xtremerat | c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7

General

Target

c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
Size

526KB
MD5

5109339d6fbcf467a9d50cd9e092c480
SHA1

819f1177d29584624eb9b1b9c219f550b068125b
SHA256

c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7
SHA512

0ff6c31444662eb8e8322f676f735f5a3a288c9c8b587592d2f9d40ab2cba0c3ac7c4379d84c7a24565ca588f85b5b6302bf5896cc19d3bf4033504486d16129
SSDEEP

12288:Feo9tmBXojQaRK+nm7tqpVCm257KzQWFUrZAf05pVMSr:0h4jQaR5nmheg57XCULLVM

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Executes dropped EXE 2 IoCs

Processes:

appinit.exeappinit.exe

pid process

4596 appinit.exe
3876 appinit.exe

pid	process
4596	appinit.exe
3876	appinit.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3504-152-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/3504-153-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/3504-154-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/3504-156-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/3504-157-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/3504-159-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/3504-158-0x0000000001610000-0x0000000001720000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exeappinit.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\{90783-8547-9081-90}\\appinit.exe"	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	appinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\{90783-8547-9081-90}\\appinit.exe"	appinit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\{90783-8547-9081-90}\\appinit.exe"	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	appinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\{90783-8547-9081-90}\\appinit.exe"	appinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\{90783-8547-9081-90}\\appinit.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\{90783-8547-9081-90}\\appinit.exe"	explorer.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exeappinit.exeappinit.exe

description	pid	process	target process
PID 4908 set thread context of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4596 set thread context of 3876	4596	appinit.exe	appinit.exe
PID 3876 set thread context of 3504	3876	appinit.exe	explorer.exe

Drops file in Windows directory 5 IoCs

Processes:

c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exeappinit.exe

description	ioc	process
File opened for modification	C:\Windows\{90783-8547-9081-90}\	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
File opened for modification	C:\Windows\{90783-8547-9081-90}\appinit.exe	appinit.exe
File opened for modification	C:\Windows\{90783-8547-9081-90}\	appinit.exe
File opened for modification	C:\Windows\{90783-8547-9081-90}\appinit.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
File created	C:\Windows\{90783-8547-9081-90}\appinit.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe

Modifies registry class 1 IoCs

Processes:

c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

explorer.exe

pid process

3504 explorer.exe
3504 explorer.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exeexplorer.exe

pid process

4904 c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
3504 explorer.exe

pid	process
3504	explorer.exe
3504	explorer.exe

pid	process
4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
3504	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exec844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe

description	pid	process	target process
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4908 wrote to memory of 4904	4908	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
PID 4904 wrote to memory of 3988	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 3988	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 4560	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4560	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4560	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4708	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 4708	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 4716	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4716	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4716	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 1356	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 1356	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 4608	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4608	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4608	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4632	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 4632	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 4032	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4032	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4032	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 5068	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 5068	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 5104	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 5104	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 5104	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 5084	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 5084	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 5064	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 5064	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 5064	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 5080	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 5080	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 4616	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4616	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 4616	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 1580	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 1580	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 116	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 116	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 116	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 204	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 204	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 5036	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 5036	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 5036	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 2248	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 2248	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe
PID 4904 wrote to memory of 3896	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 3896	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 3896	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	explorer.exe
PID 4904 wrote to memory of 2336	4904	c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
"C:\Users\Admin\AppData\Local\Temp\c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4908

C:\Users\Admin\AppData\Local\Temp\c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe
"C:\Users\Admin\AppData\Local\Temp\c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:3988

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4708

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:1356

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4632

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:5068

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:5084

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:5080

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:1580

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:204

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:5036

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2336

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4984

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2616

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2404

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4680

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:3196

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4728

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:3040

C:\Windows\{90783-8547-9081-90}\appinit.exe
"C:\Windows\{90783-8547-9081-90}\appinit.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4596

C:\Windows\{90783-8547-9081-90}\appinit.exe
"C:\Windows\{90783-8547-9081-90}\appinit.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:860

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
- Adds Run key to start application
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\G5lZfyWn78ljg6\G5lZfyWn78ljg6.dat
Filesize
2B

MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\G5lZfyWn78ljg6\G5lZfyWn78ljg6.nfo
Filesize
3KB

MD5
f7fae5c69b6ae78f297542f1c1405dcf

SHA1
e275446b5bff321022e3833f67f63d1d0cca3883

SHA256
c13949237267afdf33459d743748646af80dd77f291f0a0644b9edb7953a0d94

SHA512
953f4f55494e58273a0d371db6cfcc10a18e9374d411eb8ae5e469c7a80bf706940ad1569a475a8c52d5e43ab7127c2206831d7aec97f6a3bc8defa67e8c65f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\G5lZfyWn78ljg6\G5lZfyWn78ljg6.nfo
Filesize
3KB

MD5
f7fae5c69b6ae78f297542f1c1405dcf

SHA1
e275446b5bff321022e3833f67f63d1d0cca3883

SHA256
c13949237267afdf33459d743748646af80dd77f291f0a0644b9edb7953a0d94

SHA512
953f4f55494e58273a0d371db6cfcc10a18e9374d411eb8ae5e469c7a80bf706940ad1569a475a8c52d5e43ab7127c2206831d7aec97f6a3bc8defa67e8c65f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\G5lZfyWn78ljg6\G5lZfyWn78ljg6.svr
Filesize
358KB

MD5
ad69242f4bf9548496051bd95ac05e1e

SHA1
913292f6b83adf41337fd50201ad341500abc8b0

SHA256
2663fdfe0fe4c37532f919282d035579bf84a895be5971982437cffbd41bdb1b

SHA512
09bed3adc8427e4aeec4e32dfd0640da71d2839b62973e4bae94f0965c5836028511295d99be878af388789fc020117972c3cf51d5a2ef1899aeb9d43c2fd94e

Download Submit
C:\Windows\{90783-8547-9081-90}\appinit.exe
Filesize
526KB

MD5
5109339d6fbcf467a9d50cd9e092c480

SHA1
819f1177d29584624eb9b1b9c219f550b068125b

SHA256
c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7

SHA512
0ff6c31444662eb8e8322f676f735f5a3a288c9c8b587592d2f9d40ab2cba0c3ac7c4379d84c7a24565ca588f85b5b6302bf5896cc19d3bf4033504486d16129

Download Submit
C:\Windows\{90783-8547-9081-90}\appinit.exe
Filesize
526KB

MD5
5109339d6fbcf467a9d50cd9e092c480

SHA1
819f1177d29584624eb9b1b9c219f550b068125b

SHA256
c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7

SHA512
0ff6c31444662eb8e8322f676f735f5a3a288c9c8b587592d2f9d40ab2cba0c3ac7c4379d84c7a24565ca588f85b5b6302bf5896cc19d3bf4033504486d16129

Download Submit
C:\Windows\{90783-8547-9081-90}\appinit.exe
Filesize
526KB

MD5
5109339d6fbcf467a9d50cd9e092c480

SHA1
819f1177d29584624eb9b1b9c219f550b068125b

SHA256
c844b326d9151ac6606ef20410e1bcdcc26d1d0bbaeccfb97002199b19777ee7

SHA512
0ff6c31444662eb8e8322f676f735f5a3a288c9c8b587592d2f9d40ab2cba0c3ac7c4379d84c7a24565ca588f85b5b6302bf5896cc19d3bf4033504486d16129

Download Submit
memory/3504-158-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/3504-156-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/3504-153-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/3504-166-0x00000000016C5000-0x000000000171E000-memory.dmp

Filesize
356KB

Download
memory/3504-154-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/3504-165-0x00000000016C5000-0x000000000171E000-memory.dmp

Filesize
356KB

Download
memory/3504-163-0x00000000016C5000-0x000000000171E000-memory.dmp

Filesize
356KB

Download
memory/3504-157-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/3504-159-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/3504-164-0x0000000001611000-0x00000000016C5000-memory.dmp

Filesize
720KB

Download
memory/3504-151-0x0000000000000000-mapping.dmp

Download
memory/3504-152-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/3876-141-0x0000000000000000-mapping.dmp

Download
memory/3876-162-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3876-149-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4596-142-0x0000000072E80000-0x0000000073431000-memory.dmp

Filesize
5.7MB

Download
memory/4596-145-0x0000000072E80000-0x0000000073431000-memory.dmp

Filesize
5.7MB

Download
memory/4596-138-0x0000000000000000-mapping.dmp

Download
memory/4904-148-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4904-137-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4904-134-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4904-133-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4904-132-0x0000000000000000-mapping.dmp

Download
memory/4904-136-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4908-135-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads