xtremerat | d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af

General

Target

d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
Size

405KB
MD5

acb6797410609685f65ce25978fbbc71
SHA1

79d4daf4cc98668cf62cf6e1d5e3628e6edbd8b2
SHA256

d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af
SHA512

d3aa92f9bd9876a00cfd079550e6fa82bd2d3d51fc2aea4ed94bf107da0bf6f1093f3abb6a25702711ce8caf722ba089d520f3111586278fa73ba977a6208d5e
SSDEEP

12288:VkqF3zfVnl6VCB+lHOWbtOBEtV1H8UTAti5:VkqF3hoAyx2Vc5

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	explorer.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Adds policy Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exeSkype.exeexplorer.exed53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	Skype.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	Skype.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Skype.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Skype.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe

Executes dropped EXE 2 IoCs

Processes:

Skype.exeSkype.exe

pid process

4084 Skype.exe
2392 Skype.exe

pid	process
4084	Skype.exe
2392	Skype.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1156-143-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/1156-144-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/1156-145-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/1156-147-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/1156-148-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/1156-149-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral2/memory/1156-150-0x0000000001610000-0x0000000001720000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Skype.exeexplorer.exed53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	Skype.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\google = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	Skype.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Skype.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\google\\Skype.exe"	Skype.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Skype.exe

description pid process target process

PID 4084 set thread context of 1156 4084 Skype.exe explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4084 set thread context of 1156	4084	Skype.exe	explorer.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

explorer.exe

pid process

1156 explorer.exe
1156 explorer.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exeexplorer.exe

pid process

4768 d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
1156 explorer.exe

pid	process
1156	explorer.exe
1156	explorer.exe

pid	process
4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
1156	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe

description	pid	process	target process
PID 4768 wrote to memory of 5000	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	svchost.exe
PID 4768 wrote to memory of 5000	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	svchost.exe
PID 4768 wrote to memory of 5000	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	svchost.exe
PID 4768 wrote to memory of 5000	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	svchost.exe
PID 4768 wrote to memory of 1256	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 1256	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 4540	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 4540	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 4540	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 1356	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 1356	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 4944	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 4944	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 4944	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 1712	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 1712	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 3716	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3716	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3716	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 2156	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 2156	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 364	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 364	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 364	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 2652	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 2652	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 972	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 972	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 972	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 996	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 996	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 3728	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3728	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3728	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3704	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 3704	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 3528	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3528	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3528	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 1312	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 1312	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 3512	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3512	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3512	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 4344	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 4344	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 680	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 680	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 680	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 724	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 724	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 2668	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 2668	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 2668	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 2256	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 2256	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 3200	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3200	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 3200	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 5088	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 5088	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	msedge.exe
PID 4768 wrote to memory of 2804	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 2804	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe
PID 4768 wrote to memory of 2804	4768	d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe
"C:\Users\Admin\AppData\Local\Temp\d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af.exe"
1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
PID:5000

C:\Users\Admin\AppData\Roaming\google\Skype.exe
"C:\Users\Admin\AppData\Roaming\google\Skype.exe"
3⤵
- Executes dropped EXE
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:1256

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:1356

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:1712

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:3716

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:2156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:2652

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:996

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:3704

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:1312

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:4344

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:680

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:2256

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:5088

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:2804

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:1700

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:2848

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:1608

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
PID:3772

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:1756

C:\Users\Admin\AppData\Roaming\google\Skype.exe
"C:\Users\Admin\AppData\Roaming\google\Skype.exe"
2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:4084

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VFwig3\VFwig3.dat
Filesize
2B

MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VFwig3\VFwig3.nfo
Filesize
3KB

MD5
68b0e56cce929d663e03223b27670144

SHA1
68bab0d2775dc47529be35876c0aea65ca24ceca

SHA256
74e03a39a97b67d6b1cbfc2d947407f58bc9d2b04da05a8f626c86a88748d32e

SHA512
3cd41fbe6227e2e0f769f9a68b74143801a45a393d3d75995c1c6ff800b9f17f226be9ee6496df84476c26308eace3e4392b38cc9b034d7e679cc8ca73025a1a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VFwig3\VFwig3.nfo
Filesize
3KB

MD5
68b0e56cce929d663e03223b27670144

SHA1
68bab0d2775dc47529be35876c0aea65ca24ceca

SHA256
74e03a39a97b67d6b1cbfc2d947407f58bc9d2b04da05a8f626c86a88748d32e

SHA512
3cd41fbe6227e2e0f769f9a68b74143801a45a393d3d75995c1c6ff800b9f17f226be9ee6496df84476c26308eace3e4392b38cc9b034d7e679cc8ca73025a1a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VFwig3\VFwig3.nfo
Filesize
3KB

MD5
68b0e56cce929d663e03223b27670144

SHA1
68bab0d2775dc47529be35876c0aea65ca24ceca

SHA256
74e03a39a97b67d6b1cbfc2d947407f58bc9d2b04da05a8f626c86a88748d32e

SHA512
3cd41fbe6227e2e0f769f9a68b74143801a45a393d3d75995c1c6ff800b9f17f226be9ee6496df84476c26308eace3e4392b38cc9b034d7e679cc8ca73025a1a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VFwig3\VFwig3.svr
Filesize
358KB

MD5
00671f81b85f89f4d846ec178eeff6cb

SHA1
c1809712719f84aa6e0ad8cc5ec20cd62aca615a

SHA256
f4498728dc99d4e0f67d9c0c3a0272b75f5c9b5e2680e0d7e2a4d8bef9da1b4c

SHA512
b31813a82e61d645c32e4f24337803d4ef045439bacc3401d0f724a5ae58d1fa9c17495f7678b09fb3c312f4c012e39f783ee2924461f72b2a05edaea6a4f39c

Download Submit
C:\Users\Admin\AppData\Roaming\google\Skype.exe
Filesize
405KB

MD5
acb6797410609685f65ce25978fbbc71

SHA1
79d4daf4cc98668cf62cf6e1d5e3628e6edbd8b2

SHA256
d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af

SHA512
d3aa92f9bd9876a00cfd079550e6fa82bd2d3d51fc2aea4ed94bf107da0bf6f1093f3abb6a25702711ce8caf722ba089d520f3111586278fa73ba977a6208d5e

Download Submit
C:\Users\Admin\AppData\Roaming\google\Skype.exe
Filesize
405KB

MD5
acb6797410609685f65ce25978fbbc71

SHA1
79d4daf4cc98668cf62cf6e1d5e3628e6edbd8b2

SHA256
d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af

SHA512
d3aa92f9bd9876a00cfd079550e6fa82bd2d3d51fc2aea4ed94bf107da0bf6f1093f3abb6a25702711ce8caf722ba089d520f3111586278fa73ba977a6208d5e

Download Submit
C:\Users\Admin\AppData\Roaming\google\Skype.exe
Filesize
405KB

MD5
acb6797410609685f65ce25978fbbc71

SHA1
79d4daf4cc98668cf62cf6e1d5e3628e6edbd8b2

SHA256
d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af

SHA512
d3aa92f9bd9876a00cfd079550e6fa82bd2d3d51fc2aea4ed94bf107da0bf6f1093f3abb6a25702711ce8caf722ba089d520f3111586278fa73ba977a6208d5e

Download Submit
memory/1156-142-0x0000000000000000-mapping.dmp

Download
memory/1156-148-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1156-155-0x00000000016C5000-0x000000000171E000-memory.dmp

Filesize
356KB

Download
memory/1156-143-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1156-144-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1156-145-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1156-147-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1156-154-0x0000000001611000-0x00000000016C5000-memory.dmp

Filesize
720KB

Download
memory/1156-149-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1156-150-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1156-153-0x00000000016C5000-0x000000000171E000-memory.dmp

Filesize
356KB

Download
memory/2392-136-0x0000000000000000-mapping.dmp

Download
memory/4084-135-0x0000000000000000-mapping.dmp

Download
memory/5000-134-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5000-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads