hawkeye_reborn | 3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-07-2022 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Size

813KB
MD5

be04d13e880984969b6d7eb4faf58a50
SHA1

815223967c0f594e4834dd58abf4ec87a57c53ec
SHA256

3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92
SHA512

bb19f6a902d68fbcae1a21394b10b9cc159fe6c87874b7fe8f8577197f86fd14a2f8f6a6938870e65063b199a320f7648bb3fd6f3cd9e8812c0c63be11b0e8c4

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 8 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/1492-141-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral2/memory/1492-143-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral2/memory/1492-144-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral2/memory/1492-145-0x0000000000402000-0x000000000048B200-memory.dmp	m00nd3v_logger
behavioral2/memory/1492-146-0x0000000000402000-0x000000000048B200-memory.dmp	m00nd3v_logger
behavioral2/memory/1492-147-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral2/memory/1492-149-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral2/memory/1492-151-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "rundll32.exe"	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe

Loads dropped DLL 5 IoCs

pid	Process
4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4124 set thread context of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4392 set thread context of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4900	1492	WerFault.exe	83
1996	1492	WerFault.exe	83

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4124 wrote to memory of 4392	4124	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	82
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83
PID 4392 wrote to memory of 1492	4392	3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe	83

C:\Users\Admin\AppData\Local\Temp\3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
"C:\Users\Admin\AppData\Local\Temp\3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
  "C:\Users\Admin\AppData\Local\Temp\3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe
    "C:\Users\Admin\AppData\Local\Temp\3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92.exe"
    3⤵
    - Sets file execution options in registry
    PID:1492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 140
      4⤵
      Program crash
      PID:4900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1716
      4⤵
      Program crash
      PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 1492 -ip 1492
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1492 -ip 1492
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lysis.dll

Filesize
78KB

MD5
ac90321d9947dd1e4fd41e1a5e5c9f7d

SHA1
d21e1af8e984633c543e6ba3158316765872497b

SHA256
698ed66ab1863eb859cf79a9077468a1f0f1df46ccbdd7d006eb41ca7a9d3880

SHA512
68cba99ae7740a35a87d7bca3d03155de932cee8cb3144e12c6a028f87cc01ee7d9ce746c6739260cde3b396a2cc3adc7384e822efa8c8777bc6c9ebc0dbb640

Download Submit
C:\Users\Admin\AppData\Local\Temp\lysis.dll

Filesize
78KB

MD5
ac90321d9947dd1e4fd41e1a5e5c9f7d

SHA1
d21e1af8e984633c543e6ba3158316765872497b

SHA256
698ed66ab1863eb859cf79a9077468a1f0f1df46ccbdd7d006eb41ca7a9d3880

SHA512
68cba99ae7740a35a87d7bca3d03155de932cee8cb3144e12c6a028f87cc01ee7d9ce746c6739260cde3b396a2cc3adc7384e822efa8c8777bc6c9ebc0dbb640

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfA176.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfA176.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfA176.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/1492-141-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1492-144-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1492-152-0x00000000744F0000-0x0000000074AA1000-memory.dmp

Filesize
5.7MB

Download
memory/1492-151-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1492-150-0x00000000744F0000-0x0000000074AA1000-memory.dmp

Filesize
5.7MB

Download
memory/1492-143-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1492-149-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1492-145-0x0000000000402000-0x000000000048B200-memory.dmp

Filesize
548KB

Download
memory/1492-146-0x0000000000402000-0x000000000048B200-memory.dmp

Filesize
548KB

Download
memory/1492-147-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1492-148-0x00000000744F0000-0x0000000074AA1000-memory.dmp

Filesize
5.7MB

Download
memory/4124-135-0x00000000022B0000-0x00000000022C8000-memory.dmp

Filesize
96KB

Download
memory/4392-139-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4392-137-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download