neshta | fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480

General

Target

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
Size

692KB
MD5

38fe8a92a7e43b48e6d9c9ae13e2e9c0
SHA1

4d216a2a888f543ba196fa1aea22f4bc30e3189a
SHA256

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480
SHA512

6b2031a308da1ee6e422bc39ba8ccf53562b29d757979beb9a41d0e39e0b35a27b0cc5fc97b994822c5574c4adb46f42249d540b6b159fb0ee309410408a718c
SSDEEP

12288:/1IrmedBigNA8BmUE5h4ytt0FPSQ1WjHo9zFaOw3D6S:8maB3FmUEj4ytt0FPB1SomB

Score

10^/10

neshta persistence spyware stealer upx

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Executes dropped EXE 2 IoCs

Processes:

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exefb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe

pid	process
4784	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
4708	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe	upx
C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe	upx
behavioral2/memory/4708-139-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

Drops file in Windows directory 1 IoCs

Processes:

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

description ioc process

File opened for modification C:\Windows\svchost.com fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4612 4708 WerFault.exe fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

pid	pid_target	process	target process
4612	4708	WerFault.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe

Modifies registry class 1 IoCs

Processes:

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

pid process

4784 fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exefb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

description	pid	process	target process
PID 2568 wrote to memory of 4784	2568	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
PID 2568 wrote to memory of 4784	2568	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
PID 2568 wrote to memory of 4784	2568	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
PID 4784 wrote to memory of 4708	4784	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe
PID 4784 wrote to memory of 4708	4784	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe
PID 4784 wrote to memory of 4708	4784	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe	fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe

C:\Users\Admin\AppData\Local\Temp\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
"C:\Users\Admin\AppData\Local\Temp\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568

C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784

C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe
3⤵
- Executes dropped EXE
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 264
4⤵
- Program crash
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4708 -ip 4708
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

Filesize
652KB

MD5
97e25a6bd9697b04272696cb0ad46ec7

SHA1
4373d0d42c078f3297ca15975fac688ed110222f

SHA256
068c6871c56565ca8962b7f8e1377d137a517a16ea15642b69bac2dbe3d4c758

SHA512
55e67f23d40d0597eb49617d73fe8c5ad18e848eec452bd2147919d03d97f3a3e71e699c2da75df4c0cd580630a2bcb2d8f017007c327757d744bcb3d652fc4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480.exe

Filesize
652KB

MD5
97e25a6bd9697b04272696cb0ad46ec7

SHA1
4373d0d42c078f3297ca15975fac688ed110222f

SHA256
068c6871c56565ca8962b7f8e1377d137a517a16ea15642b69bac2dbe3d4c758

SHA512
55e67f23d40d0597eb49617d73fe8c5ad18e848eec452bd2147919d03d97f3a3e71e699c2da75df4c0cd580630a2bcb2d8f017007c327757d744bcb3d652fc4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe

Filesize
104KB

MD5
84b7783804fa7506672a409e9899c6be

SHA1
2da8a6e9c04662564e18cdf98f73e224a5662533

SHA256
b26a93c17ac6a412c6c191aa6a1543537f3185fe813c24153c6dec736fbad4ef

SHA512
8a867296b05f45dd79ab64b11b6cc0cc8fad835b2f5ba9b8469981cc9b3e15c91f98b688cbe7addfab7ea2bd55a1d475fc853c004afb24be1b5691f8183c897c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\fb3e6bcac169c1bf9b56002ddcace1e19f6c3c38828552e71a1d83bfa7cc7480mgr.exe

Filesize
104KB

MD5
84b7783804fa7506672a409e9899c6be

SHA1
2da8a6e9c04662564e18cdf98f73e224a5662533

SHA256
b26a93c17ac6a412c6c191aa6a1543537f3185fe813c24153c6dec736fbad4ef

SHA512
8a867296b05f45dd79ab64b11b6cc0cc8fad835b2f5ba9b8469981cc9b3e15c91f98b688cbe7addfab7ea2bd55a1d475fc853c004afb24be1b5691f8183c897c

Download Submit
memory/4708-135-0x0000000000000000-mapping.dmp

Download
memory/4708-139-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4784-132-0x0000000000000000-mapping.dmp

Download
memory/4784-138-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads