modiloader | 24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f

Analysis

max time kernel
161s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe
Size

844KB
MD5

61a23dbb6dd7a8199682e0d71de1dd7d
SHA1

c287ed4faf8cf6b12a227b3adccf4d34af184800
SHA256

24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f
SHA512

025ae286d36c3974890c90536b33b4ff67b29194e331239035c461180ca73f61dfb998b716aa478835b0c4a133522c23d419d22ecad34d9ff37cd5bb3b5d60c2
SSDEEP

24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	srRTMxaDv9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	roiez.exe

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000022e62-140.dat	modiloader_stage2
behavioral2/files/0x0007000000022e62-141.dat	modiloader_stage2

Executes dropped EXE 7 IoCs

pid	Process
4440	srRTMxaDv9.exe
1508	amhost.exe
344	roiez.exe
3916	bmhost.exe
2680	cmhost.exe
3948	X
4460	dmhost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	srRTMxaDv9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /m"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /O"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /u"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /x"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /f"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /t"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /M"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /h"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /s"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /L"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /v"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /X"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /o"	roiez.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	srRTMxaDv9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /l"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /e"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /k"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /T"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /g"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /d"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /w"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /J"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /T"	srRTMxaDv9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /Q"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /U"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /P"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /F"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /y"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /Y"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /V"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /A"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /H"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /B"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /n"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /i"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /D"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /r"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /G"	roiez.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /Z"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /R"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /W"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /j"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /p"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /c"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /E"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /a"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /C"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /I"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /z"	roiez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roiez = "C:\\Users\\Admin\\roiez.exe /b"	roiez.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3916 set thread context of 3912	3916	bmhost.exe	90
PID 2680 set thread context of 1876	2680	cmhost.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1908	tasklist.exe
1112	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4440	srRTMxaDv9.exe
4440	srRTMxaDv9.exe
4440	srRTMxaDv9.exe
4440	srRTMxaDv9.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe
344	roiez.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	tasklist.exe
Token: SeDebugPrivilege	3916	bmhost.exe
Token: SeDebugPrivilege	2680	cmhost.exe
Token: SeShutdownPrivilege	2220	Explorer.EXE
Token: SeCreatePagefilePrivilege	2220	Explorer.EXE
Token: SeShutdownPrivilege	2220	Explorer.EXE
Token: SeCreatePagefilePrivilege	2220	Explorer.EXE
Token: SeDebugPrivilege	1112	tasklist.exe
Token: SeShutdownPrivilege	2220	Explorer.EXE
Token: SeCreatePagefilePrivilege	2220	Explorer.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe
4440	srRTMxaDv9.exe
344	roiez.exe
4460	dmhost.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4440	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	81
PID 4872 wrote to memory of 4440	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	81
PID 4872 wrote to memory of 4440	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	81
PID 4872 wrote to memory of 1508	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	83
PID 4872 wrote to memory of 1508	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	83
PID 4872 wrote to memory of 1508	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	83
PID 4440 wrote to memory of 344	4440	srRTMxaDv9.exe	85
PID 4440 wrote to memory of 344	4440	srRTMxaDv9.exe	85
PID 4440 wrote to memory of 344	4440	srRTMxaDv9.exe	85
PID 4440 wrote to memory of 1988	4440	srRTMxaDv9.exe	86
PID 4440 wrote to memory of 1988	4440	srRTMxaDv9.exe	86
PID 4440 wrote to memory of 1988	4440	srRTMxaDv9.exe	86
PID 1988 wrote to memory of 1908	1988	cmd.exe	88
PID 1988 wrote to memory of 1908	1988	cmd.exe	88
PID 1988 wrote to memory of 1908	1988	cmd.exe	88
PID 4872 wrote to memory of 3916	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	89
PID 4872 wrote to memory of 3916	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	89
PID 4872 wrote to memory of 3916	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	89
PID 3916 wrote to memory of 3912	3916	bmhost.exe	90
PID 3916 wrote to memory of 3912	3916	bmhost.exe	90
PID 3916 wrote to memory of 3912	3916	bmhost.exe	90
PID 3916 wrote to memory of 3912	3916	bmhost.exe	90
PID 4872 wrote to memory of 2680	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	92
PID 4872 wrote to memory of 2680	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	92
PID 4872 wrote to memory of 2680	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	92
PID 2680 wrote to memory of 3948	2680	cmhost.exe	93
PID 2680 wrote to memory of 3948	2680	cmhost.exe	93
PID 3948 wrote to memory of 2220	3948	X	45
PID 2680 wrote to memory of 1876	2680	cmhost.exe	94
PID 2680 wrote to memory of 1876	2680	cmhost.exe	94
PID 2680 wrote to memory of 1876	2680	cmhost.exe	94
PID 2680 wrote to memory of 1876	2680	cmhost.exe	94
PID 4872 wrote to memory of 4460	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	96
PID 4872 wrote to memory of 4460	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	96
PID 4872 wrote to memory of 4460	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	96
PID 4872 wrote to memory of 4732	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	103
PID 4872 wrote to memory of 4732	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	103
PID 4872 wrote to memory of 4732	4872	24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe	103
PID 4732 wrote to memory of 1112	4732	cmd.exe	105
PID 4732 wrote to memory of 1112	4732	cmd.exe	105
PID 4732 wrote to memory of 1112	4732	cmd.exe	105
PID 344 wrote to memory of 1112	344	roiez.exe	105
PID 344 wrote to memory of 1112	344	roiez.exe	105

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2220
- C:\Users\Admin\AppData\Local\Temp\24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe
  "C:\Users\Admin\AppData\Local\Temp\24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\srRTMxaDv9.exe
    C:\Users\Admin\srRTMxaDv9.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Users\Admin\roiez.exe
      "C:\Users\Admin\roiez.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:344
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
- - C:\Users\Admin\amhost.exe
    C:\Users\Admin\amhost.exe
    3⤵
    - Executes dropped EXE
    PID:1508
- - C:\Users\Admin\bmhost.exe
    C:\Users\Admin\bmhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:3912
- - C:\Users\Admin\cmhost.exe
    C:\Users\Admin\cmhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\8dd2ae5a\X
      176.53.17.24:80
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1876
- - C:\Users\Admin\dmhost.exe
    C:\Users\Admin\dmhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 24b936fee46ed863b96a89990e40964480881580d28f2a0e3c6e52a3ecde776f.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\8dd2ae5a\X

Filesize
41KB

MD5
be40a2578e862f1cecc9b9194f524201

SHA1
0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

SHA256
2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

SHA512
25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

Download Submit
C:\Users\Admin\AppData\Local\8dd2ae5a\X

Filesize
41KB

MD5
be40a2578e862f1cecc9b9194f524201

SHA1
0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

SHA256
2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

SHA512
25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

Download Submit
C:\Users\Admin\amhost.exe

Filesize
80KB

MD5
8ccbe4f27f9710f3e7f75e1d1de57e49

SHA1
272e95e476477cd4a1715ee0bcf32318e0351718

SHA256
3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

SHA512
334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

Download Submit
C:\Users\Admin\amhost.exe

Filesize
80KB

MD5
8ccbe4f27f9710f3e7f75e1d1de57e49

SHA1
272e95e476477cd4a1715ee0bcf32318e0351718

SHA256
3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

SHA512
334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

Download Submit
C:\Users\Admin\bmhost.exe

Filesize
258KB

MD5
2da0070a7c50f3a078b73b4fb7ee7c02

SHA1
999b4860a80b908622fadfc8fae27db66b200932

SHA256
f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

SHA512
2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

Download Submit
C:\Users\Admin\bmhost.exe

Filesize
258KB

MD5
2da0070a7c50f3a078b73b4fb7ee7c02

SHA1
999b4860a80b908622fadfc8fae27db66b200932

SHA256
f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

SHA512
2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

Download Submit
C:\Users\Admin\cmhost.exe

Filesize
358KB

MD5
03102e4338eb16e0c4dfe106830557e3

SHA1
4fdb5baf0900e44e95acdeee1c947be3b0518b39

SHA256
7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

SHA512
c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

Download Submit
C:\Users\Admin\cmhost.exe

Filesize
358KB

MD5
03102e4338eb16e0c4dfe106830557e3

SHA1
4fdb5baf0900e44e95acdeee1c947be3b0518b39

SHA256
7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

SHA512
c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

Download Submit
C:\Users\Admin\dmhost.exe

Filesize
32KB

MD5
b0a7ccfcd09b2273fbcdf0762eb396f5

SHA1
d73fbc3696c03c422868d791d596ef0f1d94845c

SHA256
2b95744d1cb96fa54a9163fa529b3953c24c8beefb4dedabeb7d5953d0d8ac12

SHA512
7ca31f82db8df42ff30085b70e9e9d045103b89ab746a4d834abe19188dcc7afc26d747d7c4e3ab26fa6c2294f615df24cbd6769c2afe8b16b94148a54520092

Download Submit
C:\Users\Admin\dmhost.exe

Filesize
32KB

MD5
b0a7ccfcd09b2273fbcdf0762eb396f5

SHA1
d73fbc3696c03c422868d791d596ef0f1d94845c

SHA256
2b95744d1cb96fa54a9163fa529b3953c24c8beefb4dedabeb7d5953d0d8ac12

SHA512
7ca31f82db8df42ff30085b70e9e9d045103b89ab746a4d834abe19188dcc7afc26d747d7c4e3ab26fa6c2294f615df24cbd6769c2afe8b16b94148a54520092

Download Submit
C:\Users\Admin\roiez.exe

Filesize
344KB

MD5
f00b5d04e2f00e714f548eb453ca2382

SHA1
7e5f235c3736dd7bbddf11faa9d62a4f2d0561b6

SHA256
18fd4addf6c58301e89c97d95d9c6619e84867f19ffd81ce6d40196a06112542

SHA512
2a60381d26a2a3a42fd06a5845ddf4aaa4141895c5f25a1669fd719be49a19c63c1c06d8d9a1115fb9e52763c91427e8efab97d1287e1a5e7700d3b4b336aa16

Download Submit
C:\Users\Admin\roiez.exe

Filesize
344KB

MD5
f00b5d04e2f00e714f548eb453ca2382

SHA1
7e5f235c3736dd7bbddf11faa9d62a4f2d0561b6

SHA256
18fd4addf6c58301e89c97d95d9c6619e84867f19ffd81ce6d40196a06112542

SHA512
2a60381d26a2a3a42fd06a5845ddf4aaa4141895c5f25a1669fd719be49a19c63c1c06d8d9a1115fb9e52763c91427e8efab97d1287e1a5e7700d3b4b336aa16

Download Submit
C:\Users\Admin\srRTMxaDv9.exe

Filesize
344KB

MD5
57a5743f47b3a874773041195600909c

SHA1
74f5c16a6ca03baea7c684e40d351f1ec484a70d

SHA256
eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

SHA512
66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

Download Submit
C:\Users\Admin\srRTMxaDv9.exe

Filesize
344KB

MD5
57a5743f47b3a874773041195600909c

SHA1
74f5c16a6ca03baea7c684e40d351f1ec484a70d

SHA256
eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

SHA512
66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

Download Submit
memory/2680-165-0x00000000006C6000-0x000000000070E000-memory.dmp

Filesize
288KB

Download
memory/2680-164-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/2680-168-0x00000000006C6000-0x000000000070E000-memory.dmp

Filesize
288KB

Download
memory/2680-167-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/3916-155-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3916-154-0x00000000006B0000-0x00000000006F6000-memory.dmp

Filesize
280KB

Download
memory/3916-157-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3916-153-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3916-152-0x00000000006B0000-0x00000000006F6000-memory.dmp

Filesize
280KB

Download