gh0strat | a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe
Size

121KB
MD5

6e99d55e2249e0ec6af52ef986fa0e1d
SHA1

d91a7646204ef1491c756ca59085327eda43c949
SHA256

a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f
SHA512

0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e
SSDEEP

3072:zWPi626T8Md/8I64gsHaARfVrhz9gz0BcjMJHXHiU:zWPruq6a7azQhHXCU

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 52 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4692-132-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\69A4D845.exe	family_gh0strat
behavioral2/memory/1688-137-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/4792-142-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
behavioral2/memory/4792-143-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/2184-146-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/4956-149-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/2204-152-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/2808-155-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/4896-158-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/3848-161-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/692-164-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/456-167-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/3272-170-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/404-173-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/1636-176-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/3512-179-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/3640-182-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/428-185-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/1284-188-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
behavioral2/memory/3408-191-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/4196-194-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/3936-197-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/4204-200-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/2192-203-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/2168-206-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/5012-209-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
C:\Windows\20BF1A22.exe	family_gh0strat
behavioral2/memory/4180-212-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 25 IoCs

Processes:

69A4D845.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe20BF1A22.exe

pid	process
1688	69A4D845.exe
4792	20BF1A22.exe
2184	20BF1A22.exe
4956	20BF1A22.exe
2204	20BF1A22.exe
2808	20BF1A22.exe
4896	20BF1A22.exe
3848	20BF1A22.exe
692	20BF1A22.exe
456	20BF1A22.exe
3272	20BF1A22.exe
404	20BF1A22.exe
1636	20BF1A22.exe
3512	20BF1A22.exe
3640	20BF1A22.exe
428	20BF1A22.exe
1284	20BF1A22.exe
3408	20BF1A22.exe
4196	20BF1A22.exe
3936	20BF1A22.exe
4204	20BF1A22.exe
2192	20BF1A22.exe
2168	20BF1A22.exe
5012	20BF1A22.exe
4180	20BF1A22.exe

Drops file in Windows directory 2 IoCs

Processes:

a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe69A4D845.exe

description	ioc	process
File opened for modification	\??\c:\Windows\69A4D845.exe	a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe
File opened for modification	\??\c:\Windows\20BF1A22.exe	69A4D845.exe

Modifies data under HKEY_USERS 25 IoCs

Processes:

scrcons.exewscript.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{596AB062-B4D2-4215-9F74-E9109B0A8153} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006e438f3423ffd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99D353BC-C813-41EC-8F28-EAE61E702E57} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 0100000000000000f5ef9f3423ffd801	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{474C98EE-CF3D-41F5-80E3-4AAB0AB04301} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004ca2913423ffd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f5ef9f3423ffd801	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{470C0EBD-5D73-4D58-9CED-E91E22E23282} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006eb3a43423ffd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1D27F844-3A1F-4410-85AC-14651078412D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005115a73423ffd801	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c05ba23423ffd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 0100000000000000c05ba23423ffd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006eb3a43423ffd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f5ef9f3423ffd801	scrcons.exe

Suspicious behavior: RenamesItself 2 IoCs

Processes:

a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe69A4D845.exe

pid process

4692 a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe
1688 69A4D845.exe

pid	process
4692	a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe
1688	69A4D845.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exescrcons.exe69A4D845.exe

description	pid	process	target process
PID 4692 wrote to memory of 2288	4692	a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe	wscript.exe
PID 4692 wrote to memory of 2288	4692	a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe	wscript.exe
PID 4692 wrote to memory of 2288	4692	a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe	wscript.exe
PID 712 wrote to memory of 1688	712	scrcons.exe	69A4D845.exe
PID 712 wrote to memory of 1688	712	scrcons.exe	69A4D845.exe
PID 712 wrote to memory of 1688	712	scrcons.exe	69A4D845.exe
PID 1688 wrote to memory of 2440	1688	69A4D845.exe	wscript.exe
PID 1688 wrote to memory of 2440	1688	69A4D845.exe	wscript.exe
PID 1688 wrote to memory of 2440	1688	69A4D845.exe	wscript.exe
PID 712 wrote to memory of 4792	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4792	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4792	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 2184	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 2184	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 2184	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4956	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4956	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4956	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 2204	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 2204	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 2204	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 2808	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 2808	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 2808	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4896	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4896	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4896	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3848	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3848	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3848	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 692	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 692	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 692	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 456	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 456	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 456	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3272	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3272	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3272	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 404	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 404	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 404	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 1636	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 1636	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 1636	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3512	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3512	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3512	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3640	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3640	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3640	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 428	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 428	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 428	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 1284	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 1284	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 1284	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3408	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3408	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3408	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4196	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4196	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 4196	712	scrcons.exe	20BF1A22.exe
PID 712 wrote to memory of 3936	712	scrcons.exe	20BF1A22.exe

