xtremerat | 1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14/11/2023, 17:31

231114-v3qg7acf42 10

14/11/2023, 17:21

28/10/2023, 19:29

24/10/2023, 13:29

18/10/2023, 12:04

07/09/2023, 12:10

Analysis

max time kernel
32s
max time network
19s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/09/2023, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
Size

290KB
MD5

7ee1ec661c83f963eedc619390d1cf0d
SHA1

088400864842aa89878b59b6520ac6dc489b01a1
SHA256

0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a
SHA512

02ea27b45edb24e5a5ef4ff7003648c76f305d155a4fc7761a8c761c5437d7cf9d132f017b20fea2f9c2ef28b1dd0cd10d8400f0be90d6e55b0920d3c909c500
SSDEEP

6144://0uoAgR+cX0ijt+/wLZ+mlRY5Fas7qcJ:/Jdu+cXbt+/wV/YTuC

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

sexsevngmail.zapto.org

Signatures

Detect XtremeRAT payload 22 IoCs

resource	yara_rule
behavioral3/memory/2652-15-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2716-24-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2640-34-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2652-35-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2640-44-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1784-48-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/580-52-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/580-54-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1488-61-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1084-70-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1784-67-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1488-85-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1488-84-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2104-91-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2104-89-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1084-81-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2072-78-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/620-99-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2072-103-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1908-106-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2072-102-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1776-113-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe

Executes dropped EXE 11 IoCs

pid	Process
2652	server.exe
2640	Server.exe
1784	Server.exe
580	Server.exe
1488	Server.exe
1084	Server.exe
2072	Server.exe
2104	Server.exe
620	Server.exe
1908	Server.exe
1776	Server.exe

Loads dropped DLL 28 IoCs

pid	Process
2372	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
2372	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
2652	server.exe
2652	server.exe
2652	server.exe
2640	Server.exe
2716	svchost.exe
2716	svchost.exe
2640	Server.exe
1784	Server.exe
580	Server.exe
2716	svchost.exe
2716	svchost.exe
1488	Server.exe
1784	Server.exe
1084	Server.exe
1084	Server.exe
2072	Server.exe
1488	Server.exe
2104	Server.exe
2716	svchost.exe
2716	svchost.exe
620	Server.exe
2072	Server.exe
1908	Server.exe
2716	svchost.exe
2716	svchost.exe
1776	Server.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2372-6-0x00000000001D0000-0x00000000001E6000-memory.dmp	upx
behavioral3/files/0x000f0000000149d7-14.dat	upx
behavioral3/files/0x000f0000000149d7-13.dat	upx
behavioral3/files/0x000f0000000149d7-12.dat	upx
behavioral3/files/0x000f0000000149d7-9.dat	upx
behavioral3/files/0x000f0000000149d7-7.dat	upx
behavioral3/files/0x000f0000000149d7-4.dat	upx
behavioral3/memory/2652-15-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/2716-24-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-25.dat	upx
behavioral3/files/0x00050000000195ac-26.dat	upx
behavioral3/files/0x00050000000195ac-28.dat	upx
behavioral3/files/0x00050000000195ac-30.dat	upx
behavioral3/files/0x00050000000195ac-31.dat	upx
behavioral3/memory/2652-29-0x0000000002E90000-0x0000000002EA6000-memory.dmp	upx
behavioral3/memory/2640-32-0x0000000000020000-0x0000000000036000-memory.dmp	upx
behavioral3/memory/2640-34-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/2652-35-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-43.dat	upx
behavioral3/files/0x00050000000195ac-42.dat	upx
behavioral3/files/0x00050000000195ac-47.dat	upx
behavioral3/files/0x00050000000195ac-46.dat	upx
behavioral3/files/0x00050000000195ac-41.dat	upx
behavioral3/files/0x00050000000195ac-40.dat	upx
behavioral3/files/0x00050000000195ac-39.dat	upx
behavioral3/memory/2640-44-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/1784-48-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/1784-49-0x0000000000020000-0x0000000000036000-memory.dmp	upx
behavioral3/memory/580-52-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/580-54-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/1488-61-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-59.dat	upx
behavioral3/files/0x00050000000195ac-57.dat	upx
behavioral3/files/0x00050000000195ac-56.dat	upx
behavioral3/files/0x00050000000195ac-55.dat	upx
behavioral3/files/0x00050000000195ac-62.dat	upx
behavioral3/memory/1084-70-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-68.dat	upx
behavioral3/memory/1784-67-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-66.dat	upx
behavioral3/files/0x00050000000195ac-83.dat	upx
behavioral3/memory/1488-85-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/1488-84-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-93.dat	upx
behavioral3/memory/620-96-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-95.dat	upx
behavioral3/files/0x00050000000195ac-94.dat	upx
behavioral3/memory/2104-91-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-92.dat	upx
behavioral3/memory/2104-89-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-82.dat	upx
behavioral3/memory/1084-81-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-79.dat	upx
behavioral3/memory/2072-78-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-75.dat	upx
behavioral3/files/0x00050000000195ac-74.dat	upx
behavioral3/files/0x00050000000195ac-72.dat	upx
behavioral3/memory/620-99-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/2072-100-0x0000000000020000-0x0000000000036000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-101.dat	upx
behavioral3/memory/2072-103-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/1908-106-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x00050000000195ac-105.dat	upx
behavioral3/files/0x00050000000195ac-104.dat	upx

Adds Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File created	C:\Windows\InstallDir\Server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2652	2372	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	28
PID 2372 wrote to memory of 2652	2372	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	28
PID 2372 wrote to memory of 2652	2372	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	28
PID 2372 wrote to memory of 2652	2372	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	28
PID 2372 wrote to memory of 2652	2372	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	28
PID 2372 wrote to memory of 2652	2372	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	28
PID 2372 wrote to memory of 2652	2372	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	28
PID 2652 wrote to memory of 2716	2652	server.exe	29
PID 2652 wrote to memory of 2716	2652	server.exe	29
PID 2652 wrote to memory of 2716	2652	server.exe	29
PID 2652 wrote to memory of 2716	2652	server.exe	29
PID 2652 wrote to memory of 2716	2652	server.exe	29
PID 2652 wrote to memory of 2716	2652	server.exe	29
PID 2652 wrote to memory of 2716	2652	server.exe	29
PID 2652 wrote to memory of 2716	2652	server.exe	29
PID 2652 wrote to memory of 2624	2652	server.exe	30
PID 2652 wrote to memory of 2624	2652	server.exe	30
PID 2652 wrote to memory of 2624	2652	server.exe	30
PID 2652 wrote to memory of 2624	2652	server.exe	30
PID 2652 wrote to memory of 2624	2652	server.exe	30
PID 2652 wrote to memory of 2624	2652	server.exe	30
PID 2652 wrote to memory of 2624	2652	server.exe	30
PID 2652 wrote to memory of 2624	2652	server.exe	30
PID 2652 wrote to memory of 2592	2652	server.exe	31
PID 2652 wrote to memory of 2592	2652	server.exe	31
PID 2652 wrote to memory of 2592	2652	server.exe	31
PID 2652 wrote to memory of 2592	2652	server.exe	31
PID 2652 wrote to memory of 2592	2652	server.exe	31
PID 2652 wrote to memory of 2592	2652	server.exe	31
PID 2652 wrote to memory of 2592	2652	server.exe	31
PID 2652 wrote to memory of 2592	2652	server.exe	31
PID 2652 wrote to memory of 2600	2652	server.exe	32
PID 2652 wrote to memory of 2600	2652	server.exe	32
PID 2652 wrote to memory of 2600	2652	server.exe	32
PID 2652 wrote to memory of 2600	2652	server.exe	32
PID 2652 wrote to memory of 2600	2652	server.exe	32
PID 2652 wrote to memory of 2600	2652	server.exe	32
PID 2652 wrote to memory of 2600	2652	server.exe	32
PID 2652 wrote to memory of 2600	2652	server.exe	32
PID 2652 wrote to memory of 2284	2652	server.exe	33
PID 2652 wrote to memory of 2284	2652	server.exe	33
PID 2652 wrote to memory of 2284	2652	server.exe	33
PID 2652 wrote to memory of 2284	2652	server.exe	33
PID 2652 wrote to memory of 2284	2652	server.exe	33
PID 2652 wrote to memory of 2284	2652	server.exe	33
PID 2652 wrote to memory of 2284	2652	server.exe	33
PID 2652 wrote to memory of 2284	2652	server.exe	33
PID 2652 wrote to memory of 2108	2652	server.exe	34
PID 2652 wrote to memory of 2108	2652	server.exe	34
PID 2652 wrote to memory of 2108	2652	server.exe	34
PID 2652 wrote to memory of 2108	2652	server.exe	34
PID 2652 wrote to memory of 2108	2652	server.exe	34
PID 2652 wrote to memory of 2108	2652	server.exe	34
PID 2652 wrote to memory of 2108	2652	server.exe	34
PID 2652 wrote to memory of 2108	2652	server.exe	34
PID 2652 wrote to memory of 2712	2652	server.exe	35
PID 2652 wrote to memory of 2712	2652	server.exe	35
PID 2652 wrote to memory of 2712	2652	server.exe	35
PID 2652 wrote to memory of 2712	2652	server.exe	35
PID 2652 wrote to memory of 2712	2652	server.exe	35
PID 2652 wrote to memory of 2712	2652	server.exe	35
PID 2652 wrote to memory of 2712	2652	server.exe	35
PID 2652 wrote to memory of 2712	2652	server.exe	35
PID 2652 wrote to memory of 2628	2652	server.exe	36

C:\Users\Admin\AppData\Local\Temp\0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
"C:\Users\Admin\AppData\Local\Temp\0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Installed Components in the registry
    - Loads dropped DLL
    - Adds Run key to start application
    PID:2716
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      PID:1784
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2756
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2840
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2856
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2780
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2892
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:972
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1076
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2796
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1084
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:380
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2160
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1628
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2888
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2900
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1516
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1184
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:792
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2072
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:816
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1072
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:964
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2204
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      PID:1488
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1664
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2644
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1904
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2984
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2896
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2096
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2000
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:924
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2104
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:620
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      PID:1776
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1456
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2004
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2212
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2916
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:564
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:540
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2624
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2592
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2600
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2284
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2108
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2712
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2628
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2500
- - C:\Windows\InstallDir\Server.exe
    "C:\Windows\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:2640
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2476
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2440
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:372
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:664
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:476
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2444
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2076
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1740
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
memory/580-54-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/580-52-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/620-96-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/620-99-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1084-81-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1084-70-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1084-73-0x0000000002E50000-0x0000000002E66000-memory.dmp

Filesize
88KB

Download
memory/1488-85-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1488-86-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/1488-84-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1488-61-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1776-114-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/1776-113-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1784-49-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/1784-67-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1784-69-0x0000000002F70000-0x0000000002F86000-memory.dmp

Filesize
88KB

Download
memory/1784-48-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1908-106-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2072-76-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/2072-102-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2072-103-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2072-100-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/2072-78-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2104-89-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2104-91-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2372-27-0x00000000001D0000-0x00000000001E6000-memory.dmp

Filesize
88KB

Download
memory/2372-11-0x00000000001D0000-0x00000000001E6000-memory.dmp

Filesize
88KB

Download
memory/2372-33-0x00000000001D0000-0x00000000001E6000-memory.dmp

Filesize
88KB

Download
memory/2372-6-0x00000000001D0000-0x00000000001E6000-memory.dmp

Filesize
88KB

Download
memory/2640-44-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2640-32-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/2640-34-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2652-15-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2652-35-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2652-29-0x0000000002E90000-0x0000000002EA6000-memory.dmp

Filesize
88KB

Download
memory/2716-45-0x00000000020A0000-0x00000000020B6000-memory.dmp

Filesize
88KB

Download
memory/2716-60-0x0000000002630000-0x0000000002646000-memory.dmp

Filesize
88KB

Download
memory/2716-24-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2716-22-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2716-77-0x0000000002630000-0x0000000002646000-memory.dmp

Filesize
88KB

Download
memory/2716-111-0x00000000029A0000-0x00000000029B6000-memory.dmp

Filesize
88KB

Download
memory/2716-58-0x0000000002630000-0x0000000002646000-memory.dmp

Filesize
88KB

Download
memory/2716-65-0x00000000020A0000-0x00000000020B6000-memory.dmp

Filesize
88KB

Download
memory/2716-80-0x0000000002630000-0x0000000002646000-memory.dmp

Filesize
88KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads