Analysis
-
max time kernel
151s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 15:50
Behavioral task
behavioral1
Sample
367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe
Resource
win10v2004-20220812-en
General
-
Target
367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe
-
Size
19KB
-
MD5
05170fd2c88fe903594b47e7439560e4
-
SHA1
eaa97abb688bf7de54ca0713bf7897bf1b0ad675
-
SHA256
367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
-
SHA512
787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
SSDEEP
384:9HKZfuH87GowDqGoMwevqxP6k6zIDwPVBSvKGuwDbxyNdoc7R:IZfuHUvwDKP6kMpTGuFNaW
Malware Config
Signatures
-
Detect XtremeRAT payload 18 IoCs
resource yara_rule behavioral1/memory/1896-55-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1896-60-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/864-63-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/864-67-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1028-69-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1028-72-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1652-75-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1652-77-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1540-80-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1540-83-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1328-86-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1328-89-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1896-91-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1896-92-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1896-95-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/568-97-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/568-101-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1628-103-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Executes dropped EXE 8 IoCs
pid Process 864 Server.exe 1028 Server.exe 1652 Server.exe 1540 Server.exe 1328 Server.exe 1896 Server.exe 568 Server.exe 1628 Server.exe -
Modifies Installed Components in the registry 2 TTPs 18 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe -
resource yara_rule behavioral1/memory/1896-55-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-56.dat upx behavioral1/files/0x0008000000012758-57.dat upx behavioral1/memory/1896-60-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-59.dat upx behavioral1/memory/864-63-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-64.dat upx behavioral1/memory/864-67-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-66.dat upx behavioral1/memory/1028-69-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/1028-72-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-71.dat upx behavioral1/memory/1652-75-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-78.dat upx behavioral1/memory/1652-77-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/1540-80-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/1540-83-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-82.dat upx behavioral1/memory/1328-86-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/1328-89-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-88.dat upx behavioral1/memory/1896-91-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/1896-92-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/1896-95-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-94.dat upx behavioral1/memory/568-97-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/files/0x0008000000012758-100.dat upx behavioral1/memory/568-101-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/1628-103-0x0000000000C80000-0x0000000000C95000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe -
Adds Run key to start application 2 TTPs 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\InstallDir\Server.exe 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe File created C:\Windows\InstallDir\Server.exe 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1896 wrote to memory of 1940 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 28 PID 1896 wrote to memory of 1940 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 28 PID 1896 wrote to memory of 1940 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 28 PID 1896 wrote to memory of 1940 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 28 PID 1896 wrote to memory of 1940 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 28 PID 1896 wrote to memory of 1976 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 29 PID 1896 wrote to memory of 1976 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 29 PID 1896 wrote to memory of 1976 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 29 PID 1896 wrote to memory of 1976 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 29 PID 1896 wrote to memory of 1976 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 29 PID 1896 wrote to memory of 1900 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 30 PID 1896 wrote to memory of 1900 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 30 PID 1896 wrote to memory of 1900 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 30 PID 1896 wrote to memory of 1900 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 30 PID 1896 wrote to memory of 1900 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 30 PID 1896 wrote to memory of 1452 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 31 PID 1896 wrote to memory of 1452 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 31 PID 1896 wrote to memory of 1452 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 31 PID 1896 wrote to memory of 1452 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 31 PID 1896 wrote to memory of 1452 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 31 PID 1896 wrote to memory of 1208 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 32 PID 1896 wrote to memory of 1208 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 32 PID 1896 wrote to memory of 1208 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 32 PID 1896 wrote to memory of 1208 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 32 PID 1896 wrote to memory of 1208 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 32 PID 1896 wrote to memory of 1232 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 33 PID 1896 wrote to memory of 1232 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 33 PID 1896 wrote to memory of 1232 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 33 PID 1896 wrote to memory of 1232 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 33 PID 1896 wrote to memory of 1232 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 33 PID 1896 wrote to memory of 1240 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 34 PID 1896 wrote to memory of 1240 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 34 PID 1896 wrote to memory of 1240 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 34 PID 1896 wrote to memory of 1240 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 34 PID 1896 wrote to memory of 1240 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 34 PID 1896 wrote to memory of 1376 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 35 PID 1896 wrote to memory of 1376 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 35 PID 1896 wrote to memory of 1376 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 35 PID 1896 wrote to memory of 1376 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 35 PID 1896 wrote to memory of 864 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 36 PID 1896 wrote to memory of 864 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 36 PID 1896 wrote to memory of 864 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 36 PID 1896 wrote to memory of 864 1896 367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe 36 PID 864 wrote to memory of 952 864 Server.exe 37 PID 864 wrote to memory of 952 864 Server.exe 37 PID 864 wrote to memory of 952 864 Server.exe 37 PID 864 wrote to memory of 952 864 Server.exe 37 PID 864 wrote to memory of 952 864 Server.exe 37 PID 864 wrote to memory of 1968 864 Server.exe 38 PID 864 wrote to memory of 1968 864 Server.exe 38 PID 864 wrote to memory of 1968 864 Server.exe 38 PID 864 wrote to memory of 1968 864 Server.exe 38 PID 864 wrote to memory of 1968 864 Server.exe 38 PID 864 wrote to memory of 2016 864 Server.exe 39 PID 864 wrote to memory of 2016 864 Server.exe 39 PID 864 wrote to memory of 2016 864 Server.exe 39 PID 864 wrote to memory of 2016 864 Server.exe 39 PID 864 wrote to memory of 2016 864 Server.exe 39 PID 864 wrote to memory of 1160 864 Server.exe 40 PID 864 wrote to memory of 1160 864 Server.exe 40 PID 864 wrote to memory of 1160 864 Server.exe 40 PID 864 wrote to memory of 1160 864 Server.exe 40 PID 864 wrote to memory of 1160 864 Server.exe 40 PID 864 wrote to memory of 764 864 Server.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe"C:\Users\Admin\AppData\Local\Temp\367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6.exe"1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1940
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1976
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1900
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1452
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1208
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1232
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1240
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1376
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:952
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1968
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2016
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1160
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:764
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:580
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:660
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1428
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1028 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:1620
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:1184
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:1660
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:1684
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:1736
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:1728
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:676
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:1848
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1652 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1884
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1524
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1996
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1860
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:768
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1928
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1704
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1572
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1540 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:1044
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:1108
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:1124
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:336
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:1372
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:756
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:1864
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:552
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1328 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:1760
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:1624
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:1944
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:872
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:392
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:2008
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:1344
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:1740
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1896 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"8⤵PID:1716
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"8⤵PID:1336
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"8⤵PID:1260
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"8⤵PID:904
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"8⤵PID:432
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"8⤵PID:1604
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"8⤵PID:912
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"8⤵PID:1680
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"8⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:568 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:1484
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:1948
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:1264
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:1548
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:928
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:1420
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:1824
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:956
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"9⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1628 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"10⤵PID:1560
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"10⤵PID:1880
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"10⤵PID:1592
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"10⤵PID:428
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"10⤵PID:980
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"10⤵PID:112
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5922b71e9e4734a9cab5c3983bf7d8368
SHA1ea647e977bc89ab97549e5bad62dbce8de313599
SHA2567ecb1ec5e0af14faacdedf877190dfe76dbeb8ae69f958c444f15d3622f16c3b
SHA51239e5b3380869bfbca3d4eedf5f29454cf58794feae8fee43af4c3c5501be485734b4013d10a15951f72438ab79fad70288f9012ecd86e21813e51a15e94a9a46
-
Filesize
1KB
MD5922b71e9e4734a9cab5c3983bf7d8368
SHA1ea647e977bc89ab97549e5bad62dbce8de313599
SHA2567ecb1ec5e0af14faacdedf877190dfe76dbeb8ae69f958c444f15d3622f16c3b
SHA51239e5b3380869bfbca3d4eedf5f29454cf58794feae8fee43af4c3c5501be485734b4013d10a15951f72438ab79fad70288f9012ecd86e21813e51a15e94a9a46
-
Filesize
1KB
MD5922b71e9e4734a9cab5c3983bf7d8368
SHA1ea647e977bc89ab97549e5bad62dbce8de313599
SHA2567ecb1ec5e0af14faacdedf877190dfe76dbeb8ae69f958c444f15d3622f16c3b
SHA51239e5b3380869bfbca3d4eedf5f29454cf58794feae8fee43af4c3c5501be485734b4013d10a15951f72438ab79fad70288f9012ecd86e21813e51a15e94a9a46
-
Filesize
1KB
MD5922b71e9e4734a9cab5c3983bf7d8368
SHA1ea647e977bc89ab97549e5bad62dbce8de313599
SHA2567ecb1ec5e0af14faacdedf877190dfe76dbeb8ae69f958c444f15d3622f16c3b
SHA51239e5b3380869bfbca3d4eedf5f29454cf58794feae8fee43af4c3c5501be485734b4013d10a15951f72438ab79fad70288f9012ecd86e21813e51a15e94a9a46
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27
-
Filesize
19KB
MD505170fd2c88fe903594b47e7439560e4
SHA1eaa97abb688bf7de54ca0713bf7897bf1b0ad675
SHA256367e823dbf7c1a3de3944e0c05028dda5fe1f504506e96ed0d09962a016c90e6
SHA512787104b6560eddfc3c9e83252125ce39aaae579a5af96408d846b55494fea25226da52750469c4b895445a531786ff042b6a6835e826b998e1bd79748d9b8c27