description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\servercik.exe = "C:\\Users\\Admin\\AppData\\Roaming\\servercik.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\C:\\Users\\Admin\\AppData\\Local\\Temp.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	%tmp%.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\servercik.exe"	%tmp%.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD73DAE2-D48F-AE47-B74C-9899CC4F7AEC}	%tmp%.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD73DAE2-D48F-AE47-B74C-9899CC4F7AEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\servercik.exe"	%tmp%.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{CD73DAE2-D48F-AE47-B74C-9899CC4F7AEC}	%tmp%.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{CD73DAE2-D48F-AE47-B74C-9899CC4F7AEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\servercik.exe"	%tmp%.exe

resource	yara_rule
behavioral2/files/0x0007000000022e43-135.dat	upx
behavioral2/files/0x0007000000022e43-136.dat	upx
behavioral2/memory/4316-139-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/4316-150-0x0000000000400000-0x000000000047B000-memory.dmp	upx

pid	Process
768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe
768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe
768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe
768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe
768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe
768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe
768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe
768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe
768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe

description	pid	Process
Token: SeDebugPrivilege	768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe
Token: 1	4316	%tmp%.exe
Token: SeCreateTokenPrivilege	4316	%tmp%.exe
Token: SeAssignPrimaryTokenPrivilege	4316	%tmp%.exe
Token: SeLockMemoryPrivilege	4316	%tmp%.exe
Token: SeIncreaseQuotaPrivilege	4316	%tmp%.exe
Token: SeMachineAccountPrivilege	4316	%tmp%.exe
Token: SeTcbPrivilege	4316	%tmp%.exe
Token: SeSecurityPrivilege	4316	%tmp%.exe
Token: SeTakeOwnershipPrivilege	4316	%tmp%.exe
Token: SeLoadDriverPrivilege	4316	%tmp%.exe
Token: SeSystemProfilePrivilege	4316	%tmp%.exe
Token: SeSystemtimePrivilege	4316	%tmp%.exe
Token: SeProfSingleProcessPrivilege	4316	%tmp%.exe
Token: SeIncBasePriorityPrivilege	4316	%tmp%.exe
Token: SeCreatePagefilePrivilege	4316	%tmp%.exe
Token: SeCreatePermanentPrivilege	4316	%tmp%.exe
Token: SeBackupPrivilege	4316	%tmp%.exe
Token: SeRestorePrivilege	4316	%tmp%.exe
Token: SeShutdownPrivilege	4316	%tmp%.exe
Token: SeDebugPrivilege	4316	%tmp%.exe
Token: SeAuditPrivilege	4316	%tmp%.exe
Token: SeSystemEnvironmentPrivilege	4316	%tmp%.exe
Token: SeChangeNotifyPrivilege	4316	%tmp%.exe
Token: SeRemoteShutdownPrivilege	4316	%tmp%.exe
Token: SeUndockPrivilege	4316	%tmp%.exe
Token: SeSyncAgentPrivilege	4316	%tmp%.exe
Token: SeEnableDelegationPrivilege	4316	%tmp%.exe
Token: SeManageVolumePrivilege	4316	%tmp%.exe
Token: SeImpersonatePrivilege	4316	%tmp%.exe
Token: SeCreateGlobalPrivilege	4316	%tmp%.exe
Token: 31	4316	%tmp%.exe
Token: 32	4316	%tmp%.exe
Token: 33	4316	%tmp%.exe
Token: 34	4316	%tmp%.exe
Token: 35	4316	%tmp%.exe
Token: SeDebugPrivilege	4316	%tmp%.exe

description	pid	Process	procid_target
PID 768 wrote to memory of 4316	768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe	85
PID 768 wrote to memory of 4316	768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe	85
PID 768 wrote to memory of 4316	768	d9f97c2513e9dbc5a065cc4107576e8a9fd22febbd4a5c3857cf388e21cd9b07.exe	85
PID 4316 wrote to memory of 1972	4316	%tmp%.exe	86
PID 4316 wrote to memory of 1972	4316	%tmp%.exe	86
PID 4316 wrote to memory of 1972	4316	%tmp%.exe	86
PID 4316 wrote to memory of 3172	4316	%tmp%.exe	87
PID 4316 wrote to memory of 3172	4316	%tmp%.exe	87
PID 4316 wrote to memory of 3172	4316	%tmp%.exe	87
PID 4316 wrote to memory of 4004	4316	%tmp%.exe	90
PID 4316 wrote to memory of 4004	4316	%tmp%.exe	90
PID 4316 wrote to memory of 4004	4316	%tmp%.exe	90
PID 4316 wrote to memory of 400	4316	%tmp%.exe	92
PID 4316 wrote to memory of 400	4316	%tmp%.exe	92
PID 4316 wrote to memory of 400	4316	%tmp%.exe	92
PID 1972 wrote to memory of 4060	1972	cmd.exe	94
PID 1972 wrote to memory of 4060	1972	cmd.exe	94
PID 1972 wrote to memory of 4060	1972	cmd.exe	94
PID 400 wrote to memory of 1788	400	cmd.exe	96
PID 400 wrote to memory of 1788	400	cmd.exe	96
PID 400 wrote to memory of 1788	400	cmd.exe	96
PID 3172 wrote to memory of 2692	3172	cmd.exe	95
PID 3172 wrote to memory of 2692	3172	cmd.exe	95
PID 3172 wrote to memory of 2692	3172	cmd.exe	95
PID 4004 wrote to memory of 2312	4004	cmd.exe	97
PID 4004 wrote to memory of 2312	4004	cmd.exe	97
PID 4004 wrote to memory of 2312	4004	cmd.exe	97

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.