xtremerat | cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4

General

Target

cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
Size

646KB
MD5

fac9fe795014ff2760a485836bce4f3e
SHA1

1a00b3edc541d3514a2b5efef2e9dcfd7c34160a
SHA256

cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4
SHA512

a3edf1ab89629a3278f7197f576d37163236cb93e01df511ac686b0d2b0bd6ef65a839387e43d9aebce7e57a72c407b3b791859632ce95880b44a12989192209
SSDEEP

12288:FmdibbI6DagCtX2UGsSjP+Yw0ODICU9jZ8Y7W4tJX:s3o+m/nPOD4f8YCsX

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Adds policy Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exesvchost.exeadobett.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	adobett.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	adobett.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	adobett.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	adobett.exe

Executes dropped EXE 4 IoCs

Processes:

adobett.exeadobett.exeadobett.exeadobett.exe

pid process

484 adobett.exe
1144 adobett.exe
2020 adobett.exe
1804 adobett.exe
Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

1748 explorer.exe
Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

1392 svchost.exe

pid	process
484	adobett.exe
1144	adobett.exe
2020	adobett.exe
1804	adobett.exe

pid	process
1748	explorer.exe

pid	process
1392	svchost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

adobett.execfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	adobett.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	adobett.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	adobett.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Tetris = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Tetris\\adobett.exe"	adobett.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exeadobett.exeadobett.exe

description	pid	process	target process
PID 2040 set thread context of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 484 set thread context of 1144	484	adobett.exe	adobett.exe
PID 2020 set thread context of 1804	2020	adobett.exe	adobett.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.execfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe

description	pid	process	target process
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 2040 wrote to memory of 1128	2040	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
PID 1128 wrote to memory of 1392	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	svchost.exe
PID 1128 wrote to memory of 1392	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	svchost.exe
PID 1128 wrote to memory of 1392	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	svchost.exe
PID 1128 wrote to memory of 1392	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	svchost.exe
PID 1128 wrote to memory of 1392	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	svchost.exe
PID 1128 wrote to memory of 676	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 676	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 676	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 676	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 568	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 568	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 568	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 568	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1748	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1748	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1748	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1748	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1748	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1096	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1096	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1096	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1096	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1488	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1488	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1488	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1488	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 824	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 824	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 824	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 824	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1348	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1348	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1348	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1348	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1052	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1052	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1052	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1052	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1548	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1548	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1548	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1548	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1740	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1740	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1740	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1740	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1336	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1336	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1336	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1336	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	explorer.exe
PID 1128 wrote to memory of 1244	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe
PID 1128 wrote to memory of 1244	1128	cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
"C:\Users\Admin\AppData\Local\Temp\cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe
"C:\Users\Admin\AppData\Local\Temp\cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Adds Run key to start application
PID:1392

C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
"C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:484

C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
"C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
PID:1144

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1660

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1192

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1764

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2028

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:940

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1500

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1684

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1908

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1912

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1768

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1980

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1808

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1840

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1424

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1044

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2000

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1668

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1992

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1104

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1096

C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
"C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2020

C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
"C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe"
5⤵
- Executes dropped EXE
PID:1804

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:676

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:568

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Deletes itself
PID:1748

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1096

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1488

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:824

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1348

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1052

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1740

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1336

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1244

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1592

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1564

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:924

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1520

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1540

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1416

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1968

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1788

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1792

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:680

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1300

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:960

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1280

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:296

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:944

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1160

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:432

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1064

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1164

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
Filesize
646KB

MD5
fac9fe795014ff2760a485836bce4f3e

SHA1
1a00b3edc541d3514a2b5efef2e9dcfd7c34160a

SHA256
cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4

SHA512
a3edf1ab89629a3278f7197f576d37163236cb93e01df511ac686b0d2b0bd6ef65a839387e43d9aebce7e57a72c407b3b791859632ce95880b44a12989192209

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
Filesize
646KB

MD5
fac9fe795014ff2760a485836bce4f3e

SHA1
1a00b3edc541d3514a2b5efef2e9dcfd7c34160a

SHA256
cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4

SHA512
a3edf1ab89629a3278f7197f576d37163236cb93e01df511ac686b0d2b0bd6ef65a839387e43d9aebce7e57a72c407b3b791859632ce95880b44a12989192209

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
Filesize
646KB

MD5
fac9fe795014ff2760a485836bce4f3e

SHA1
1a00b3edc541d3514a2b5efef2e9dcfd7c34160a

SHA256
cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4

SHA512
a3edf1ab89629a3278f7197f576d37163236cb93e01df511ac686b0d2b0bd6ef65a839387e43d9aebce7e57a72c407b3b791859632ce95880b44a12989192209

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
Filesize
646KB

MD5
fac9fe795014ff2760a485836bce4f3e

SHA1
1a00b3edc541d3514a2b5efef2e9dcfd7c34160a

SHA256
cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4

SHA512
a3edf1ab89629a3278f7197f576d37163236cb93e01df511ac686b0d2b0bd6ef65a839387e43d9aebce7e57a72c407b3b791859632ce95880b44a12989192209

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
Filesize
646KB

MD5
fac9fe795014ff2760a485836bce4f3e

SHA1
1a00b3edc541d3514a2b5efef2e9dcfd7c34160a

SHA256
cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4

SHA512
a3edf1ab89629a3278f7197f576d37163236cb93e01df511ac686b0d2b0bd6ef65a839387e43d9aebce7e57a72c407b3b791859632ce95880b44a12989192209

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MYJ5jZ6DFjzx\MYJ5jZ6DFjzx.nfo
Filesize
3KB

MD5
64cca211e30dfe509ff50ad294ad8bd4

SHA1
1f4ea9069922b49eb7dcc2047b67fb4c3d12ce6e

SHA256
01fd18934a6520ce63af8b4c30156b4e2bb5c2a069c5dec654d07bedbbc6be9f

SHA512
a0c397cece830fca0c0d2851597d878541361da3d563da3043ffb94ed7541aeb301c1c0ec19bb956c49c8e3f7520f0129b85e7f608461a5bddc79e6c6284bce7

Download Submit
\Users\Admin\AppData\Roaming\Adobe Tetris\adobett.exe
Filesize
646KB

MD5
fac9fe795014ff2760a485836bce4f3e

SHA1
1a00b3edc541d3514a2b5efef2e9dcfd7c34160a

SHA256
cfda7f297276d61aea2a64447e97237504b4e87fea2543d968a97d02d59c46c4

SHA512
a3edf1ab89629a3278f7197f576d37163236cb93e01df511ac686b0d2b0bd6ef65a839387e43d9aebce7e57a72c407b3b791859632ce95880b44a12989192209

Download Submit
memory/484-84-0x0000000000000000-mapping.dmp

Download
memory/1128-55-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-65-0x0000000000408600-mapping.dmp

Download
memory/1128-68-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-69-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-70-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-66-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-64-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-62-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-104-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-58-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-59-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-61-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1128-60-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1144-102-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1144-97-0x0000000000408600-mapping.dmp

Download
memory/1144-105-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1144-125-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1392-76-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1392-73-0x0000000000000000-mapping.dmp

Download
memory/1748-82-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1748-81-0x00000000747C1000-0x00000000747C3000-memory.dmp

Filesize
8KB

Download
memory/1748-79-0x0000000000000000-mapping.dmp

Download
memory/1804-119-0x0000000000408600-mapping.dmp

Download
memory/1804-124-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2020-106-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads