gh0strat | 46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a

General

Target

46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe
Size

252KB
MD5

7c77f7a1ebddd9579a7567dedb131a95
SHA1

76aedce6c1483506c33f1cb00cbe72a4f9387427
SHA256

46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a
SHA512

3187ca40dd4c3fb9aead5b5eef1682a1128c957a41df1d5d0947b1f666c04737aacbdbb5c7deb9a2fb276a77437b456695f55e8429362fd68de5660e9da82e73

Score

10^/10

gh0strat evasion rat trojan

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1932-55-0x0000000010000000-0x0000000010032000-memory.dmp	family_gh0strat
behavioral1/memory/2036-75-0x0000000010000000-0x0000000010032000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 2 IoCs

Processes:

Eoksc.pifEoksc.pif

pid process

2040 Eoksc.pif
2036 Eoksc.pif
Loads dropped DLL 5 IoCs

Processes:

Eoksc.pifWerFault.exe

pid process

2040 Eoksc.pif
1968 WerFault.exe
1968 WerFault.exe
1968 WerFault.exe
1968 WerFault.exe

pid	process
2040	Eoksc.pif
2036	Eoksc.pif

pid	process
2040	Eoksc.pif
1968	WerFault.exe
1968	WerFault.exe
1968	WerFault.exe
1968	WerFault.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exeEoksc.pifEoksc.pif

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Eoksc.pif
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Eoksc.pif

Drops file in System32 directory 5 IoCs

Processes:

Eoksc.pif

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	Eoksc.pif
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	Eoksc.pif
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_B2FEEE6B08CF6C854CB2A5F3B5EFD61C	Eoksc.pif
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_B2FEEE6B08CF6C854CB2A5F3B5EFD61C	Eoksc.pif
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Eoksc.pif

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1968 2040 WerFault.exe Eoksc.pif

pid	pid_target	process	target process
1968	2040	WerFault.exe	Eoksc.pif

Modifies data under HKEY_USERS 64 IoCs

Processes:

Eoksc.pif

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Eoksc.pif
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Eoksc.pif
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0BD3DB-3DFA-4793-A0E3-2520BF657DAF}\WpadDecisionReason = "1"	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Eoksc.pif
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0BD3DB-3DFA-4793-A0E3-2520BF657DAF}	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Eoksc.pif
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	Eoksc.pif
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Eoksc.pif
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Eoksc.pif
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Eoksc.pif
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-e6-3b-2c-4f-61\WpadDecisionReason = "1"	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Eoksc.pif
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Eoksc.pif
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Eoksc.pif
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Eoksc.pif
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0BD3DB-3DFA-4793-A0E3-2520BF657DAF}\WpadNetworkName = "Network 3"	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-e6-3b-2c-4f-61	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Eoksc.pif
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Eoksc.pif
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0BD3DB-3DFA-4793-A0E3-2520BF657DAF}\WpadDecisionTime = d03ae550ff6cd801	Eoksc.pif
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0BD3DB-3DFA-4793-A0E3-2520BF657DAF}\WpadDecision = "0"	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0BD3DB-3DFA-4793-A0E3-2520BF657DAF}\b2-e6-3b-2c-4f-61	Eoksc.pif
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-e6-3b-2c-4f-61\WpadDecisionTime = d03ae550ff6cd801	Eoksc.pif
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-e6-3b-2c-4f-61\WpadDecision = "0"	Eoksc.pif
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Eoksc.pif

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Eoksc.pif

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Eoksc.pif
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Eoksc.pif

Suspicious behavior: RenamesItself 1 IoCs

Processes:

46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe

pid process

1932 46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe

pid	process
1932	46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Eoksc.pif

description	pid	process	target process
PID 2040 wrote to memory of 2036	2040	Eoksc.pif	Eoksc.pif
PID 2040 wrote to memory of 2036	2040	Eoksc.pif	Eoksc.pif
PID 2040 wrote to memory of 2036	2040	Eoksc.pif	Eoksc.pif
PID 2040 wrote to memory of 2036	2040	Eoksc.pif	Eoksc.pif
PID 2040 wrote to memory of 1968	2040	Eoksc.pif	WerFault.exe
PID 2040 wrote to memory of 1968	2040	Eoksc.pif	WerFault.exe
PID 2040 wrote to memory of 1968	2040	Eoksc.pif	WerFault.exe
PID 2040 wrote to memory of 1968	2040	Eoksc.pif	WerFault.exe

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

Processes:

Eoksc.pifEoksc.pif46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Eoksc.pif
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Eoksc.pif
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Eoksc.pif
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Eoksc.pif
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Eoksc.pif
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Eoksc.pif

C:\Users\Admin\AppData\Local\Temp\46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe
"C:\Users\Admin\AppData\Local\Temp\46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: RenamesItself
- System policy modification
PID:1932

