limerat | 78973c8f956a77c6c88aa4b508ce289d2c59966e1e7f2af4fc9cfd9e2368df66

Analysis

max time kernel
151s
max time network
149s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04-03-2023 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a364b35d4dbdcf328367df843a6286c1.exe
Size

12.9MB
MD5

a364b35d4dbdcf328367df843a6286c1
SHA1

31a54c5118109afa7d5c7c465bb4d3b25c947284
SHA256

78973c8f956a77c6c88aa4b508ce289d2c59966e1e7f2af4fc9cfd9e2368df66
SHA512

e0687836489ea4cf25fb2b58105a46666a46a447acd01e291a5646928a12e469031f2936087cded0e7eee869cb6e71784c588cd61812387073ba4d0b637c6826
SSDEEP

196608:Lg+Aalc1yGZIh6L5iYl/dsy+7d3tFELLs1cAm6f971YAmX1ZK1vauo9Dn:Lgsl5hef1k7ptmQbm6fnmlZsoRn

Score

10^/10

limerat quasar revengerat storage persistence rat spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

storage

xmarvel.ddns.net:4782

2.58.56.188:4782

Mutex

Slbw7KtgA7WecQEqcR

Attributes

encryption_key
BTg0dEybEXwn6MM90CP2
install_name
ccleaner.exe
log_directory
windowfirewalls
reconnect_delay
1
startup_key
windowsfirewall.msc
subdirectory
windowsfirewall

Extracted

Family

limerat

Wallets

13WHQ6XEobZYNAjHZPJHkDuzMS8TpgkRqm

Attributes

aes_key
key
antivm
true
c2_url
https://pastebin.com/raw/nW4J6TiP
delay
3
download_payload
false
install
true
install_name
windowsdefender.exe
main_folder
AppData
pin_spread
false
sub_folder
\
usb_spread
true

Extracted

Family

quasar

Attributes

reconnect_delay
1

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 16 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\OHITWG.exe	family_quasar
C:\Users\Admin\AppData\Local\Temp\OHITWG.exe	family_quasar
\Users\Admin\AppData\Local\Temp\OHITWG.exe	family_quasar
\Users\Admin\AppData\Local\Temp\OHITWG.exe	family_quasar
\Users\Admin\AppData\Local\Temp\OHITWG.exe	family_quasar
C:\Users\Admin\AppData\Local\Temp\OHITWG.exe	family_quasar
C:\Users\Admin\AppData\Local\Temp\OHITWG.exe	family_quasar
behavioral1/memory/1756-95-0x0000000000EC0000-0x0000000000F0E000-memory.dmp	family_quasar
\Windows\SysWOW64\windowsfirewall\ccleaner.exe	family_quasar
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe	family_quasar
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe	family_quasar
behavioral1/memory/1516-109-0x00000000009D0000-0x0000000000A1E000-memory.dmp	family_quasar
behavioral1/memory/1516-122-0x0000000004960000-0x00000000049A0000-memory.dmp	family_quasar
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe	family_quasar
behavioral1/memory/548-127-0x0000000004B20000-0x0000000004B60000-memory.dmp	family_quasar
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe	family_quasar

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 1 IoCs

Processes:

a364b35d4dbdcf328367df843a6286c1.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NULXGA.lnk	a364b35d4dbdcf328367df843a6286c1.exe

Executes dropped EXE 8 IoCs

Processes:

OHITWG.exeHMAGXL.execcleaner.exewindowsdefender.execcleaner.exewfmsc.exewfmsc.execcleaner.exe

pid process

1756 OHITWG.exe
760 HMAGXL.exe
1516 ccleaner.exe
1592 windowsdefender.exe
548 ccleaner.exe
620 wfmsc.exe
1044 wfmsc.exe
1016 ccleaner.exe

pid	process
1756	OHITWG.exe
760	HMAGXL.exe
1516	ccleaner.exe
1592	windowsdefender.exe
548	ccleaner.exe
620	wfmsc.exe
1044	wfmsc.exe
1016	ccleaner.exe

Loads dropped DLL 11 IoCs

Processes:

a364b35d4dbdcf328367df843a6286c1.exeOHITWG.exeHMAGXL.exe

pid	process
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1756	OHITWG.exe
760	HMAGXL.exe
760	HMAGXL.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a364b35d4dbdcf328367df843a6286c1.execcleaner.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run	a364b35d4dbdcf328367df843a6286c1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\NULXGA = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\wfmsc.exe\""	a364b35d4dbdcf328367df843a6286c1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowsfirewall.msc = "\"C:\\Windows\\SysWOW64\\windowsfirewall\\ccleaner.exe\""	ccleaner.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com

flow	ioc
1	ip-api.com

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe	autoit_exe

Drops file in System32 directory 4 IoCs

Processes:

OHITWG.execcleaner.exe

description	ioc	process
File created	C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe	OHITWG.exe
File opened for modification	C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe	OHITWG.exe
File opened for modification	C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe	ccleaner.exe
File opened for modification	C:\Windows\SysWOW64\windowsfirewall	ccleaner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1684 schtasks.exe
340 schtasks.exe
2008 schtasks.exe
656 schtasks.exe
1984 schtasks.exe

pid	process
1684	schtasks.exe
340	schtasks.exe
2008	schtasks.exe
656	schtasks.exe
1984	schtasks.exe

NTFS ADS 1 IoCs

Processes:

a364b35d4dbdcf328367df843a6286c1.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	a364b35d4dbdcf328367df843a6286c1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a364b35d4dbdcf328367df843a6286c1.exewindowsdefender.exe

pid	process
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1592	windowsdefender.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe
1084	a364b35d4dbdcf328367df843a6286c1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

a364b35d4dbdcf328367df843a6286c1.exe

pid process

1084 a364b35d4dbdcf328367df843a6286c1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

OHITWG.execcleaner.exewindowsdefender.exe

description	pid	process
Token: SeDebugPrivilege	1756	OHITWG.exe
Token: SeDebugPrivilege	1516	ccleaner.exe
Token: SeDebugPrivilege	1592	windowsdefender.exe
Token: SeDebugPrivilege	1592	windowsdefender.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

a364b35d4dbdcf328367df843a6286c1.execmd.exeOHITWG.execcleaner.exeHMAGXL.exetaskeng.exe

description	pid	process	target process
PID 1084 wrote to memory of 1756	1084	a364b35d4dbdcf328367df843a6286c1.exe	OHITWG.exe
PID 1084 wrote to memory of 1756	1084	a364b35d4dbdcf328367df843a6286c1.exe	OHITWG.exe
PID 1084 wrote to memory of 1756	1084	a364b35d4dbdcf328367df843a6286c1.exe	OHITWG.exe
PID 1084 wrote to memory of 1756	1084	a364b35d4dbdcf328367df843a6286c1.exe	OHITWG.exe
PID 1084 wrote to memory of 760	1084	a364b35d4dbdcf328367df843a6286c1.exe	HMAGXL.exe
PID 1084 wrote to memory of 760	1084	a364b35d4dbdcf328367df843a6286c1.exe	HMAGXL.exe
PID 1084 wrote to memory of 760	1084	a364b35d4dbdcf328367df843a6286c1.exe	HMAGXL.exe
PID 1084 wrote to memory of 760	1084	a364b35d4dbdcf328367df843a6286c1.exe	HMAGXL.exe
PID 1084 wrote to memory of 1148	1084	a364b35d4dbdcf328367df843a6286c1.exe	cmd.exe
PID 1084 wrote to memory of 1148	1084	a364b35d4dbdcf328367df843a6286c1.exe	cmd.exe
PID 1084 wrote to memory of 1148	1084	a364b35d4dbdcf328367df843a6286c1.exe	cmd.exe
PID 1084 wrote to memory of 1148	1084	a364b35d4dbdcf328367df843a6286c1.exe	cmd.exe
PID 1084 wrote to memory of 968	1084	a364b35d4dbdcf328367df843a6286c1.exe	WSCript.exe
PID 1084 wrote to memory of 968	1084	a364b35d4dbdcf328367df843a6286c1.exe	WSCript.exe
PID 1084 wrote to memory of 968	1084	a364b35d4dbdcf328367df843a6286c1.exe	WSCript.exe
PID 1084 wrote to memory of 968	1084	a364b35d4dbdcf328367df843a6286c1.exe	WSCript.exe
PID 1148 wrote to memory of 1684	1148	cmd.exe	schtasks.exe
PID 1148 wrote to memory of 1684	1148	cmd.exe	schtasks.exe
PID 1148 wrote to memory of 1684	1148	cmd.exe	schtasks.exe
PID 1148 wrote to memory of 1684	1148	cmd.exe	schtasks.exe
PID 1756 wrote to memory of 340	1756	OHITWG.exe	schtasks.exe
PID 1756 wrote to memory of 340	1756	OHITWG.exe	schtasks.exe
PID 1756 wrote to memory of 340	1756	OHITWG.exe	schtasks.exe
PID 1756 wrote to memory of 340	1756	OHITWG.exe	schtasks.exe
PID 1756 wrote to memory of 1516	1756	OHITWG.exe	ccleaner.exe
PID 1756 wrote to memory of 1516	1756	OHITWG.exe	ccleaner.exe
PID 1756 wrote to memory of 1516	1756	OHITWG.exe	ccleaner.exe
PID 1756 wrote to memory of 1516	1756	OHITWG.exe	ccleaner.exe
PID 1516 wrote to memory of 2008	1516	ccleaner.exe	schtasks.exe
PID 1516 wrote to memory of 2008	1516	ccleaner.exe	schtasks.exe
PID 1516 wrote to memory of 2008	1516	ccleaner.exe	schtasks.exe
PID 1516 wrote to memory of 2008	1516	ccleaner.exe	schtasks.exe
PID 1516 wrote to memory of 656	1516	ccleaner.exe	schtasks.exe
PID 1516 wrote to memory of 656	1516	ccleaner.exe	schtasks.exe
PID 1516 wrote to memory of 656	1516	ccleaner.exe	schtasks.exe
PID 1516 wrote to memory of 656	1516	ccleaner.exe	schtasks.exe
PID 760 wrote to memory of 1984	760	HMAGXL.exe	schtasks.exe
PID 760 wrote to memory of 1984	760	HMAGXL.exe	schtasks.exe
PID 760 wrote to memory of 1984	760	HMAGXL.exe	schtasks.exe
PID 760 wrote to memory of 1984	760	HMAGXL.exe	schtasks.exe
PID 760 wrote to memory of 1592	760	HMAGXL.exe	windowsdefender.exe
PID 760 wrote to memory of 1592	760	HMAGXL.exe	windowsdefender.exe
PID 760 wrote to memory of 1592	760	HMAGXL.exe	windowsdefender.exe
PID 760 wrote to memory of 1592	760	HMAGXL.exe	windowsdefender.exe
PID 1080 wrote to memory of 548	1080	taskeng.exe	ccleaner.exe
PID 1080 wrote to memory of 548	1080	taskeng.exe	ccleaner.exe
PID 1080 wrote to memory of 548	1080	taskeng.exe	ccleaner.exe
PID 1080 wrote to memory of 548	1080	taskeng.exe	ccleaner.exe
PID 1080 wrote to memory of 620	1080	taskeng.exe	wfmsc.exe
PID 1080 wrote to memory of 620	1080	taskeng.exe	wfmsc.exe
PID 1080 wrote to memory of 620	1080	taskeng.exe	wfmsc.exe
PID 1080 wrote to memory of 620	1080	taskeng.exe	wfmsc.exe
PID 1080 wrote to memory of 1016	1080	taskeng.exe	ccleaner.exe
PID 1080 wrote to memory of 1016	1080	taskeng.exe	ccleaner.exe
PID 1080 wrote to memory of 1016	1080	taskeng.exe	ccleaner.exe
PID 1080 wrote to memory of 1016	1080	taskeng.exe	ccleaner.exe
PID 1080 wrote to memory of 1044	1080	taskeng.exe	wfmsc.exe
PID 1080 wrote to memory of 1044	1080	taskeng.exe	wfmsc.exe
PID 1080 wrote to memory of 1044	1080	taskeng.exe	wfmsc.exe
PID 1080 wrote to memory of 1044	1080	taskeng.exe	wfmsc.exe

C:\Users\Admin\AppData\Local\Temp\a364b35d4dbdcf328367df843a6286c1.exe
"C:\Users\Admin\AppData\Local\Temp\a364b35d4dbdcf328367df843a6286c1.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1084

C:\Users\Admin\AppData\Local\Temp\OHITWG.exe
"C:\Users\Admin\AppData\Local\Temp\OHITWG.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "windowsfirewall.msc" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\OHITWG.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:340

C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe
"C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "windowsfirewall.msc" /sc ONLOGON /tr "C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2008

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe" /sc MINUTE /MO 1
4⤵
- Creates scheduled task(s)
PID:656

C:\Users\Admin\AppData\Local\Temp\HMAGXL.exe
"C:\Users\Admin\AppData\Local\Temp\HMAGXL.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\windowsdefender.exe'"
3⤵
- Creates scheduled task(s)
PID:1984

C:\Users\Admin\AppData\Roaming\windowsdefender.exe
"C:\Users\Admin\AppData\Roaming\windowsdefender.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /create /tn NULXGA.exe /tr C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe /sc minute /mo 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NULXGA.exe /tr C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe /sc minute /mo 1
3⤵
- Creates scheduled task(s)
PID:1684

C:\Windows\SysWOW64\WSCript.exe
WSCript C:\Users\Admin\AppData\Local\Temp\NULXGA.vbs
2⤵
PID:968

C:\Windows\system32\taskeng.exe
taskeng.exe {85C146D9-404C-4E5A-9F1E-693CB81B804A} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe
C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe
2⤵
- Executes dropped EXE
PID:620

C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe
2⤵
- Executes dropped EXE
PID:548

C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe
2⤵
- Executes dropped EXE
PID:1016

C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe
C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe
2⤵
- Executes dropped EXE
PID:1044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HMAGXL.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\HMAGXL.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\HMAGXL.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\NULXGA.vbs
Filesize
884B

MD5
c3520452306f69d75cb46acfc2039be9

SHA1
c769c1ff2b0187fefb38c0de722469b3a7a9e547

SHA256
1193086114453474a8a9c52e5da3cc89020c26037d8ad2596546438f778d2bad

SHA512
5634e10ab5bacabe9fce2bb40827e9ab31d3694c16575713960f9680056c6ea9a7716e5923d966da47f8961ac0c5640f4b586e3d42580d3aed54ca9083d03ac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\OHITWG.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\OHITWG.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\OHITWG.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe
Filesize
12.9MB

MD5
a364b35d4dbdcf328367df843a6286c1

SHA1
31a54c5118109afa7d5c7c465bb4d3b25c947284

SHA256
78973c8f956a77c6c88aa4b508ce289d2c59966e1e7f2af4fc9cfd9e2368df66

SHA512
e0687836489ea4cf25fb2b58105a46666a46a447acd01e291a5646928a12e469031f2936087cded0e7eee869cb6e71784c588cd61812387073ba4d0b637c6826

Download Submit
C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe
Filesize
12.9MB

MD5
a364b35d4dbdcf328367df843a6286c1

SHA1
31a54c5118109afa7d5c7c465bb4d3b25c947284

SHA256
78973c8f956a77c6c88aa4b508ce289d2c59966e1e7f2af4fc9cfd9e2368df66

SHA512
e0687836489ea4cf25fb2b58105a46666a46a447acd01e291a5646928a12e469031f2936087cded0e7eee869cb6e71784c588cd61812387073ba4d0b637c6826

Download Submit
C:\Users\Admin\AppData\Roaming\Windata\wfmsc.exe
Filesize
12.9MB

MD5
a364b35d4dbdcf328367df843a6286c1

SHA1
31a54c5118109afa7d5c7c465bb4d3b25c947284

SHA256
78973c8f956a77c6c88aa4b508ce289d2c59966e1e7f2af4fc9cfd9e2368df66

SHA512
e0687836489ea4cf25fb2b58105a46666a46a447acd01e291a5646928a12e469031f2936087cded0e7eee869cb6e71784c588cd61812387073ba4d0b637c6826

Download Submit
C:\Users\Admin\AppData\Roaming\windowsdefender.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
C:\Users\Admin\AppData\Roaming\windowsdefender.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
C:\Windows\SysWOW64\windowsfirewall\ccleaner.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
\Users\Admin\AppData\Local\Temp\HMAGXL.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
\Users\Admin\AppData\Local\Temp\HMAGXL.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
\Users\Admin\AppData\Local\Temp\HMAGXL.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
\Users\Admin\AppData\Local\Temp\HMAGXL.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
\Users\Admin\AppData\Local\Temp\OHITWG.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
\Users\Admin\AppData\Local\Temp\OHITWG.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
\Users\Admin\AppData\Local\Temp\OHITWG.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
\Users\Admin\AppData\Local\Temp\OHITWG.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
\Users\Admin\AppData\Roaming\windowsdefender.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
\Users\Admin\AppData\Roaming\windowsdefender.exe
Filesize
28KB

MD5
7cf120a9dad95a45232d7d6f3f87b067

SHA1
55b96683b6b78888e1d0463fed961b30c014dde7

SHA256
9449691939856bd53ccb28071c5fec85da01ba6e113e9088f545857171b5f7a3

SHA512
22eaa765f6ac881b3a47a5e614f1ef15abdb29f1aa8891fd90c05817faeb3a14a32c8661bae1760cace254784ff6b8079002ed9d06ff062390df976d15565efd

Download Submit
\Windows\SysWOW64\windowsfirewall\ccleaner.exe
Filesize
288KB

MD5
473dada2898cd0c3f7bb193e784211a4

SHA1
f9d24e4d578a240df8cb7791145f2a65cdc2a5b8

SHA256
827530d82fa9c5ad081f6ea918a136fc9c13d57dfdfc49f14947a68083cb6fce

SHA512
3c8a6fb530e763f7d192f9631932fe884bada3d54ea089fc9e36280fc7731d8544c1fd8d81a8d546849ea163a6e14db2e37fc6aa4b24c6eb17c161bfbb36dbb6

Download Submit
memory/548-127-0x0000000004B20000-0x0000000004B60000-memory.dmp

Filesize
256KB

Download
memory/760-94-0x0000000001270000-0x000000000127C000-memory.dmp

Filesize
48KB

Download
memory/1516-122-0x0000000004960000-0x00000000049A0000-memory.dmp

Filesize
256KB

Download
memory/1516-110-0x0000000004960000-0x00000000049A0000-memory.dmp

Filesize
256KB

Download
memory/1516-109-0x00000000009D0000-0x0000000000A1E000-memory.dmp

Filesize
312KB

Download
memory/1592-123-0x0000000000A30000-0x0000000000A4E000-memory.dmp

Filesize
120KB

Download
memory/1592-121-0x0000000000D20000-0x0000000000D2C000-memory.dmp

Filesize
48KB

Download
memory/1756-101-0x00000000004E0000-0x0000000000520000-memory.dmp

Filesize
256KB

Download
memory/1756-95-0x0000000000EC0000-0x0000000000F0E000-memory.dmp

Filesize
312KB

Download