Analysis
-
max time kernel
167s -
max time network
200s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:31
Static task
static1
Behavioral task
behavioral1
Sample
6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe
Resource
win10v2004-20221111-en
General
-
Target
6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe
-
Size
152KB
-
MD5
e7c6eadfef09694d56a38efec25b5fa0
-
SHA1
290979641ffac5d7f1f67843634bd5fb8572b1a3
-
SHA256
6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73
-
SHA512
40bfe3cb19161d8d39928577d53dda7a16a1044331cc8ef55a0bc2902dba21d48f6e1a44757c0d02835fdcc95079bf96e78b885a0601ed7c997d7db0f03a7b44
-
SSDEEP
1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral1/memory/108-112-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/108-113-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1604-169-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1604-170-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1440-228-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1440-232-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 13 IoCs
Processes:
svhust.exesvhust.exesvhust.exeAdobeART.exeAdobeART.exesvhust.exesvhust.exesvhust.exeAdobeART.exeAdobeART.exesvhust.exesvhust.exesvhust.exepid process 1444 svhust.exe 1568 svhust.exe 108 svhust.exe 796 AdobeART.exe 1808 AdobeART.exe 1352 svhust.exe 1728 svhust.exe 1604 svhust.exe 1572 AdobeART.exe 980 AdobeART.exe 1508 svhust.exe 1636 svhust.exe 1440 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/852-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/852-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/852-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/852-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/852-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/852-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/108-95-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/108-98-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/108-100-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/852-105-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1568-107-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/108-108-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1568-110-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/108-111-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/108-112-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/108-113-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1808-135-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1808-166-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1604-168-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1604-169-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1604-170-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/980-192-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/980-226-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1636-227-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1440-228-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1728-230-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1636-231-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1440-232-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Loads dropped DLL 13 IoCs
Processes:
6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exesvhust.exeAdobeART.exesvhust.exeAdobeART.exepid process 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 108 svhust.exe 108 svhust.exe 1808 AdobeART.exe 1808 AdobeART.exe 1808 AdobeART.exe 1604 svhust.exe 980 AdobeART.exe 980 AdobeART.exe 980 AdobeART.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" svhust.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exesvhust.exeAdobeART.exesvhust.exeAdobeART.exesvhust.exedescription pid process target process PID 1236 set thread context of 852 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe PID 1444 set thread context of 1568 1444 svhust.exe svhust.exe PID 1444 set thread context of 108 1444 svhust.exe svhust.exe PID 796 set thread context of 1808 796 AdobeART.exe AdobeART.exe PID 1352 set thread context of 1728 1352 svhust.exe svhust.exe PID 1352 set thread context of 1604 1352 svhust.exe svhust.exe PID 1572 set thread context of 980 1572 AdobeART.exe AdobeART.exe PID 1508 set thread context of 1636 1508 svhust.exe svhust.exe PID 1508 set thread context of 1440 1508 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exesvhust.exesvhust.exedescription pid process Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe Token: SeDebugPrivilege 1636 svhust.exe Token: SeDebugPrivilege 1568 svhust.exe Token: SeDebugPrivilege 1728 svhust.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exesvhust.exesvhust.exeAdobeART.exeAdobeART.exesvhust.exesvhust.exeAdobeART.exeAdobeART.exesvhust.exesvhust.exepid process 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 1444 svhust.exe 1568 svhust.exe 796 AdobeART.exe 1808 AdobeART.exe 1352 svhust.exe 1728 svhust.exe 1572 AdobeART.exe 980 AdobeART.exe 1508 svhust.exe 1636 svhust.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.execmd.exesvhust.exesvhust.exeAdobeART.exeAdobeART.exesvhust.exedescription pid process target process PID 1236 wrote to memory of 852 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe PID 1236 wrote to memory of 852 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe PID 1236 wrote to memory of 852 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe PID 1236 wrote to memory of 852 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe PID 1236 wrote to memory of 852 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe PID 1236 wrote to memory of 852 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe PID 1236 wrote to memory of 852 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe PID 1236 wrote to memory of 852 1236 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe PID 852 wrote to memory of 1136 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe cmd.exe PID 852 wrote to memory of 1136 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe cmd.exe PID 852 wrote to memory of 1136 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe cmd.exe PID 852 wrote to memory of 1136 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe cmd.exe PID 1136 wrote to memory of 988 1136 cmd.exe reg.exe PID 1136 wrote to memory of 988 1136 cmd.exe reg.exe PID 1136 wrote to memory of 988 1136 cmd.exe reg.exe PID 1136 wrote to memory of 988 1136 cmd.exe reg.exe PID 852 wrote to memory of 1444 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe svhust.exe PID 852 wrote to memory of 1444 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe svhust.exe PID 852 wrote to memory of 1444 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe svhust.exe PID 852 wrote to memory of 1444 852 6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe svhust.exe PID 1444 wrote to memory of 1568 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 1568 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 1568 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 1568 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 1568 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 1568 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 1568 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 1568 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 108 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 108 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 108 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 108 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 108 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 108 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 108 1444 svhust.exe svhust.exe PID 1444 wrote to memory of 108 1444 svhust.exe svhust.exe PID 108 wrote to memory of 796 108 svhust.exe AdobeART.exe PID 108 wrote to memory of 796 108 svhust.exe AdobeART.exe PID 108 wrote to memory of 796 108 svhust.exe AdobeART.exe PID 108 wrote to memory of 796 108 svhust.exe AdobeART.exe PID 796 wrote to memory of 1808 796 AdobeART.exe AdobeART.exe PID 796 wrote to memory of 1808 796 AdobeART.exe AdobeART.exe PID 796 wrote to memory of 1808 796 AdobeART.exe AdobeART.exe PID 796 wrote to memory of 1808 796 AdobeART.exe AdobeART.exe PID 796 wrote to memory of 1808 796 AdobeART.exe AdobeART.exe PID 796 wrote to memory of 1808 796 AdobeART.exe AdobeART.exe PID 796 wrote to memory of 1808 796 AdobeART.exe AdobeART.exe PID 796 wrote to memory of 1808 796 AdobeART.exe AdobeART.exe PID 1808 wrote to memory of 1352 1808 AdobeART.exe svhust.exe PID 1808 wrote to memory of 1352 1808 AdobeART.exe svhust.exe PID 1808 wrote to memory of 1352 1808 AdobeART.exe svhust.exe PID 1808 wrote to memory of 1352 1808 AdobeART.exe svhust.exe PID 1352 wrote to memory of 1728 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1728 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1728 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1728 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1728 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1728 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1728 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1728 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1604 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1604 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1604 1352 svhust.exe svhust.exe PID 1352 wrote to memory of 1604 1352 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe"C:\Users\Admin\AppData\Local\Temp\6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe"C:\Users\Admin\AppData\Local\Temp\6445fa2fe1401ffe44b1fff531c5f664ab63471e9efc91ba80db513fe8950a73.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XLPUB.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"12⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XLPUB.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
152KB
MD5fe7b18b6c3381dee88ad9180a54ceb87
SHA1414b965ad14e5fe04a8d795d39c18a4ec1823e04
SHA256a5c4250995021138394d8f9e2b77f2aea1e203465cb79315130c16a0e38ae22d
SHA512f3d9efb2363d0a01ef42bba1bc26d62331ff7107f66f2ef8ecb4995a545f1ad57b93b0868d9eba0530e9fecf1ea1c38d2934a25c3b3574d42a5420019e9a02dd
-
memory/108-101-0x0000000000412D20-mapping.dmp
-
memory/108-95-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/108-93-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/108-111-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/108-112-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/108-113-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/108-108-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/108-98-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/108-100-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/796-120-0x000000000059C000-0x00000000005A3000-memory.dmpFilesize
28KB
-
memory/796-116-0x0000000000000000-mapping.dmp
-
memory/852-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/852-105-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/852-63-0x00000000004085D0-mapping.dmp
-
memory/852-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/852-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/852-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/852-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/852-70-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/852-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/852-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/980-185-0x00000000004085D0-mapping.dmp
-
memory/980-226-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/980-192-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/988-73-0x0000000000000000-mapping.dmp
-
memory/1136-71-0x0000000000000000-mapping.dmp
-
memory/1236-56-0x000000000030D000-0x0000000000314000-memory.dmpFilesize
28KB
-
memory/1352-144-0x00000000002AC000-0x00000000002B3000-memory.dmpFilesize
28KB
-
memory/1352-140-0x0000000000000000-mapping.dmp
-
memory/1440-232-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1440-228-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1440-219-0x0000000000412D20-mapping.dmp
-
memory/1444-78-0x0000000000000000-mapping.dmp
-
memory/1444-82-0x000000000061C000-0x0000000000623000-memory.dmpFilesize
28KB
-
memory/1508-197-0x0000000000000000-mapping.dmp
-
memory/1568-90-0x00000000004085D0-mapping.dmp
-
memory/1568-110-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1568-107-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1572-173-0x0000000000000000-mapping.dmp
-
memory/1572-177-0x000000000060C000-0x0000000000613000-memory.dmpFilesize
28KB
-
memory/1604-168-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1604-170-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1604-169-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1604-162-0x0000000000412D20-mapping.dmp
-
memory/1636-227-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1636-208-0x00000000004085D0-mapping.dmp
-
memory/1636-231-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1728-151-0x00000000004085D0-mapping.dmp
-
memory/1728-230-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1808-135-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1808-166-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1808-128-0x00000000004085D0-mapping.dmp