Resubmissions
29/03/2023, 08:16
230329-j6fllsha8w 10Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2023, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
vbc.exe
Resource
win10v2004-20230220-en
General
-
Target
vbc.exe
-
Size
500KB
-
MD5
4da41093eb4cce80c18d1e6a2391ba80
-
SHA1
c6e1338fb7c3ffc9d39d5362722110e8482216ea
-
SHA256
f628532a482840b66c9fdf0ed09de86b63418e1f2cc3bbff139f54482f895d43
-
SHA512
43ea46aeeda700e7b7e1f1f3fdede845e8d5723204d854e5452f9af785a20a9a915e1d9e4f44162777f2e5f569eda06904548114667ae05a285a980cb426dcd3
-
SSDEEP
6144:+Ya6HI+QksRbJpnYqzFNZDPln6PJWJIFwYdga6c4jLvw1SxhDUoj+Xxk1Zci2E6e:+Y1I+QkunY8LzlOWi2HjHw1k15FqvK
Malware Config
Extracted
remcos
SixthClients
top.not2beabused01.xyz:1558
sub.not2beabused02.xyz:1558
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
appsync.exe
-
copy_folder
Appsync
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Appsync
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Appsync-TYGH55
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Appsync
-
take_screenshot_option
true
-
take_screenshot_time
55
-
take_screenshot_title
mail;webmail;crypto;btc;ethereum;bitcoin;eth;outlook;foxmail;bank;email;compose;
Extracted
warzonerat
top.not2beabused01.xyz:1668
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dfsghjs\\uytedew.exe," reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dfsghjs\\iurdsfhgj.exe," reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dfsghjs\\uytresdfgh.exe," reg.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4592-183-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/4592-189-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2644-177-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/2644-190-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/2644-203-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral2/memory/2644-177-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/4592-183-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/2644-190-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2088-193-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4592-189-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/2088-188-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2644-203-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Warzone RAT payload 7 IoCs
resource yara_rule behavioral2/memory/1732-252-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1732-255-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1732-271-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1732-287-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1732-289-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1732-291-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1732-293-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation tqchnnl.exe -
Executes dropped EXE 13 IoCs
pid Process 1800 tqchnnl.exe 1596 tqchnnl.exe 2644 tqchnnl.exe 4592 tqchnnl.exe 2088 tqchnnl.exe 2132 fmwrz.exe 1092 ghibzkdm.exe 2712 datorg.exe 2812 datxld.exe 1732 ghibzkdm.exe 2888 datrem.exe 2368 uytedew.exe 716 iurdsfhgj.exe -
Loads dropped DLL 6 IoCs
pid Process 1732 ghibzkdm.exe 1732 ghibzkdm.exe 1732 ghibzkdm.exe 1732 ghibzkdm.exe 1732 ghibzkdm.exe 1732 ghibzkdm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts tqchnnl.exe -
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odsnqyon = "C:\\Users\\Admin\\AppData\\Roaming\\ukyerc\\irsqhssjjf.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\tqchnnl.exe\" C:\\Users\\Admin\\AppData\\Local\\" tqchnnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maoie = "C:\\Users\\Admin\\AppData\\Roaming\\dnetoln\\qiyvhavtewgo.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ghibzkdm.exe\" C:\\Users\\Admin\\AppData\\Lo" ghibzkdm.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1800 set thread context of 1596 1800 tqchnnl.exe 85 PID 1596 set thread context of 2644 1596 tqchnnl.exe 86 PID 1596 set thread context of 4592 1596 tqchnnl.exe 87 PID 1596 set thread context of 2088 1596 tqchnnl.exe 88 PID 1092 set thread context of 1732 1092 ghibzkdm.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 9 IoCs
pid Process 1816 PING.EXE 4148 PING.EXE 4264 PING.EXE 3196 PING.EXE 2932 PING.EXE 4564 PING.EXE 5004 PING.EXE 4920 PING.EXE 1544 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2644 tqchnnl.exe 2644 tqchnnl.exe 2088 tqchnnl.exe 2088 tqchnnl.exe 2644 tqchnnl.exe 2644 tqchnnl.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2812 datxld.exe 2812 datxld.exe 2812 datxld.exe 2812 datxld.exe 2812 datxld.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2812 datxld.exe 2712 datorg.exe 2712 datorg.exe 2712 datorg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1596 tqchnnl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1800 tqchnnl.exe 1596 tqchnnl.exe 1596 tqchnnl.exe 1596 tqchnnl.exe 1092 ghibzkdm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2088 tqchnnl.exe Token: SeDebugPrivilege 2812 datxld.exe Token: SeDebugPrivilege 2712 datorg.exe Token: SeDebugPrivilege 2888 datrem.exe Token: SeDebugPrivilege 2368 uytedew.exe Token: SeDebugPrivilege 716 iurdsfhgj.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1596 tqchnnl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 616 wrote to memory of 1800 616 vbc.exe 84 PID 616 wrote to memory of 1800 616 vbc.exe 84 PID 616 wrote to memory of 1800 616 vbc.exe 84 PID 1800 wrote to memory of 1596 1800 tqchnnl.exe 85 PID 1800 wrote to memory of 1596 1800 tqchnnl.exe 85 PID 1800 wrote to memory of 1596 1800 tqchnnl.exe 85 PID 1800 wrote to memory of 1596 1800 tqchnnl.exe 85 PID 1596 wrote to memory of 2644 1596 tqchnnl.exe 86 PID 1596 wrote to memory of 2644 1596 tqchnnl.exe 86 PID 1596 wrote to memory of 2644 1596 tqchnnl.exe 86 PID 1596 wrote to memory of 4592 1596 tqchnnl.exe 87 PID 1596 wrote to memory of 4592 1596 tqchnnl.exe 87 PID 1596 wrote to memory of 4592 1596 tqchnnl.exe 87 PID 1596 wrote to memory of 2088 1596 tqchnnl.exe 88 PID 1596 wrote to memory of 2088 1596 tqchnnl.exe 88 PID 1596 wrote to memory of 2088 1596 tqchnnl.exe 88 PID 1596 wrote to memory of 2132 1596 tqchnnl.exe 91 PID 1596 wrote to memory of 2132 1596 tqchnnl.exe 91 PID 1596 wrote to memory of 2132 1596 tqchnnl.exe 91 PID 2132 wrote to memory of 1092 2132 fmwrz.exe 92 PID 2132 wrote to memory of 1092 2132 fmwrz.exe 92 PID 2132 wrote to memory of 1092 2132 fmwrz.exe 92 PID 1596 wrote to memory of 2712 1596 tqchnnl.exe 93 PID 1596 wrote to memory of 2712 1596 tqchnnl.exe 93 PID 1596 wrote to memory of 2712 1596 tqchnnl.exe 93 PID 1596 wrote to memory of 2812 1596 tqchnnl.exe 94 PID 1596 wrote to memory of 2812 1596 tqchnnl.exe 94 PID 1596 wrote to memory of 2812 1596 tqchnnl.exe 94 PID 1092 wrote to memory of 1732 1092 ghibzkdm.exe 95 PID 1092 wrote to memory of 1732 1092 ghibzkdm.exe 95 PID 1092 wrote to memory of 1732 1092 ghibzkdm.exe 95 PID 1092 wrote to memory of 1732 1092 ghibzkdm.exe 95 PID 1596 wrote to memory of 2888 1596 tqchnnl.exe 97 PID 1596 wrote to memory of 2888 1596 tqchnnl.exe 97 PID 1596 wrote to memory of 2888 1596 tqchnnl.exe 97 PID 2712 wrote to memory of 4224 2712 datorg.exe 101 PID 2712 wrote to memory of 4224 2712 datorg.exe 101 PID 2712 wrote to memory of 4224 2712 datorg.exe 101 PID 2812 wrote to memory of 4164 2812 datxld.exe 103 PID 2812 wrote to memory of 4164 2812 datxld.exe 103 PID 2812 wrote to memory of 4164 2812 datxld.exe 103 PID 4224 wrote to memory of 1544 4224 cmd.exe 105 PID 4224 wrote to memory of 1544 4224 cmd.exe 105 PID 4224 wrote to memory of 1544 4224 cmd.exe 105 PID 4164 wrote to memory of 2932 4164 cmd.exe 106 PID 4164 wrote to memory of 2932 4164 cmd.exe 106 PID 4164 wrote to memory of 2932 4164 cmd.exe 106 PID 2888 wrote to memory of 3932 2888 datrem.exe 108 PID 2888 wrote to memory of 3932 2888 datrem.exe 108 PID 2888 wrote to memory of 3932 2888 datrem.exe 108 PID 3932 wrote to memory of 1816 3932 cmd.exe 110 PID 3932 wrote to memory of 1816 3932 cmd.exe 110 PID 3932 wrote to memory of 1816 3932 cmd.exe 110 PID 2712 wrote to memory of 4848 2712 datorg.exe 111 PID 2712 wrote to memory of 4848 2712 datorg.exe 111 PID 2712 wrote to memory of 4848 2712 datorg.exe 111 PID 4848 wrote to memory of 4564 4848 cmd.exe 113 PID 4848 wrote to memory of 4564 4848 cmd.exe 113 PID 4848 wrote to memory of 4564 4848 cmd.exe 113 PID 2812 wrote to memory of 508 2812 datxld.exe 114 PID 2812 wrote to memory of 508 2812 datxld.exe 114 PID 2812 wrote to memory of 508 2812 datxld.exe 114 PID 508 wrote to memory of 5004 508 cmd.exe 116 PID 508 wrote to memory of 5004 508 cmd.exe 116 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe"C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe" C:\Users\Admin\AppData\Local\Temp\smpprgdmyr.v2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe"C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exeC:\Users\Admin\AppData\Local\Temp\tqchnnl.exe /stext "C:\Users\Admin\AppData\Local\Temp\czocvqcsnapqahyimxvqdhzqbixgdfbmti"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2644
-
-
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exeC:\Users\Admin\AppData\Local\Temp\tqchnnl.exe /stext "C:\Users\Admin\AppData\Local\Temp\nbbnvj"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:4592
-
-
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exeC:\Users\Admin\AppData\Local\Temp\tqchnnl.exe /stext "C:\Users\Admin\AppData\Local\Temp\pvhfwbxnx"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\fmwrz.exe"C:\Users\Admin\AppData\Local\Temp\fmwrz.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe"C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe" C:\Users\Admin\AppData\Local\Temp\xaaktctbkvc.h5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe"C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1732
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\datorg.exe"C:\Users\Admin\AppData\Local\Temp\datorg.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe,"5⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 396⤵
- Runs ping.exe
PID:1544
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe,"6⤵
- Modifies WinLogon for persistence
PID:4572
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && copy "C:\Users\Admin\AppData\Local\Temp\datorg.exe" "C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe" && ping 127.0.0.1 -n 39 > nul && "C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 396⤵
- Runs ping.exe
PID:4564
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 396⤵
- Runs ping.exe
PID:4920
-
-
C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe"C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\datxld.exe"C:\Users\Admin\AppData\Local\Temp\datxld.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 36 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe,"5⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 366⤵
- Runs ping.exe
PID:2932
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe,"6⤵
- Modifies WinLogon for persistence
PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 38 > nul && copy "C:\Users\Admin\AppData\Local\Temp\datxld.exe" "C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe" && ping 127.0.0.1 -n 38 > nul && "C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 386⤵
- Runs ping.exe
PID:5004
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 386⤵
- Runs ping.exe
PID:4264
-
-
C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe"C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\datrem.exe"C:\Users\Admin\AppData\Local\Temp\datrem.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe,"5⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 396⤵
- Runs ping.exe
PID:1816
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe,"6⤵
- Modifies WinLogon for persistence
PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 46 > nul && copy "C:\Users\Admin\AppData\Local\Temp\datrem.exe" "C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe" && ping 127.0.0.1 -n 46 > nul && "C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe"5⤵PID:4616
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 466⤵
- Runs ping.exe
PID:4148
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 466⤵
- Runs ping.exe
PID:3196
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD59d9e72c9c9718c1b11fa079c9e176126
SHA184061c88da377e5badb0456d7e7d27b2b589da53
SHA256c1b68659db646a5da925a4bb927a9803ab7d10ae74516a2547c87097f87ba317
SHA5121b1aba5888e92f1afd33454ae69de66bc8202a4974b36696a0a6903cc528cb59810f778446ba855ac125b3c77f6be0ebee5d6df49a2838e0c0543a9a29a4e428
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
218KB
MD5a3a47448f45b0374c3cde59e1a7bfb0d
SHA1e00b404f1a143c99e1cf095ef27678022539be43
SHA2569b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
SHA512cc70d6c4829a13a7b5819c6924d0309beb083131c59d8cb3e81f13b1bc38d02413f48447064b7f5948bdb2d162c450863c9bc0c47f51735375264d31bbc48dd4
-
Filesize
218KB
MD5a3a47448f45b0374c3cde59e1a7bfb0d
SHA1e00b404f1a143c99e1cf095ef27678022539be43
SHA2569b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
SHA512cc70d6c4829a13a7b5819c6924d0309beb083131c59d8cb3e81f13b1bc38d02413f48447064b7f5948bdb2d162c450863c9bc0c47f51735375264d31bbc48dd4
-
Filesize
218KB
MD5a3a47448f45b0374c3cde59e1a7bfb0d
SHA1e00b404f1a143c99e1cf095ef27678022539be43
SHA2569b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
SHA512cc70d6c4829a13a7b5819c6924d0309beb083131c59d8cb3e81f13b1bc38d02413f48447064b7f5948bdb2d162c450863c9bc0c47f51735375264d31bbc48dd4
-
Filesize
326KB
MD5ef12ab9d0b231b8f898067b2114b1bc0
SHA16d90f27b2105945f9bb77039e8b892070a5f9442
SHA2562b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7
SHA5122aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
133KB
MD575f8cc548cabf0cc800c25047e4d3124
SHA1602676768f9faecd35b48c38a0632781dfbde10c
SHA256fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0
SHA512ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f
-
Filesize
429KB
MD5109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
Filesize
1.2MB
MD5d7858e8449004e21b01d468e9fd04b82
SHA19524352071ede21c167e7e4f106e9526dc23ef4e
SHA25678758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db
SHA5121e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440
-
Filesize
7KB
MD58bba552e868d530af56dadd00d38ce78
SHA1e8f76dd15c91b3c42d42ce83a06c299d900cedf6
SHA256dd99bf95cbfb93c236cdfe239dddce5aa54f6355a50a7b2ed7606afd00958b9b
SHA512ff8fe38ed26720865f57fa69a9dd3806109cb688ea22e38ff44ca05f6a7d95795705ac2ccff1e7eb964696a0a0843b370fe76c96373a580ef66ada63054ce35f
-
Filesize
141KB
MD5471c983513694ac3002590345f2be0da
SHA16612b9af4ff6830fa9b7d4193078434ef72f775b
SHA256bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f
SHA512a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410
-
Filesize
161KB
MD512c7d6f0b173d7d369ae8bf93dd1c384
SHA1bcb512d7fe890bb980206788d15c494ca02ede8a
SHA256ae4add2b61f783f6d4faa3216ff68960302f76230ef0a371edf6778188bf86f3
SHA51253e8b9337544218ab38f319d34752161ad974db1b370dae10786695554d0541dc21209e48c819b5e9e48f339e0afa843d750e8e5105e5abf18aa84e7bb3c24be
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
Filesize
496KB
MD5b8e0694c7d8f49c6bab7b2f38a068cc7
SHA1b19f8174f08d3e844b5ae2e74cb6eb7a7e6f7923
SHA2566a0e2c58b2be31c768cd2dd0236ebef7d8ef9839c6398931f6f9b9a20b62dd4c
SHA512ead2ee5aeec1a2df1d244b8b5502bc0e84e85c5024602fb9cc4e3b09f687e9af77c2427d6e59661319217306494d50ea77d623b18e586baebeecc7b72a05c14f
-
Filesize
7KB
MD5bab85673afd9040f8fffe381439cf5cc
SHA18d13dfa7f0047acb464e3ed534580c60bdabed6b
SHA25676aee090b77973c9e217601cd168c181c0e4639b2073a0f52db7eb5c32fa77c2
SHA512df2694645b1ed4d2e9b2ffb901cb0d0af8ac192665c81214bbc8157fab7b6b5fe7203d8f6ebdbe070796ff6185c3535efed97a515f7ed413c0f7f689d1b0f16c
-
Filesize
144B
MD5bd91ec5dad01faacaf4ba90c0101dccb
SHA1ef07b56364766fdb78e1716f2cfb7b95a91ce0af
SHA2563b5e91fbb60d1cfbb1856c79a12eb208ccc6bb80cdde3fafb825f6e64370d489
SHA512cc7e2f14927ab09cd50ecbe803f261ab9be5bc0dc8a195c5d57b94ae2563d73e54fcac9980a3b79764cb5fa6bc8fb9ef3e8ba4d94b0e5164b4e0cf674f82e4f0
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed