Roaming\\Microcoft\\operas.exe"	operas.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	operas.exe

Drops file in Program Files directory 64 IoCs

Processes:

Host.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	Host.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\BHO\IE_TO_~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	Host.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	Host.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	Host.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	Host.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\IDENTI~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~4.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	Host.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\msedge.exe	Host.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\PWAHEL~1.EXE	Host.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	Host.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	Host.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	Host.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~3.EXE	Host.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\ELEVAT~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~2.EXE	Host.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	Host.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	Host.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	Host.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI9C33~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\COOKIE~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{A9F77~1\EDGEMI~1.TMP\setup.exe	Host.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	Host.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	Host.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~2.EXE	Host.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	Host.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	Host.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	Host.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	Host.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	Host.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	Host.exe

Drops file in Windows directory 9 IoCs

Processes:

svchost.exeTiWorker.exeHost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\svchost.com	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3628 2292 WerFault.exe Paypal Valid Email Checker By X-SLAYER.exe

pid	pid_target	process	target process
3628	2292	WerFault.exe	Paypal Valid Email Checker By X-SLAYER.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Modifies registry class 1 IoCs

Processes:

Host.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Host.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WerFault.exe

pid process

3628 WerFault.exe
3628 WerFault.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Host.exe

pid	process
3628	WerFault.exe
3628	WerFault.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	3108	svchost.exe
Token: SeCreatePagefilePrivilege	3108	svchost.exe
Token: SeShutdownPrivilege	3108	svchost.exe
Token: SeCreatePagefilePrivilege	3108	svchost.exe
Token: SeShutdownPrivilege	3108	svchost.exe
Token: SeCreatePagefilePrivilege	3108	svchost.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe
Token: SeRestorePrivilege	3904	TiWorker.exe
Token: SeSecurityPrivilege	3904	TiWorker.exe
Token: SeBackupPrivilege	3904	TiWorker.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exeHost.exeHost.exeWerFault.exe

description	pid	process	target process
PID 1984 wrote to memory of 2992	1984	09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exe	Host.exe
PID 1984 wrote to memory of 2992	1984	09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exe	Host.exe
PID 1984 wrote to memory of 2992	1984	09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exe	Host.exe
PID 1984 wrote to memory of 2292	1984	09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exe	Paypal Valid Email Checker By X-SLAYER.exe
PID 1984 wrote to memory of 2292	1984	09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exe	Paypal Valid Email Checker By X-SLAYER.exe
PID 2992 wrote to memory of 3936	2992	Host.exe	Host.exe
PID 2992 wrote to memory of 3936	2992	Host.exe	Host.exe
PID 2992 wrote to memory of 3936	2992	Host.exe	Host.exe
PID 3936 wrote to memory of 2612	3936	Host.exe	operas.exe
PID 3936 wrote to memory of 2612	3936	Host.exe	operas.exe
PID 3936 wrote to memory of 2612	3936	Host.exe	operas.exe
PID 3692 wrote to memory of 2292	3692	WerFault.exe	Paypal Valid Email Checker By X-SLAYER.exe
PID 3692 wrote to memory of 2292	3692	WerFault.exe	Paypal Valid Email Checker By X-SLAYER.exe

C:\Users\Admin\AppData\Local\Temp\09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exe
"C:\Users\Admin\AppData\Local\Temp\09dcbd4090a6ae4c8d19ec1e357a017722c33a38abf3b610982a11e742c37da8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1984

C:\Users\Admin\AppData\Local\Temp\Host.exe
"C:\Users\Admin\AppData\Local\Temp\Host.exe"
2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2992

C:\Users\Admin\AppData\Local\Temp\3582-490\Host.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\Host.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936

C:\Users\Admin\AppData\Roaming\Microcoft\operas.exe
"C:\Users\Admin\AppData\Roaming\Microcoft\operas.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2612

C:\Users\Admin\AppData\Local\Temp\Paypal Valid Email Checker By X-SLAYER.exe
"C:\Users\Admin\AppData\Local\Temp\Paypal Valid Email Checker By X-SLAYER.exe"
2⤵
- Executes dropped EXE
PID:2292

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2292 -s 1012
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3628

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 2292 -ip 2292
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\Host.exe
MD5
ed876a1434032b34a76c5b4bf0bf5e14

SHA1
1e6fd20060088cde898a56721f267ff8ef48ea78

SHA256
249c848e47deb86e8c2d4150d6bfa04dd0b0457105d92d41af330b9433f12b0b

SHA512
3e9d6e8cda567e84db47fc0f494d0e7570c6865ecd2fd405bdfc96f728602bd06040634febec7b86ea6d6d998fd4bafc78c368d38e71575a18a9a96735c30f55

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\Host.exe
MD5
ed876a1434032b34a76c5b4bf0bf5e14

SHA1
1e6fd20060088cde898a56721f267ff8ef48ea78

SHA256
249c848e47deb86e8c2d4150d6bfa04dd0b0457105d92d41af330b9433f12b0b

SHA512
3e9d6e8cda567e84db47fc0f494d0e7570c6865ecd2fd405bdfc96f728602bd06040634febec7b86ea6d6d998fd4bafc78c368d38e71575a18a9a96735c30f55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Host.exe
MD5
03efa228bd04a6beb79975668969d863

SHA1
f039736ed906aaf6e040ac4b7ee8528e660fd83a

SHA256
b60892bf1bf647c35ca36de5e5bb00960846c07dec8700364ac01a3428c9ba53

SHA512
3e4998d3c9c4981cd1915da8e40f30ef3d53cd7b63257a6122b4159a9fa1bbadebd3b2ba013278c1c352d1864d595d61b339e7c8102a25957b105220395a3f64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Host.exe
MD5
03efa228bd04a6beb79975668969d863

SHA1
f039736ed906aaf6e040ac4b7ee8528e660fd83a

SHA256
b60892bf1bf647c35ca36de5e5bb00960846c07dec8700364ac01a3428c9ba53

SHA512
3e4998d3c9c4981cd1915da8e40f30ef3d53cd7b63257a6122b4159a9fa1bbadebd3b2ba013278c1c352d1864d595d61b339e7c8102a25957b105220395a3f64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Paypal Valid Email Checker By X-SLAYER.exe
MD5
027c04d092196816f3a02a0ce2941541

SHA1
136b3568c00734d85d77e43d9e553f8fb68ec7b7

SHA256
2b03dc71ff9e56c92868b3145268ca7fbccd4e845a61ed413725f62dbd61605b

SHA512
43d5021189c9b020eddb2e0b2c406b08f2ed82bb86e0971d9d4dd5b156b2ab95a6f70a67ba63085e2b48f6cfacbd5598576e9d5c6a7c4a30a1636ad3f3bd4b02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Paypal Valid Email Checker By X-SLAYER.exe
MD5
027c04d092196816f3a02a0ce2941541

SHA1
136b3568c00734d85d77e43d9e553f8fb68ec7b7

SHA256
2b03dc71ff9e56c92868b3145268ca7fbccd4e845a61ed413725f62dbd61605b

SHA512
43d5021189c9b020eddb2e0b2c406b08f2ed82bb86e0971d9d4dd5b156b2ab95a6f70a67ba63085e2b48f6cfacbd5598576e9d5c6a7c4a30a1636ad3f3bd4b02

Download Submit
C:\Users\Admin\AppData\Roaming\Microcoft\operas.exe
MD5
ed876a1434032b34a76c5b4bf0bf5e14

SHA1
1e6fd20060088cde898a56721f267ff8ef48ea78

SHA256
249c848e47deb86e8c2d4150d6bfa04dd0b0457105d92d41af330b9433f12b0b

SHA512
3e9d6e8cda567e84db47fc0f494d0e7570c6865ecd2fd405bdfc96f728602bd06040634febec7b86ea6d6d998fd4bafc78c368d38e71575a18a9a96735c30f55

Download Submit
C:\Users\Admin\AppData\Roaming\Microcoft\operas.exe
MD5
ed876a1434032b34a76c5b4bf0bf5e14

SHA1
1e6fd20060088cde898a56721f267ff8ef48ea78

SHA256
249c848e47deb86e8c2d4150d6bfa04dd0b0457105d92d41af330b9433f12b0b

SHA512
3e9d6e8cda567e84db47fc0f494d0e7570c6865ecd2fd405bdfc96f728602bd06040634febec7b86ea6d6d998fd4bafc78c368d38e71575a18a9a96735c30f55

Download Submit
memory/2292-134-0x0000000000110000-0x0000000000250000-memory.dmp

Filesize
1.2MB

Download
memory/2292-139-0x00007FFA9E0B3000-0x00007FFA9E0B5000-memory.dmp

Filesize
8KB

Download
memory/2292-140-0x000000001B1B0000-0x000000001B1B2000-memory.dmp

Filesize
8KB

Download
memory/3108-141-0x000002D441020000-0x000002D441030000-memory.dmp

Filesize
64KB

Download
memory/3108-142-0x000002D441080000-0x000002D441090000-memory.dmp

Filesize
64KB

Download
memory/3108-143-0x000002D443750000-0x000002D443754000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads