xtremerat | 33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

Analysis

max time kernel
150s
max time network
90s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
Size

712KB
MD5

0d6542d9d1dadd5fddf51a0302231258
SHA1

9aae90db2ac05caf13a835c288850653cbf36584
SHA256

33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9
SHA512

bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66
SSDEEP

12288:bOqBSPmJ7uD4vqQOqCg/0+cdEuH8uitp4xieV31K93u:yCSCOTRdEuUpJGl3

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

imaistroextr.zapto.org

Signatures

Detect XtremeRAT payload 20 IoCs

resource	yara_rule
behavioral1/memory/844-57-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/844-59-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/844-62-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/844-65-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/844-67-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/844-70-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/844-72-0x0000000000C88B20-mapping.dmp	family_xtremerat
behavioral1/memory/844-74-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/844-75-0x0000000000C81000-0x0000000000C8A000-memory.dmp	family_xtremerat
behavioral1/memory/2040-78-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/1760-83-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/2040-85-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/1760-87-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/1760-88-0x0000000000C80000-0x0000000000CEE000-memory.dmp	family_xtremerat
behavioral1/memory/1640-120-0x0000000000C88B20-mapping.dmp	family_xtremerat
behavioral1/memory/684-143-0x0000000000C88B20-mapping.dmp	family_xtremerat
behavioral1/memory/1112-189-0x0000000000C88B20-mapping.dmp	family_xtremerat
behavioral1/memory/1996-226-0x0000000000C88B20-mapping.dmp	family_xtremerat
behavioral1/memory/1132-249-0x0000000000C88B20-mapping.dmp	family_xtremerat
behavioral1/memory/1500-295-0x0000000000C88B20-mapping.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Executes dropped EXE 12 IoCs

pid	Process
1480	Server.exe
1408	Server.exe
672	Server.exe
1908	Server.exe
1640	Server.exe
684	Server.exe
1900	Server.exe
1112	Server.exe
1432	Server.exe
1996	Server.exe
1132	Server.exe
1500	Server.exe

Modifies Installed Components in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4I122HE4-0SYK-S3P6-08L6-528050TSHWLY}	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe

Loads dropped DLL 7 IoCs

pid	Process
2040	svchost.exe
2040	svchost.exe
1760	explorer.exe
2040	svchost.exe
2040	svchost.exe
2040	svchost.exe
2040	svchost.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	explorer.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 368 set thread context of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 1480 set thread context of 1640	1480	Server.exe	35
PID 1408 set thread context of 684	1408	Server.exe	38
PID 1640 set thread context of 1904	1640	Server.exe	36
PID 684 set thread context of 1580	684	Server.exe	40
PID 672 set thread context of 1112	672	Server.exe	42
PID 1112 set thread context of 1548	1112	Server.exe	44
PID 1908 set thread context of 1996	1908	Server.exe	46
PID 1900 set thread context of 1132	1900	Server.exe	49
PID 1996 set thread context of 1420	1996	Server.exe	48
PID 1432 set thread context of 1500	1432	Server.exe	50

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\	Server.exe
File created	C:\Windows\InstallDir\Server.exe	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
File opened for modification	C:\Windows\InstallDir\	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1548	explorer.exe
1420	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	explorer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1760	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1760	explorer.exe
1548	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 368 wrote to memory of 844	368	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	27
PID 844 wrote to memory of 2040	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	28
PID 844 wrote to memory of 2040	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	28
PID 844 wrote to memory of 2040	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	28
PID 844 wrote to memory of 2040	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	28
PID 844 wrote to memory of 2040	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	28
PID 844 wrote to memory of 1956	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	29
PID 844 wrote to memory of 1956	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	29
PID 844 wrote to memory of 1956	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	29
PID 844 wrote to memory of 1956	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	29
PID 844 wrote to memory of 1760	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	30
PID 844 wrote to memory of 1760	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	30
PID 844 wrote to memory of 1760	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	30
PID 844 wrote to memory of 1760	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	30
PID 844 wrote to memory of 1760	844	33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe	30
PID 2040 wrote to memory of 1480	2040	svchost.exe	31
PID 2040 wrote to memory of 1480	2040	svchost.exe	31
PID 2040 wrote to memory of 1480	2040	svchost.exe	31
PID 2040 wrote to memory of 1480	2040	svchost.exe	31
PID 1760 wrote to memory of 1408	1760	explorer.exe	32
PID 1760 wrote to memory of 1408	1760	explorer.exe	32
PID 1760 wrote to memory of 1408	1760	explorer.exe	32
PID 1760 wrote to memory of 1408	1760	explorer.exe	32
PID 2040 wrote to memory of 672	2040	svchost.exe	33
PID 2040 wrote to memory of 672	2040	svchost.exe	33
PID 2040 wrote to memory of 672	2040	svchost.exe	33
PID 2040 wrote to memory of 672	2040	svchost.exe	33
PID 2040 wrote to memory of 1908	2040	svchost.exe	34
PID 2040 wrote to memory of 1908	2040	svchost.exe	34
PID 2040 wrote to memory of 1908	2040	svchost.exe	34
PID 2040 wrote to memory of 1908	2040	svchost.exe	34
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1480 wrote to memory of 1640	1480	Server.exe	35
PID 1640 wrote to memory of 1924	1640	Server.exe	37
PID 1640 wrote to memory of 1924	1640	Server.exe	37
PID 1640 wrote to memory of 1924	1640	Server.exe	37
PID 1640 wrote to memory of 1924	1640	Server.exe	37
PID 1640 wrote to memory of 1904	1640	Server.exe	36
PID 1640 wrote to memory of 1904	1640	Server.exe	36
PID 1640 wrote to memory of 1904	1640	Server.exe	36
PID 1640 wrote to memory of 1904	1640	Server.exe	36
PID 1408 wrote to memory of 684	1408	Server.exe	38
PID 1408 wrote to memory of 684	1408	Server.exe	38

C:\Users\Admin\AppData\Local\Temp\33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
"C:\Users\Admin\AppData\Local\Temp\33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
  C:\Users\Admin\AppData\Local\Temp\33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9.exe
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Installed Components in the registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1640
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:1904
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1924
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:672
    - - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1112
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2008
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1548
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1908
    - - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1996
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1988
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1420
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1900
    - - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        5⤵
        Executes dropped EXE
        
        PID:1132
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1432
    - - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        5⤵
        Executes dropped EXE
        
        PID:1500
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:684
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:696
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\jzyGf9e.cfg

Filesize
1KB

MD5
bddd08860f9dea1df326658e811e2d6e

SHA1
258ef149b546f983178d0e960a0f1dde5ced915b

SHA256
68efeff41da9d29383ba362ce32d01052c238eaba08129f5148fd448a071fd30

SHA512
5a7cc7a4a2bbd24ef6e198dd89fc0b3720385f70089887da025fe5560cad8c98e70090cfd7afb773fcfe9b7852a096cea2779f67c43354986dd5e39a0bc060a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\jzyGf9e.cfg

Filesize
1KB

MD5
bddd08860f9dea1df326658e811e2d6e

SHA1
258ef149b546f983178d0e960a0f1dde5ced915b

SHA256
68efeff41da9d29383ba362ce32d01052c238eaba08129f5148fd448a071fd30

SHA512
5a7cc7a4a2bbd24ef6e198dd89fc0b3720385f70089887da025fe5560cad8c98e70090cfd7afb773fcfe9b7852a096cea2779f67c43354986dd5e39a0bc060a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\jzyGf9e.cfg

Filesize
1KB

MD5
bddd08860f9dea1df326658e811e2d6e

SHA1
258ef149b546f983178d0e960a0f1dde5ced915b

SHA256
68efeff41da9d29383ba362ce32d01052c238eaba08129f5148fd448a071fd30

SHA512
5a7cc7a4a2bbd24ef6e198dd89fc0b3720385f70089887da025fe5560cad8c98e70090cfd7afb773fcfe9b7852a096cea2779f67c43354986dd5e39a0bc060a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\jzyGf9e.cfg

Filesize
1KB

MD5
bddd08860f9dea1df326658e811e2d6e

SHA1
258ef149b546f983178d0e960a0f1dde5ced915b

SHA256
68efeff41da9d29383ba362ce32d01052c238eaba08129f5148fd448a071fd30

SHA512
5a7cc7a4a2bbd24ef6e198dd89fc0b3720385f70089887da025fe5560cad8c98e70090cfd7afb773fcfe9b7852a096cea2779f67c43354986dd5e39a0bc060a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\jzyGf9e.cfg

Filesize
1KB

MD5
bddd08860f9dea1df326658e811e2d6e

SHA1
258ef149b546f983178d0e960a0f1dde5ced915b

SHA256
68efeff41da9d29383ba362ce32d01052c238eaba08129f5148fd448a071fd30

SHA512
5a7cc7a4a2bbd24ef6e198dd89fc0b3720385f70089887da025fe5560cad8c98e70090cfd7afb773fcfe9b7852a096cea2779f67c43354986dd5e39a0bc060a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\jzyGf9e.dat

Filesize
2B

MD5
84cad01fdb44ae58dbe6c3973dcd87f5

SHA1
4700b42849fb35be323774820bf1bc8019d26c80

SHA256
8b1f194be530240c18bf0b1ee0d038e750fab8b24c6bd25c864297e5ebb41fa6

SHA512
6e10d3ec4724c1aca9ff3f6a26292ba80065d18e8e9395f1474c0a298008f25e312e2f7024e7d10aab3264764e69a25553cc20afd23090f83921d20e42b989ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\jzyGf9e.xtr

Filesize
343KB

MD5
6426d400c96fb9ffef4eaa54f6647f4c

SHA1
70a37871aff432790b6adf7d3fc4eb929476e082

SHA256
98bba0cf4c57ecd35b227f45e4aa6dd50ef7cfb1160235cc14687c96eb09fa3c

SHA512
2c8b4d3ab066cbfca6cf0c8d89d5044152b5e3d7100249cbedd1c816e3a4a94efc8bc6b79c1dab4bdf96e3ce476d6caccf625cfbe0aff3bf5e7a29dfcfa948c5

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
\Windows\InstallDir\Server.exe

Filesize
712KB

MD5
0d6542d9d1dadd5fddf51a0302231258

SHA1
9aae90db2ac05caf13a835c288850653cbf36584

SHA256
33398ed32c539bc45a33b394a03d054c13db10e32b294627ba3da04737dff3a9

SHA512
bbef96545cae9b67816d101026f94db5b26066010cabf658e68ecdabd148cbdf11e71827ce3fbb9c7465d1636a64d6aa0e3bbcc1c24c0459187c5f9a8c18ff66

Download Submit
memory/844-74-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/844-55-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/844-57-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/844-67-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/844-70-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/844-65-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/844-75-0x0000000000C81000-0x0000000000C8A000-memory.dmp

Filesize
36KB

Download
memory/844-59-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/844-54-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/844-62-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/844-73-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1420-275-0x0000000001611000-0x00000000016BB000-memory.dmp

Filesize
680KB

Download
memory/1420-273-0x00000000016BB000-0x0000000001710000-memory.dmp

Filesize
340KB

Download
memory/1548-300-0x00000000016BB000-0x0000000001710000-memory.dmp

Filesize
340KB

Download
memory/1548-276-0x00000000016BB000-0x0000000001710000-memory.dmp

Filesize
340KB

Download
memory/1760-86-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1760-87-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/1760-88-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download
memory/2040-85-0x0000000000C80000-0x0000000000CEE000-memory.dmp

Filesize
440KB

Download