General
Target

3ee9471ac58b08b6bf94434c852c9beb714fc9528671e9f0e844c51199a32384.exe

Filesize

908KB

Completed

21-05-2022 00:34

Task

behavioral2

Score
10/10
MD5

c4afbd6e19c17dbbc1c73898c3595562

SHA1

2fcb0502909895b07017a03f50a57b6530e9a294

SHA256

3ee9471ac58b08b6bf94434c852c9beb714fc9528671e9f0e844c51199a32384

SHA512

30bab75ef8a03a41ec8f5820a54d14fef323fa0bf1a2368e08af8765826531cbe5fc7b8aee7063de930214e4157b483ae0ae0762565482481e24f75a572a695b

Malware Config

Extracted

Family

gozi_rm3

Attributes
build
300854
exe_type
loader

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12
url_path
index.htm
rsa_pubkey.plain
serpent.plain
Signatures 5

Filter: none

Defense Evasion
  • Gozi RM3

    Description

    A heavily modified version of Gozi using RM3 loader.

  • Modifies Internet Explorer settings
    iexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (data)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000a2660e9187252f8bdc7c5426ba9b922c3d770a0b22d5ca911c1df6194374c6b5000000000e800000000200002000000073bd0c97cd9e5655c5e15141d9ab096a2fe8a5fd4b03e6089ed1d063c1e8ff5d2000000068355c9489ec042419cd3d89905e0047efc0b53c3e766ffc77c7e9f31b813f0540000000a0004f568d21b3e2954081c5eb8dadaa4d713d558023510416d353be7cfd07e94068469a01a5d603d901d08028eb108eedda3ec2ce35c64ecf92c198599e2363iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce1000000000200000000001066000000010000200000003e183a3c77fcd3a78979740d075644ca42edacd52f2b0b5eeab3978c56ba387d000000000e80000000020000200000002dade568d0603542a54cc28eb88ed1422d78bca755b5458c22a0b5a13f8867fc20000000e1a7006a30bef93d02b4b60bd06665b818948352895960358201628b43698425400000001566ae0cbcd765b0ef56d4ca34ecea2d4c1420a1c13fc5bfe3c8644c2dc855130f7d1db377c3e8c3b57286eb20c5e437243c389af8b863fc27096d6613d32d7eiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{65C06E51-D89D-11EC-AD90-C618EE80FC43} = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30960810"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000d105b82d994e21a8920d3568eb9a98a9bce15d569c0d53b6c5176cd587ff9d69000000000e80000000020000200000004b65b123a5b8e345db48ac14ee243e235b8b832820b5dc17a9f4547175016e5f20000000635ae50715b271f5ba18a5b850d965a2d45fd7660d257de9b08d93b190a1229640000000c33d6238c96f3ff4231caba1d08707b3acca647cd342c110f9fe6803320d98a055979184e9ace34cdcda3614c3eae99eb372cd6a4e24909a01c6a43f3b19dc95iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8825392E-D89D-11EC-AD90-C618EE80FC43} = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000505c9f99edc31ae418e961ff4cdee06c7e6d1b2ba84ce42ddbbd85df4ad3b747000000000e80000000020000200000000917985afc3979a08ac8917677627f5decf4f1f230154859dee3a13fd0d7c59520000000ed8f0d1c912d8726dd1202f0afb08304746e06c029957400c1b12bd2c61aff2e40000000b1b54718c1c029ed8ce61cfae684a14c15a4e336c8ee240eb0a6379e9461a52dbdf3a156a14bf01a99ded014d73b21c7d870e8af233ab7920262f25493e0e236iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{954E16AB-D89D-11EC-AD90-C618EE80FC43} = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManageriexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AF9B06C5-D89D-11EC-AD90-C618EE80FC43} = "0"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce1000000000200000000001066000000010000200000008573bda2bea9d28a92b2c185af88dbcf61f307d7b85c2737b7e1a1ae4e622e3b000000000e8000000002000020000000f1f7e183788d1271d1e05cb9bbbc8eda6cc9885566a1078d49cef211e477c4db2000000000175f9c258c6215dd266e9c00f686c925158de97a9b2aff7a02079e2c4beb7840000000f5c2d7dcf950dadd8eb8a5e6e1879e47e8b093f34bba7e5a18a423fcf09594c9a8256b6c1b84e23f3a29124ca38efbc611958d8fc712c28b4019a4c7adb2cf90iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10190c3eaa6cd801iexplore.exe
  • Suspicious use of FindShellTrayWindow
    iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

    Reported IOCs

    pidprocess
    1324iexplore.exe
    1324iexplore.exe
    2552iexplore.exe
    4440iexplore.exe
    404iexplore.exe
    360iexplore.exe
    4764iexplore.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

    Reported IOCs

    pidprocess
    1324iexplore.exe
    1324iexplore.exe
    3716IEXPLORE.EXE
    3716IEXPLORE.EXE
    1324iexplore.exe
    1324iexplore.exe
    4208IEXPLORE.EXE
    4208IEXPLORE.EXE
    2552iexplore.exe
    2552iexplore.exe
    4292IEXPLORE.EXE
    4292IEXPLORE.EXE
    4440iexplore.exe
    4440iexplore.exe
    3224IEXPLORE.EXE
    3224IEXPLORE.EXE
    404iexplore.exe
    404iexplore.exe
    4472IEXPLORE.EXE
    4472IEXPLORE.EXE
    360iexplore.exe
    360iexplore.exe
    1408IEXPLORE.EXE
    1408IEXPLORE.EXE
    4764iexplore.exe
    4764iexplore.exe
    4020IEXPLORE.EXE
    4020IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1324 wrote to memory of 37161324iexplore.exeIEXPLORE.EXE
    PID 1324 wrote to memory of 37161324iexplore.exeIEXPLORE.EXE
    PID 1324 wrote to memory of 37161324iexplore.exeIEXPLORE.EXE
    PID 1324 wrote to memory of 42081324iexplore.exeIEXPLORE.EXE
    PID 1324 wrote to memory of 42081324iexplore.exeIEXPLORE.EXE
    PID 1324 wrote to memory of 42081324iexplore.exeIEXPLORE.EXE
    PID 2552 wrote to memory of 42922552iexplore.exeIEXPLORE.EXE
    PID 2552 wrote to memory of 42922552iexplore.exeIEXPLORE.EXE
    PID 2552 wrote to memory of 42922552iexplore.exeIEXPLORE.EXE
    PID 4440 wrote to memory of 32244440iexplore.exeIEXPLORE.EXE
    PID 4440 wrote to memory of 32244440iexplore.exeIEXPLORE.EXE
    PID 4440 wrote to memory of 32244440iexplore.exeIEXPLORE.EXE
    PID 404 wrote to memory of 4472404iexplore.exeIEXPLORE.EXE
    PID 404 wrote to memory of 4472404iexplore.exeIEXPLORE.EXE
    PID 404 wrote to memory of 4472404iexplore.exeIEXPLORE.EXE
    PID 360 wrote to memory of 1408360iexplore.exeIEXPLORE.EXE
    PID 360 wrote to memory of 1408360iexplore.exeIEXPLORE.EXE
    PID 360 wrote to memory of 1408360iexplore.exeIEXPLORE.EXE
    PID 4764 wrote to memory of 40204764iexplore.exeIEXPLORE.EXE
    PID 4764 wrote to memory of 40204764iexplore.exeIEXPLORE.EXE
    PID 4764 wrote to memory of 40204764iexplore.exeIEXPLORE.EXE
Processes 15
  • C:\Users\Admin\AppData\Local\Temp\3ee9471ac58b08b6bf94434c852c9beb714fc9528671e9f0e844c51199a32384.exe
    "C:\Users\Admin\AppData\Local\Temp\3ee9471ac58b08b6bf94434c852c9beb714fc9528671e9f0e844c51199a32384.exe"
    PID:4820
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    PID:4692
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3716
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:17416 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4208
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:17410 /prefetch:2
      Suspicious use of SetWindowsHookEx
      PID:4292
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3224
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:404
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:404 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4472
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:360
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:360 CREDAT:17410 /prefetch:2
      Suspicious use of SetWindowsHookEx
      PID:1408
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4764 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4020
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/4820-130-0x0000000000690000-0x00000000006A1000-memory.dmp

                        • memory/4820-135-0x0000000000560000-0x000000000056C000-memory.dmp

                        • memory/4820-137-0x0000000000400000-0x00000000004E5000-memory.dmp