C:\Users\Admin\AppData\Local\Temp\a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe
"C:\Users\Admin\AppData\Local\Temp\a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\lcggwyakq.vbs" //B //Nologo
2⤵
PID:2288

C:\Windows\system32\wbem\scrcons.exe
C:\Windows\system32\wbem\scrcons.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:712

C:\Windows\69A4D845.exe
"C:\Windows\69A4D845.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\system32\wscript.exe" "C:\Windows\TEMP\iefqenlgxs.vbs" //B //Nologo
3⤵
- Modifies data under HKEY_USERS
PID:2440

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:4792

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:2184

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:4956

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:2204

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:2808

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:4896

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:3848

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:692

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:456

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:3272

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:404

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:1636

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:3512

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:3640

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:428

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:1284

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:3408

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:4196

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:3936

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:4204

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:2192

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:2168

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:5012

C:\Windows\20BF1A22.exe
"C:\Windows\20BF1A22.exe"
2⤵
- Executes dropped EXE
PID:4180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lcggwyakq.vbs

Filesize
1KB

MD5
a12d54fcf25c3ec6a40ac00b79a9c01e

SHA1
e77e708c1c0fb5e10f5671d70a02c17bd5735327

SHA256
d1bac148e9bb8600880c90495e7d389fe0f8c1e7536e4ce21aae114e709b2a1d

SHA512
d159c4b4f1e72f03abbba5edf78d63fcf39e1343cfce826f1647f391db86eb2a628cc64faf5e1b0580aa3b0e432df6776642444bd940df8a005f14ec54aa4461

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\20BF1A22.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\69A4D845.exe

Filesize
121KB

MD5
6e99d55e2249e0ec6af52ef986fa0e1d

SHA1
d91a7646204ef1491c756ca59085327eda43c949

SHA256
a670246a5fb7dbf85af274909888b4db24a0fe7460ddc39c412ca128fdeb625f

SHA512
0ea3be72025a7a7799ace2a42432418dae44a2c4b40548bc573d3f52504ae1a99db97ff0b2fb6fa200dcc8d5b44ec3c580dd4627978a2ae982e8ea65083ce37e

Download Submit
C:\Windows\TEMP\iefqenlgxs.vbs

Filesize
1KB

MD5
62f8f8c39a207e5b1031d98e629890a8

SHA1
11bdd3e05a71dc923e0c0ca8ba8ba33c72135e50

SHA256
372b28d15056d9f906ecc4e9cce1e797fb52d750fcf66a8f7dcbcb62844d8fe0

SHA512
f162c9c533af8d5b99172937262da82672db0224d81e0a7ad5c9612e57183fd4b9cd9d79b351b78d9e18d0a4b008547dccd26f94e7a693e50ed01490812775e4

Download Submit
memory/404-171-0x0000000000000000-mapping.dmp

Download
memory/404-173-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/428-185-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/428-183-0x0000000000000000-mapping.dmp

Download
memory/456-165-0x0000000000000000-mapping.dmp

Download
memory/456-167-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/692-162-0x0000000000000000-mapping.dmp

Download
memory/692-164-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1284-188-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1284-186-0x0000000000000000-mapping.dmp

Download
memory/1636-174-0x0000000000000000-mapping.dmp

Download
memory/1636-176-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1688-135-0x0000000000000000-mapping.dmp

Download
memory/1688-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2168-206-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2168-204-0x0000000000000000-mapping.dmp

Download
memory/2184-146-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2184-144-0x0000000000000000-mapping.dmp

Download
memory/2192-201-0x0000000000000000-mapping.dmp

Download
memory/2192-203-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2204-152-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2204-150-0x0000000000000000-mapping.dmp

Download
memory/2288-133-0x0000000000000000-mapping.dmp

Download
memory/2440-138-0x0000000000000000-mapping.dmp

Download
memory/2808-155-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2808-153-0x0000000000000000-mapping.dmp

Download
memory/3272-170-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3272-168-0x0000000000000000-mapping.dmp

Download
memory/3408-189-0x0000000000000000-mapping.dmp

Download
memory/3408-191-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3512-179-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3512-177-0x0000000000000000-mapping.dmp

Download
memory/3640-180-0x0000000000000000-mapping.dmp

Download
memory/3640-182-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3848-161-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3848-159-0x0000000000000000-mapping.dmp

Download
memory/3936-197-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3936-195-0x0000000000000000-mapping.dmp

Download
memory/4180-212-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4180-210-0x0000000000000000-mapping.dmp

Download
memory/4196-192-0x0000000000000000-mapping.dmp

Download
memory/4196-194-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4204-198-0x0000000000000000-mapping.dmp

Download
memory/4204-200-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4692-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4792-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4792-140-0x0000000000000000-mapping.dmp

Download
memory/4792-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4896-158-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4896-156-0x0000000000000000-mapping.dmp

Download
memory/4956-147-0x0000000000000000-mapping.dmp

Download
memory/4956-149-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5012-209-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5012-207-0x0000000000000000-mapping.dmp

Download