cde3720e9c1d758e606495f4eb216e165e0e2bbe80c9018f32287ae31f553693

Resubmissions

28/11/2022, 09:53

221128-lwp4eaea3310

17/11/2022, 04:28

221117-e328zsdf6910

07/11/2022, 10:35

221107-mm272secgj10

Analysis

max time kernel
23s
max time network
44s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
17/11/2022, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.exe
Size 60.2MB
Sample221117-e328zsdf69
SHA256 ca94c8bbbb10febb8187f8c709affaa91911f646cf0ac99e857bf45b3a709091
MD5 b77955061c0f46de8059c20128ebb156
SHA1 bd9ba700caec09387bfcf97bd9cc0a2e846836ca
SHA512 83f07b66be1138e5f3f1c1f2504d3222bcc1bb1c1626a98e2346408cde7c771a64a998fa38c23ac66097f0b610f70c6309ea914e0c9c95ecff588a385aeb69aa
SSDEEP 1572864:DdjkMwgaV4gRNzu1zCcFA4o/UDDvX94UKfytNxZhDa:FJGuMzuHnXDKfeN5Da
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	update.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	update.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	update.exe

Blocks application from running via registry modification 27 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "Cube.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "FRST64.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "bitdefender_avfree.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "PANDAFREEAV.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "Cureit.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avast_free_antivirus_setup_online.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "Cezurity_Scanner_Pro_Free.exe"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "eav_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "HitmanPro.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "AVbr.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ESETOnlineScanner_RUS.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "MBSetup.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "drweb-12.0-ss-win.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "essf_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "hitmanpro_x64.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "eset_nod32_antivirus_live_installer.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "esetonlinescanner.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "eis_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "cureit.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "ESETOnlineScanner_UKR.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "eset_internet_security_live_installer.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "TDSSKiller.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "AV_br.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KVRT.exe"	update.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "360TS_Setup_Mini.exe"	update.exe

Modifies Windows Firewall 1 TTPs 7 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1952	netsh.exe
780	netsh.exe
524	netsh.exe
1276	netsh.exe
1384	netsh.exe
744	netsh.exe
1708	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	update.exe

Themida packer 31 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1380-55-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-57-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-58-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-59-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-60-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-61-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-62-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-63-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-64-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-65-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/files/0x000c00000001231c-95.dat	themida
behavioral1/files/0x000c00000001231c-97.dat	themida
behavioral1/files/0x000700000001267b-101.dat	themida
behavioral1/files/0x000700000001267b-99.dat	themida
behavioral1/files/0x000c00000001231c-103.dat	themida
behavioral1/files/0x000700000001267b-104.dat	themida
behavioral1/files/0x000700000001267b-109.dat	themida
behavioral1/files/0x000700000001267b-110.dat	themida
behavioral1/files/0x000c00000001231c-108.dat	themida
behavioral1/files/0x000c00000001231c-107.dat	themida
behavioral1/memory/1476-111-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-112-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-113-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-114-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-115-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-116-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-118-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-120-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/880-117-0x000000013F1B0000-0x00000001424D2000-memory.dmp	themida
behavioral1/memory/880-121-0x000000013F1B0000-0x00000001424D2000-memory.dmp	themida
behavioral1/memory/1476-125-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Plex Media Server = "C:\\ProgramData\\Windows Tasks Service\\winserv.exe"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhost.exe"	update.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	update.exe

AutoIT Executable 16 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1380-58-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-59-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-60-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-61-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-62-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-63-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-64-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-65-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1476-112-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-113-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-114-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-115-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-116-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-118-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-120-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/880-121-0x000000013F1B0000-0x00000001424D2000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1380	update.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
668	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1380	update.exe
1380	update.exe
1380	update.exe
1380	update.exe
1380	update.exe
1380	update.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1780	1380	update.exe	28
PID 1380 wrote to memory of 1780	1380	update.exe	28
PID 1380 wrote to memory of 1780	1380	update.exe	28
PID 1780 wrote to memory of 668	1780	cmd.exe	29
PID 1780 wrote to memory of 668	1780	cmd.exe	29
PID 1780 wrote to memory of 668	1780	cmd.exe	29
PID 1380 wrote to memory of 1528	1380	update.exe	35
PID 1380 wrote to memory of 1528	1380	update.exe	35
PID 1380 wrote to memory of 1528	1380	update.exe	35
PID 1380 wrote to memory of 1804	1380	update.exe	34
PID 1380 wrote to memory of 1804	1380	update.exe	34
PID 1380 wrote to memory of 1804	1380	update.exe	34
PID 1804 wrote to memory of 1708	1804	cmd.exe	32
PID 1804 wrote to memory of 1708	1804	cmd.exe	32
PID 1804 wrote to memory of 1708	1804	cmd.exe	32
PID 1528 wrote to memory of 744	1528	cmd.exe	31
PID 1528 wrote to memory of 744	1528	cmd.exe	31
PID 1528 wrote to memory of 744	1528	cmd.exe	31

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	update.exe

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Blocks application from running via registry modification
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete swprv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\system32\sc.exe
    sc delete swprv
    3⤵
    - Launches sc.exe
    PID:668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
  2⤵
  PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
  2⤵
  PID:1180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
  2⤵
  PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
  2⤵
  PID:964
- C:\ProgramData\Setup\Game.exe
  C:\ProgramData\Setup\Game.exe -pnaxui
  2⤵
  PID:1124
- - C:\ProgramData\RealtekHD\GameGuard.exe
    "C:\ProgramData\RealtekHD\GameGuard.exe"
    3⤵
    PID:1476
- - C:\ProgramData\RealtekHD\taskhost.exe
    "C:\ProgramData\RealtekHD\taskhost.exe"
    3⤵
    PID:880

C:\Windows\system32\netsh.exe
netsh advfirewall set allprofiles state on
1⤵
- Modifies Windows Firewall
PID:744

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:1708

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:1952

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
1⤵
- Modifies Windows Firewall
PID:780

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
1⤵
- Modifies Windows Firewall
PID:1276

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
1⤵
- Modifies Windows Firewall
PID:1384

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

GameGuard.exe

Path C:\ProgramData\RealtekHD\GameGuard.exe
Size 5.0MB
SHA256 fc110064f6cee1dfb6793283a7bf1964347b1e6b29a0db8efc70dd77c15c85a1
MD5 32198d6a8e26f4e103885fc4eef3c2d7
SHA1 f35a0abab275eececc6410f69c5d041d14f3684e
SHA512 d25eaad411040c4b3dc8892594c717d820a0e2dc2bc10d68217a52351764691c8e1e17bc55c1e67fe550e3ffde1e01ab60e6dae8f75b5e1c182733bbc950485e
SSDEEP 98304:ZWtvEX6YcCHXudbsvVTabCo0hG1jTsks+JaPTc3xBzKbY0rjTVg8/MJ2+pb59Q:ZWtcX6YxudoV2Hr9wks5kV8/1D
MD5 SHA1 SHA512 SSDEEP

Submit Download

GameGuard.exe

Path C:\ProgramData\RealtekHD\GameGuard.exe
Size 4.2MB
SHA256 ce833f5fbcb230f6b7a4efdd97a7d44ddb5b530298473c10e2805b43d7d91977
MD5 fcdfefbc0f29afb1444ba648174b7182
SHA1 dfeff4394896cd700e9364dd930c62e1744c30de
SHA512 779bc54bb72ccfebc7b5f9845f56108f7f017c32baf45c91bbefcdc570684991c0049a96d893228288573a422504d31cb69442dcb002429f80eea5f5d48e643e
SSDEEP 98304:ZWtvEX6YcCHXudbsvVTabCo0hG1jTsks+JaPTc3xBzKbY0rjTVa:ZWtcX6YxudoV2Hr9wks5kT
MD5 SHA1 SHA512 SSDEEP

Submit Download

taskhost.exe

Path C:\ProgramData\RealtekHD\taskhost.exe
Size 6.2MB
SHA256 8e05ed626d21b7157490a92be742d4687d2b7f534fb13ca2eebeb979c9cd39aa
MD5 2522b6629f0462e8a1a3f6dda6bdc031
SHA1 b5f298a26a9625b5babd496b34703fed2736f2b6
SHA512 4ac0e8e2d7c467d114514e39eac21f503edd9d685b05baed206e27a64d77d34ba0fd41ec7c0045a6f1565213d06a362fe1b1d1d875846e9a6288bace562c3b79
SSDEEP 196608:lt8OOQttUtC3OtxnGcPm0DGf1o2CfyMUDqkK:mytUtOLcPPgCYDxK
MD5 SHA1 SHA512 SSDEEP

Submit Download

taskhost.exe

Path C:\ProgramData\RealtekHD\taskhost.exe
Size 6.0MB
SHA256 2f7fda1049c4748336f3e2c4011e0ec1a62ba83bc9786b3069335ba487d606fd
MD5 2defe16d485c9b891454cbf1dc40b412
SHA1 75cb67662073745b08ef2aa2146c838e21d0c63f
SHA512 ad076bdc2196683f970aa8846c4cd9dd9c6bf0c8500ba23a467575ef6f52e6390b170109e08dfeb2d3e1ef795522c8ee80e661e9aa4c9cb96eeaa1d2af76b8d5
SSDEEP 98304:lX9F+1OYfQqiTIJIxEAmtXQO3SMnHkX3OtnxnGcniKm0DGf1FG2CfhQMUDqk/:lt8OOQttUtC3OtxnGcPm0DGf1o2CfyMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Game.exe

Path C:\ProgramData\Setup\Game.exe
Size 8.4MB
SHA256 f4e81f05aa5c0371231b60210f42afe6ffe9fdde05a1bf5c6609fa95c61d40b7
MD5 b1c1f1f7654212a26c820bb8d98b060c
SHA1 18a48261a0c2c38fdc249905f72efe7f65ad2c57
SHA512 c965553aff374d9f839186abcc3682996f3628682bf548bfc49151b82da8d297fc91a957150969b656d0c41170bd42fb0d38f1b3b1bf83e02065dfc8b07838b2
SSDEEP 196608:C4YIvHCQFb7q1dat4LPLsH9BFORLWYmF6TL18Q1iXby/pK4v:CFSb7gdxPsdBFOgYlf1B1rxLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Game.exe

Path C:\ProgramData\Setup\Game.exe
Size 8.1MB
SHA256 58b7adda1858eb651ff030bda70a613d03a5a69ed137cfa77acbf309bbcb659f
MD5 85c2020cb64c507c0a7fa9d5b2e966a6
SHA1 2d984e00bd3f9823276102de26d11b8db8ca23f6
SHA512 0809172753be193f5811bfe675bd0b79f6d6a0d3831e06a1f78476b3ddb54633e9399594da8c74405193a5abc29b3dfbc241e58f705c50df504280d3245216ec
SSDEEP 196608:C4YIvHCQFb7q1dat4LPLsH9BFORLWYmF6TL18Q1iXby/pKg:CFSb7gdxPsdBFOgYlf1B1rxJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

GameGuard.exe

Path \ProgramData\RealtekHD\GameGuard.exe
Size 5.0MB
SHA256 fc110064f6cee1dfb6793283a7bf1964347b1e6b29a0db8efc70dd77c15c85a1
MD5 32198d6a8e26f4e103885fc4eef3c2d7
SHA1 f35a0abab275eececc6410f69c5d041d14f3684e
SHA512 d25eaad411040c4b3dc8892594c717d820a0e2dc2bc10d68217a52351764691c8e1e17bc55c1e67fe550e3ffde1e01ab60e6dae8f75b5e1c182733bbc950485e
SSDEEP 98304:ZWtvEX6YcCHXudbsvVTabCo0hG1jTsks+JaPTc3xBzKbY0rjTVg8/MJ2+pb59Q:ZWtcX6YxudoV2Hr9wks5kV8/1D
MD5 SHA1 SHA512 SSDEEP

Submit Download

GameGuard.exe

Path \ProgramData\RealtekHD\GameGuard.exe
Size 5.0MB
SHA256 fc110064f6cee1dfb6793283a7bf1964347b1e6b29a0db8efc70dd77c15c85a1
MD5 32198d6a8e26f4e103885fc4eef3c2d7
SHA1 f35a0abab275eececc6410f69c5d041d14f3684e
SHA512 d25eaad411040c4b3dc8892594c717d820a0e2dc2bc10d68217a52351764691c8e1e17bc55c1e67fe550e3ffde1e01ab60e6dae8f75b5e1c182733bbc950485e
SSDEEP 98304:ZWtvEX6YcCHXudbsvVTabCo0hG1jTsks+JaPTc3xBzKbY0rjTVg8/MJ2+pb59Q:ZWtcX6YxudoV2Hr9wks5kV8/1D
MD5 SHA1 SHA512 SSDEEP

Submit Download

GameGuard.exe

Path \ProgramData\RealtekHD\GameGuard.exe
Size 4.0MB
SHA256 c12c07ec3b48481e5c8a5f3505ac288c0a6a5b3627299af3175372e391346e20
MD5 31513526b143dfeee251948797984ea1
SHA1 2123bb1d02088b69cabcc554fb1fa531d660eb29
SHA512 571c2b87aa97e0dc1f032b3e54548d406f57c665e87280f59d1edfeee3a2a32e74df68a5b5a322061fb288440fe996c921407272496d80eb711a6031bad698b2
SSDEEP 98304:ZWtvEX6YcCHXudbsvVTabCo0hG1jTsks+JaPTc3xBzKbY0rjTX:ZWtcX6YxudoV2Hr9wks5kI
MD5 SHA1 SHA512 SSDEEP

Submit Download

taskhost.exe

Path \ProgramData\RealtekHD\taskhost.exe
Size 5.5MB
SHA256 b92d212ae2193ee5f8bf70d9830c7009f51c232419a21c88ed696921097f9a01
MD5 e851bc9b590b9eef91122a475da8e8ec
SHA1 8ded89b8a184b029422637c68a9d985d070c16d7
SHA512 06ff884db6c7576d6e3df569b26a80cd70e7a808bccb3535e7760ca4c7ff07357d88835609ba653d70e6af2dc9ae86f2a1026eb96f46516a09c19cb9d10c8720
SSDEEP 98304:lX9F+1OYfQqiTIJIxEAmtXQO3SMnHkX3OtnxnGcniKm0DGf1FG2Cfhw:lt8OOQttUtC3OtxnGcPm0DGf1o2Cf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

taskhost.exe

Path \ProgramData\RealtekHD\taskhost.exe
Size 5.4MB
SHA256 1ad53cb03047dcc99a368f82029e01ad7795bce8504b315aa78851f18e4f9520
MD5 374f4aad40de8f1ca2d97d1304d469ee
SHA1 4ba1b3b1f5e3d641bbd1484dc6d00bdc11af68a0
SHA512 a521369eaeb52fa3d3182b54591216a5270cfc0ad53e5c8beee0d69c47b05c290ad340befe4b6346464c3d163660424501577127ff9273227f645cc925e40b89
SSDEEP 98304:lX9F+1OYfQqiTIJIxEAmtXQO3SMnHkX3OtnxnGcniKm0DGf1FG2CC:lt8OOQttUtC3OtxnGcPm0DGf1o2CC
MD5 SHA1 SHA512 SSDEEP

Submit Download

taskhost.exe

Path \ProgramData\RealtekHD\taskhost.exe
Size 6.4MB
SHA256 ef5114a20d122583ae6ccc2b19fee23bad302190a2f0883e558e36cd786f5e99
MD5 aa4796c6f97290be934849bdd782fcda
SHA1 3388340def67668cbb64ab01be0c6d80c618399b
SHA512 154319605ea28613b7edc881cfa9a74f197406691ab110fbbf54aee16e0edbb5b73e562a969beb6e256c44f75f7b6189973c9fcb342257975e9531c0a737006f
SSDEEP 196608:lt8OOQttUtC3OtxnGcPm0DGf1o2CfyMUDqk8SJ:mytUtOLcPPgCYDx8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/880-121-0x000000013F1B0000-0x00000001424D2000-memory.dmp

Download

memory/880-117-0x000000013F1B0000-0x00000001424D2000-memory.dmp

Download

memory/880-123-0x0000000077030000-0x00000000771D9000-memory.dmp

Download

memory/1124-92-0x00000000757A1000-0x00000000757A3000-memory.dmp

Download

memory/1380-56-0x0000000077030000-0x00000000771D9000-memory.dmp

Download

memory/1380-66-0x0000000077030000-0x00000000771D9000-memory.dmp

Download

memory/1380-57-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1380-58-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1380-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download

memory/1380-65-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1380-64-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1380-63-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1380-55-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1380-59-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1380-62-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1380-61-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1380-60-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1464-122-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1464-106-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1464-105-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1464-119-0x000000013F2A0000-0x0000000143563000-memory.dmp

Download

memory/1476-112-0x000000013FF40000-0x0000000140B08000-memory.dmp

Download

memory/1476-118-0x000000013FF40000-0x0000000140B08000-memory.dmp

Download

memory/1476-111-0x000000013FF40000-0x0000000140B08000-memory.dmp

Download

memory/1476-126-0x0000000077030000-0x00000000771D9000-memory.dmp

Download

memory/1476-113-0x000000013FF40000-0x0000000140B08000-memory.dmp

Download

memory/1476-114-0x000000013FF40000-0x0000000140B08000-memory.dmp

Download

memory/1476-115-0x000000013FF40000-0x0000000140B08000-memory.dmp

Download

memory/1476-116-0x000000013FF40000-0x0000000140B08000-memory.dmp

Download

memory/1476-125-0x000000013FF40000-0x0000000140B08000-memory.dmp

Download

memory/1476-120-0x000000013FF40000-0x0000000140B08000-memory.dmp

Download