C:\ProgramData\Application Data\Microsoft.NET\Eoksc.pif
"C:\ProgramData\Application Data\Microsoft.NET\Eoksc.pif"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2040
- C:\ProgramData\Application Data\Microsoft.NET\Eoksc.pif
  "C:\ProgramData\Application Data\Microsoft.NET\Eoksc.pif" Win7
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - System policy modification
  PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 256
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Application Data\Microsoft.NET\Eoksc.pif

Filesize
252KB

MD5
7c77f7a1ebddd9579a7567dedb131a95

SHA1
76aedce6c1483506c33f1cb00cbe72a4f9387427

SHA256
46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a

SHA512
3187ca40dd4c3fb9aead5b5eef1682a1128c957a41df1d5d0947b1f666c04737aacbdbb5c7deb9a2fb276a77437b456695f55e8429362fd68de5660e9da82e73

Download Submit
C:\ProgramData\Microsoft.NET\Eoksc.pif

Filesize
252KB

MD5
7c77f7a1ebddd9579a7567dedb131a95

SHA1
76aedce6c1483506c33f1cb00cbe72a4f9387427

SHA256
46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a

SHA512
3187ca40dd4c3fb9aead5b5eef1682a1128c957a41df1d5d0947b1f666c04737aacbdbb5c7deb9a2fb276a77437b456695f55e8429362fd68de5660e9da82e73

Download Submit
C:\ProgramData\Microsoft.NET\Eoksc.pif

Filesize
252KB

MD5
7c77f7a1ebddd9579a7567dedb131a95

SHA1
76aedce6c1483506c33f1cb00cbe72a4f9387427

SHA256
46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a

SHA512
3187ca40dd4c3fb9aead5b5eef1682a1128c957a41df1d5d0947b1f666c04737aacbdbb5c7deb9a2fb276a77437b456695f55e8429362fd68de5660e9da82e73

Download Submit
\ProgramData\Microsoft.NET\Eoksc.pif

Filesize
252KB

MD5
7c77f7a1ebddd9579a7567dedb131a95

SHA1
76aedce6c1483506c33f1cb00cbe72a4f9387427

SHA256
46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a

SHA512
3187ca40dd4c3fb9aead5b5eef1682a1128c957a41df1d5d0947b1f666c04737aacbdbb5c7deb9a2fb276a77437b456695f55e8429362fd68de5660e9da82e73

Download Submit
\ProgramData\Microsoft.NET\Eoksc.pif

Filesize
252KB

MD5
7c77f7a1ebddd9579a7567dedb131a95

SHA1
76aedce6c1483506c33f1cb00cbe72a4f9387427

SHA256
46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a

SHA512
3187ca40dd4c3fb9aead5b5eef1682a1128c957a41df1d5d0947b1f666c04737aacbdbb5c7deb9a2fb276a77437b456695f55e8429362fd68de5660e9da82e73

Download Submit
\ProgramData\Microsoft.NET\Eoksc.pif

Filesize
252KB

MD5
7c77f7a1ebddd9579a7567dedb131a95

SHA1
76aedce6c1483506c33f1cb00cbe72a4f9387427

SHA256
46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a

SHA512
3187ca40dd4c3fb9aead5b5eef1682a1128c957a41df1d5d0947b1f666c04737aacbdbb5c7deb9a2fb276a77437b456695f55e8429362fd68de5660e9da82e73

Download Submit
\ProgramData\Microsoft.NET\Eoksc.pif

Filesize
252KB

MD5
7c77f7a1ebddd9579a7567dedb131a95

SHA1
76aedce6c1483506c33f1cb00cbe72a4f9387427

SHA256
46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a

SHA512
3187ca40dd4c3fb9aead5b5eef1682a1128c957a41df1d5d0947b1f666c04737aacbdbb5c7deb9a2fb276a77437b456695f55e8429362fd68de5660e9da82e73

Download Submit
\ProgramData\Microsoft.NET\Eoksc.pif

Filesize
252KB

MD5
7c77f7a1ebddd9579a7567dedb131a95

SHA1
76aedce6c1483506c33f1cb00cbe72a4f9387427

SHA256
46228923291ceab1c75887af7394832bbb68bdd840b3d10c7bda8f2f5e85b25a

SHA512
3187ca40dd4c3fb9aead5b5eef1682a1128c957a41df1d5d0947b1f666c04737aacbdbb5c7deb9a2fb276a77437b456695f55e8429362fd68de5660e9da82e73

Download Submit
memory/1932-55-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/1932-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1968-70-0x0000000000000000-mapping.dmp

Download
memory/2036-67-0x0000000000000000-mapping.dmp

Download
memory/2036-75-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads