Analysis
-
max time kernel
153s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2023, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
4da41093eb4cce80c18d1e6a2391ba80.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4da41093eb4cce80c18d1e6a2391ba80.exe
Resource
win10v2004-20230220-en
General
-
Target
4da41093eb4cce80c18d1e6a2391ba80.exe
-
Size
500KB
-
MD5
4da41093eb4cce80c18d1e6a2391ba80
-
SHA1
c6e1338fb7c3ffc9d39d5362722110e8482216ea
-
SHA256
f628532a482840b66c9fdf0ed09de86b63418e1f2cc3bbff139f54482f895d43
-
SHA512
43ea46aeeda700e7b7e1f1f3fdede845e8d5723204d854e5452f9af785a20a9a915e1d9e4f44162777f2e5f569eda06904548114667ae05a285a980cb426dcd3
-
SSDEEP
6144:+Ya6HI+QksRbJpnYqzFNZDPln6PJWJIFwYdga6c4jLvw1SxhDUoj+Xxk1Zci2E6e:+Y1I+QkunY8LzlOWi2HjHw1k15FqvK
Malware Config
Extracted
remcos
SixthClients
top.not2beabused01.xyz:1558
sub.not2beabused02.xyz:1558
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
appsync.exe
-
copy_folder
Appsync
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Appsync
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Appsync-TYGH55
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Appsync
-
take_screenshot_option
true
-
take_screenshot_time
55
-
take_screenshot_title
mail;webmail;crypto;btc;ethereum;bitcoin;eth;outlook;foxmail;bank;email;compose;
Extracted
warzonerat
top.not2beabused01.xyz:1668
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dfsghjs\\uytedew.exe," reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dfsghjs\\iurdsfhgj.exe," reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dfsghjs\\uytresdfgh.exe," reg.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/2996-189-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/2996-196-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2112-184-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/2112-209-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/2112-212-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral2/memory/2112-184-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2996-189-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/2060-197-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2996-196-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/2060-199-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2112-209-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2112-212-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Warzone RAT payload 7 IoCs
resource yara_rule behavioral2/memory/4488-221-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/4488-249-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/4488-254-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/4488-281-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/4488-284-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/4488-288-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/4488-290-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation tqchnnl.exe -
Executes dropped EXE 14 IoCs
pid Process 1924 tqchnnl.exe 1892 tqchnnl.exe 2112 tqchnnl.exe 2996 tqchnnl.exe 2060 tqchnnl.exe 2176 fmwrz.exe 2144 ghibzkdm.exe 4708 datorg.exe 4760 datxld.exe 4488 ghibzkdm.exe 4372 datrem.exe 4404 uytresdfgh.exe 952 iurdsfhgj.exe 4728 uytedew.exe -
Loads dropped DLL 6 IoCs
pid Process 4488 ghibzkdm.exe 4488 ghibzkdm.exe 4488 ghibzkdm.exe 4488 ghibzkdm.exe 4488 ghibzkdm.exe 4488 ghibzkdm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts tqchnnl.exe -
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maoie = "C:\\Users\\Admin\\AppData\\Roaming\\dnetoln\\qiyvhavtewgo.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ghibzkdm.exe\" C:\\Users\\Admin\\AppData\\Lo" ghibzkdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odsnqyon = "C:\\Users\\Admin\\AppData\\Roaming\\ukyerc\\irsqhssjjf.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\tqchnnl.exe\" C:\\Users\\Admin\\AppData\\Local\\" tqchnnl.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1924 set thread context of 1892 1924 tqchnnl.exe 84 PID 1892 set thread context of 2112 1892 tqchnnl.exe 88 PID 1892 set thread context of 2996 1892 tqchnnl.exe 89 PID 1892 set thread context of 2060 1892 tqchnnl.exe 90 PID 2144 set thread context of 4488 2144 ghibzkdm.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 9 IoCs
pid Process 2548 PING.EXE 1140 PING.EXE 1176 PING.EXE 2004 PING.EXE 3432 PING.EXE 3532 PING.EXE 4736 PING.EXE 3388 PING.EXE 2468 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 tqchnnl.exe 2112 tqchnnl.exe 2060 tqchnnl.exe 2060 tqchnnl.exe 2112 tqchnnl.exe 2112 tqchnnl.exe 4372 datrem.exe 4760 datxld.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4708 datorg.exe 4760 datxld.exe 4760 datxld.exe 4760 datxld.exe 4760 datxld.exe 4760 datxld.exe 4708 datorg.exe 4372 datrem.exe 4372 datrem.exe 4372 datrem.exe 4372 datrem.exe 4760 datxld.exe 4372 datrem.exe 4760 datxld.exe 4372 datrem.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1892 tqchnnl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1924 tqchnnl.exe 1892 tqchnnl.exe 1892 tqchnnl.exe 1892 tqchnnl.exe 2144 ghibzkdm.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2060 tqchnnl.exe Token: SeDebugPrivilege 4372 datrem.exe Token: SeDebugPrivilege 4760 datxld.exe Token: SeDebugPrivilege 4708 datorg.exe Token: SeDebugPrivilege 4404 uytresdfgh.exe Token: SeDebugPrivilege 952 iurdsfhgj.exe Token: SeDebugPrivilege 4728 uytedew.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1892 tqchnnl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1924 1288 4da41093eb4cce80c18d1e6a2391ba80.exe 83 PID 1288 wrote to memory of 1924 1288 4da41093eb4cce80c18d1e6a2391ba80.exe 83 PID 1288 wrote to memory of 1924 1288 4da41093eb4cce80c18d1e6a2391ba80.exe 83 PID 1924 wrote to memory of 1892 1924 tqchnnl.exe 84 PID 1924 wrote to memory of 1892 1924 tqchnnl.exe 84 PID 1924 wrote to memory of 1892 1924 tqchnnl.exe 84 PID 1924 wrote to memory of 1892 1924 tqchnnl.exe 84 PID 1892 wrote to memory of 2112 1892 tqchnnl.exe 88 PID 1892 wrote to memory of 2112 1892 tqchnnl.exe 88 PID 1892 wrote to memory of 2112 1892 tqchnnl.exe 88 PID 1892 wrote to memory of 2996 1892 tqchnnl.exe 89 PID 1892 wrote to memory of 2996 1892 tqchnnl.exe 89 PID 1892 wrote to memory of 2996 1892 tqchnnl.exe 89 PID 1892 wrote to memory of 2060 1892 tqchnnl.exe 90 PID 1892 wrote to memory of 2060 1892 tqchnnl.exe 90 PID 1892 wrote to memory of 2060 1892 tqchnnl.exe 90 PID 1892 wrote to memory of 2176 1892 tqchnnl.exe 91 PID 1892 wrote to memory of 2176 1892 tqchnnl.exe 91 PID 1892 wrote to memory of 2176 1892 tqchnnl.exe 91 PID 2176 wrote to memory of 2144 2176 fmwrz.exe 92 PID 2176 wrote to memory of 2144 2176 fmwrz.exe 92 PID 2176 wrote to memory of 2144 2176 fmwrz.exe 92 PID 2144 wrote to memory of 4488 2144 ghibzkdm.exe 93 PID 2144 wrote to memory of 4488 2144 ghibzkdm.exe 93 PID 2144 wrote to memory of 4488 2144 ghibzkdm.exe 93 PID 2144 wrote to memory of 4488 2144 ghibzkdm.exe 93 PID 1892 wrote to memory of 4760 1892 tqchnnl.exe 94 PID 1892 wrote to memory of 4760 1892 tqchnnl.exe 94 PID 1892 wrote to memory of 4760 1892 tqchnnl.exe 94 PID 1892 wrote to memory of 4708 1892 tqchnnl.exe 95 PID 1892 wrote to memory of 4708 1892 tqchnnl.exe 95 PID 1892 wrote to memory of 4708 1892 tqchnnl.exe 95 PID 1892 wrote to memory of 4372 1892 tqchnnl.exe 96 PID 1892 wrote to memory of 4372 1892 tqchnnl.exe 96 PID 1892 wrote to memory of 4372 1892 tqchnnl.exe 96 PID 4708 wrote to memory of 1640 4708 datorg.exe 100 PID 4708 wrote to memory of 1640 4708 datorg.exe 100 PID 4708 wrote to memory of 1640 4708 datorg.exe 100 PID 4760 wrote to memory of 672 4760 datxld.exe 102 PID 4760 wrote to memory of 672 4760 datxld.exe 102 PID 4760 wrote to memory of 672 4760 datxld.exe 102 PID 1640 wrote to memory of 1176 1640 cmd.exe 104 PID 1640 wrote to memory of 1176 1640 cmd.exe 104 PID 1640 wrote to memory of 1176 1640 cmd.exe 104 PID 672 wrote to memory of 2548 672 cmd.exe 105 PID 672 wrote to memory of 2548 672 cmd.exe 105 PID 672 wrote to memory of 2548 672 cmd.exe 105 PID 4372 wrote to memory of 3760 4372 datrem.exe 106 PID 4372 wrote to memory of 3760 4372 datrem.exe 106 PID 4372 wrote to memory of 3760 4372 datrem.exe 106 PID 3760 wrote to memory of 2468 3760 cmd.exe 108 PID 3760 wrote to memory of 2468 3760 cmd.exe 108 PID 3760 wrote to memory of 2468 3760 cmd.exe 108 PID 4708 wrote to memory of 4740 4708 datorg.exe 110 PID 4708 wrote to memory of 4740 4708 datorg.exe 110 PID 4708 wrote to memory of 4740 4708 datorg.exe 110 PID 4740 wrote to memory of 2004 4740 cmd.exe 112 PID 4740 wrote to memory of 2004 4740 cmd.exe 112 PID 4740 wrote to memory of 2004 4740 cmd.exe 112 PID 4760 wrote to memory of 4636 4760 datxld.exe 113 PID 4760 wrote to memory of 4636 4760 datxld.exe 113 PID 4760 wrote to memory of 4636 4760 datxld.exe 113 PID 4636 wrote to memory of 3432 4636 cmd.exe 115 PID 4636 wrote to memory of 3432 4636 cmd.exe 115 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4da41093eb4cce80c18d1e6a2391ba80.exe"C:\Users\Admin\AppData\Local\Temp\4da41093eb4cce80c18d1e6a2391ba80.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe"C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe" C:\Users\Admin\AppData\Local\Temp\smpprgdmyr.v2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe"C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exeC:\Users\Admin\AppData\Local\Temp\tqchnnl.exe /stext "C:\Users\Admin\AppData\Local\Temp\tmghhnvqspcishziw"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exeC:\Users\Admin\AppData\Local\Temp\tqchnnl.exe /stext "C:\Users\Admin\AppData\Local\Temp\eolzifgrgxuvunnmfenfv"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exeC:\Users\Admin\AppData\Local\Temp\tqchnnl.exe /stext "C:\Users\Admin\AppData\Local\Temp\oirsbyqlufmzftjqwpihyhrd"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Users\Admin\AppData\Local\Temp\fmwrz.exe"C:\Users\Admin\AppData\Local\Temp\fmwrz.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe"C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe" C:\Users\Admin\AppData\Local\Temp\xaaktctbkvc.h5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe"C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4488
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\datxld.exe"C:\Users\Admin\AppData\Local\Temp\datxld.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 36 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe,"5⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 366⤵
- Runs ping.exe
PID:2548
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe,"6⤵
- Modifies WinLogon for persistence
PID:4500
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 47 > nul && copy "C:\Users\Admin\AppData\Local\Temp\datxld.exe" "C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe" && ping 127.0.0.1 -n 47 > nul && "C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 476⤵
- Runs ping.exe
PID:3432
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 476⤵
- Runs ping.exe
PID:1140
-
-
C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe"C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\datorg.exe"C:\Users\Admin\AppData\Local\Temp\datorg.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe,"5⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 396⤵
- Runs ping.exe
PID:1176
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe,"6⤵
- Modifies WinLogon for persistence
PID:384
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 46 > nul && copy "C:\Users\Admin\AppData\Local\Temp\datorg.exe" "C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe" && ping 127.0.0.1 -n 46 > nul && "C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 466⤵
- Runs ping.exe
PID:2004
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 466⤵
- Runs ping.exe
PID:4736
-
-
C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe"C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\datrem.exe"C:\Users\Admin\AppData\Local\Temp\datrem.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 36 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe,"5⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 366⤵
- Runs ping.exe
PID:2468
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe,"6⤵
- Modifies WinLogon for persistence
PID:4896
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 41 > nul && copy "C:\Users\Admin\AppData\Local\Temp\datrem.exe" "C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe" && ping 127.0.0.1 -n 41 > nul && "C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe"5⤵PID:4520
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 416⤵
- Runs ping.exe
PID:3532
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 416⤵
- Runs ping.exe
PID:3388
-
-
C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe"C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
218KB
MD5a3a47448f45b0374c3cde59e1a7bfb0d
SHA1e00b404f1a143c99e1cf095ef27678022539be43
SHA2569b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
SHA512cc70d6c4829a13a7b5819c6924d0309beb083131c59d8cb3e81f13b1bc38d02413f48447064b7f5948bdb2d162c450863c9bc0c47f51735375264d31bbc48dd4
-
Filesize
218KB
MD5a3a47448f45b0374c3cde59e1a7bfb0d
SHA1e00b404f1a143c99e1cf095ef27678022539be43
SHA2569b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
SHA512cc70d6c4829a13a7b5819c6924d0309beb083131c59d8cb3e81f13b1bc38d02413f48447064b7f5948bdb2d162c450863c9bc0c47f51735375264d31bbc48dd4
-
Filesize
218KB
MD5a3a47448f45b0374c3cde59e1a7bfb0d
SHA1e00b404f1a143c99e1cf095ef27678022539be43
SHA2569b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
SHA512cc70d6c4829a13a7b5819c6924d0309beb083131c59d8cb3e81f13b1bc38d02413f48447064b7f5948bdb2d162c450863c9bc0c47f51735375264d31bbc48dd4
-
Filesize
326KB
MD5ef12ab9d0b231b8f898067b2114b1bc0
SHA16d90f27b2105945f9bb77039e8b892070a5f9442
SHA2562b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7
SHA5122aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
133KB
MD575f8cc548cabf0cc800c25047e4d3124
SHA1602676768f9faecd35b48c38a0632781dfbde10c
SHA256fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0
SHA512ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f
-
Filesize
429KB
MD5109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
Filesize
1.2MB
MD5d7858e8449004e21b01d468e9fd04b82
SHA19524352071ede21c167e7e4f106e9526dc23ef4e
SHA25678758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db
SHA5121e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440
-
Filesize
7KB
MD58bba552e868d530af56dadd00d38ce78
SHA1e8f76dd15c91b3c42d42ce83a06c299d900cedf6
SHA256dd99bf95cbfb93c236cdfe239dddce5aa54f6355a50a7b2ed7606afd00958b9b
SHA512ff8fe38ed26720865f57fa69a9dd3806109cb688ea22e38ff44ca05f6a7d95795705ac2ccff1e7eb964696a0a0843b370fe76c96373a580ef66ada63054ce35f
-
Filesize
141KB
MD5471c983513694ac3002590345f2be0da
SHA16612b9af4ff6830fa9b7d4193078434ef72f775b
SHA256bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f
SHA512a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410
-
Filesize
161KB
MD512c7d6f0b173d7d369ae8bf93dd1c384
SHA1bcb512d7fe890bb980206788d15c494ca02ede8a
SHA256ae4add2b61f783f6d4faa3216ff68960302f76230ef0a371edf6778188bf86f3
SHA51253e8b9337544218ab38f319d34752161ad974db1b370dae10786695554d0541dc21209e48c819b5e9e48f339e0afa843d750e8e5105e5abf18aa84e7bb3c24be
-
Filesize
4KB
MD5b1a407ed9778faba2aa43f92e4e85dca
SHA1cb9c6835291dde8bf4227b3adafdc8e0ef07a4bb
SHA2561d16f0d3fe199ac744b1305b95e04ed2fd8711ada610cfbe373a14ea301277f5
SHA5127d9ca374f1d3464a9ba12c8a7708593e43eee2a7f2b7ac7cecf6fe36845d6407bc2938dddab63ee912a16dd70488ffeae6c4408e7c1e57457441c4a3243103ac
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
Filesize
496KB
MD5b8e0694c7d8f49c6bab7b2f38a068cc7
SHA1b19f8174f08d3e844b5ae2e74cb6eb7a7e6f7923
SHA2566a0e2c58b2be31c768cd2dd0236ebef7d8ef9839c6398931f6f9b9a20b62dd4c
SHA512ead2ee5aeec1a2df1d244b8b5502bc0e84e85c5024602fb9cc4e3b09f687e9af77c2427d6e59661319217306494d50ea77d623b18e586baebeecc7b72a05c14f
-
Filesize
7KB
MD5bab85673afd9040f8fffe381439cf5cc
SHA18d13dfa7f0047acb464e3ed534580c60bdabed6b
SHA25676aee090b77973c9e217601cd168c181c0e4639b2073a0f52db7eb5c32fa77c2
SHA512df2694645b1ed4d2e9b2ffb901cb0d0af8ac192665c81214bbc8157fab7b6b5fe7203d8f6ebdbe070796ff6185c3535efed97a515f7ed413c0f7f689d1b0f16c
-
Filesize
144B
MD51cc9154bf1a71ae75ff3f6435eedb3bb
SHA129fba54951e0034db5de20d73774cd95b1ae3256
SHA25636456c5170dea57616ec84858ca8ac57603ffd2b20414de7bdb5d6843ad6bbf9
SHA512211e1e650189a307be7f25e0b3cfe2b43644b8bd2b48be157fabfc40b9334563912ffd19d2fb6850a7cfc8b6a489d253a7f7a7138f372f28ce4318808f00e997
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d