d085472f22677ffa702c0f4c0e1b90712d0fe266ba9d26de44b02273768e94b1

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dbef98d9e25f35935fc7568c9bfb66fc.exe
Size

84KB
MD5

dbef98d9e25f35935fc7568c9bfb66fc
SHA1

04356714f37f3249231ee2bee7e8f0f0ad51868a
SHA256

d085472f22677ffa702c0f4c0e1b90712d0fe266ba9d26de44b02273768e94b1
SHA512

c042c1fcbddb5dd0513623d7f86ec83ea78ee4f959197466860f7ec88e9ba7f00d39efcdf09efbc6eff41ee0d04ca34baf6bdcaba5f5e54219f8888c5865eb4c
SSDEEP

1536:AXVyiy/GZN5pBVqR/9eZZFnBTtTJQ1ExgSdh5zlVh7NipVVYRpTlOVSvEHFNFVzI:GV2diQVM9TIPT96q

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2876	log.exe
1020	log.exe
2352	log.exe
2796	log.exe

Loads dropped DLL 5 IoCs

pid	Process
2168	dbef98d9e25f35935fc7568c9bfb66fc.exe
2168	dbef98d9e25f35935fc7568c9bfb66fc.exe
2168	dbef98d9e25f35935fc7568c9bfb66fc.exe
2168	dbef98d9e25f35935fc7568c9bfb66fc.exe
2168	dbef98d9e25f35935fc7568c9bfb66fc.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-437-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2168-443-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2168-925-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1020-928-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2168-1070-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1020-1245-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinRAR = "C:\\Users\\Admin\\AppData\\Roaming\\log\\log.exe"	reg.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 2168	1956	dbef98d9e25f35935fc7568c9bfb66fc.exe	28
PID 2876 set thread context of 1020	2876	log.exe	33
PID 2876 set thread context of 2352	2876	log.exe	34
PID 2352 set thread context of 2796	2352	log.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	log.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	log.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	log.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	log.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	log.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe
Token: SeDebugPrivilege	1020	log.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1956	dbef98d9e25f35935fc7568c9bfb66fc.exe
2168	dbef98d9e25f35935fc7568c9bfb66fc.exe
2876	log.exe
1020	log.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2168	1956	dbef98d9e25f35935fc7568c9bfb66fc.exe	28
PID 1956 wrote to memory of 2168	1956	dbef98d9e25f35935fc7568c9bfb66fc.exe	28
PID 1956 wrote to memory of 2168	1956	dbef98d9e25f35935fc7568c9bfb66fc.exe	28
PID 1956 wrote to memory of 2168	1956	dbef98d9e25f35935fc7568c9bfb66fc.exe	28
PID 1956 wrote to memory of 2168	1956	dbef98d9e25f35935fc7568c9bfb66fc.exe	28
PID 1956 wrote to memory of 2168	1956	dbef98d9e25f35935fc7568c9bfb66fc.exe	28
PID 1956 wrote to memory of 2168	1956	dbef98d9e25f35935fc7568c9bfb66fc.exe	28
PID 1956 wrote to memory of 2168	1956	dbef98d9e25f35935fc7568c9bfb66fc.exe	28
PID 2168 wrote to memory of 2684	2168	dbef98d9e25f35935fc7568c9bfb66fc.exe	29
PID 2168 wrote to memory of 2684	2168	dbef98d9e25f35935fc7568c9bfb66fc.exe	29
PID 2168 wrote to memory of 2684	2168	dbef98d9e25f35935fc7568c9bfb66fc.exe	29
PID 2168 wrote to memory of 2684	2168	dbef98d9e25f35935fc7568c9bfb66fc.exe	29
PID 2684 wrote to memory of 2764	2684	cmd.exe	31
PID 2684 wrote to memory of 2764	2684	cmd.exe	31
PID 2684 wrote to memory of 2764	2684	cmd.exe	31
PID 2684 wrote to memory of 2764	2684	cmd.exe	31
PID 2168 wrote to memory of 2876	2168	dbef98d9e25f35935fc7568c9bfb66fc.exe	32
PID 2168 wrote to memory of 2876	2168	dbef98d9e25f35935fc7568c9bfb66fc.exe	32
PID 2168 wrote to memory of 2876	2168	dbef98d9e25f35935fc7568c9bfb66fc.exe	32
PID 2168 wrote to memory of 2876	2168	dbef98d9e25f35935fc7568c9bfb66fc.exe	32
PID 2876 wrote to memory of 1020	2876	log.exe	33
PID 2876 wrote to memory of 1020	2876	log.exe	33
PID 2876 wrote to memory of 1020	2876	log.exe	33
PID 2876 wrote to memory of 1020	2876	log.exe	33
PID 2876 wrote to memory of 1020	2876	log.exe	33
PID 2876 wrote to memory of 1020	2876	log.exe	33
PID 2876 wrote to memory of 1020	2876	log.exe	33
PID 2876 wrote to memory of 1020	2876	log.exe	33
PID 2876 wrote to memory of 2352	2876	log.exe	34
PID 2876 wrote to memory of 2352	2876	log.exe	34
PID 2876 wrote to memory of 2352	2876	log.exe	34
PID 2876 wrote to memory of 2352	2876	log.exe	34
PID 2876 wrote to memory of 2352	2876	log.exe	34
PID 2876 wrote to memory of 2352	2876	log.exe	34
PID 2876 wrote to memory of 2352	2876	log.exe	34
PID 2876 wrote to memory of 2352	2876	log.exe	34
PID 2352 wrote to memory of 2796	2352	log.exe	35
PID 2352 wrote to memory of 2796	2352	log.exe	35
PID 2352 wrote to memory of 2796	2352	log.exe	35
PID 2352 wrote to memory of 2796	2352	log.exe	35
PID 2352 wrote to memory of 2796	2352	log.exe	35
PID 2352 wrote to memory of 2796	2352	log.exe	35
PID 2352 wrote to memory of 2796	2352	log.exe	35
PID 2352 wrote to memory of 2796	2352	log.exe	35

C:\Users\Admin\AppData\Local\Temp\dbef98d9e25f35935fc7568c9bfb66fc.exe
"C:\Users\Admin\AppData\Local\Temp\dbef98d9e25f35935fc7568c9bfb66fc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\dbef98d9e25f35935fc7568c9bfb66fc.exe
  "C:\Users\Admin\AppData\Local\Temp\dbef98d9e25f35935fc7568c9bfb66fc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\QDBPX.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinRAR" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\log\log.exe" /f
      4⤵
      Adds Run key to start application
      PID:2764
- - C:\Users\Admin\AppData\Roaming\log\log.exe
    "C:\Users\Admin\AppData\Roaming\log\log.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Users\Admin\AppData\Roaming\log\log.exe
      "C:\Users\Admin\AppData\Roaming\log\log.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1020
  - - C:\Users\Admin\AppData\Roaming\log\log.exe
      "C:\Users\Admin\AppData\Roaming\log\log.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Users\Admin\AppData\Roaming\log\log.exe
        
        "C:\Users\Admin\AppData\Roaming\log\log.exe"
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabDDB4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\QDBPX.bat

Filesize
135B

MD5
0b6ffb040995a997bb860390dd143b64

SHA1
7fb78a49e5de643b69431b2fe68077fc9827e3b3

SHA256
19420c60878305768f3c509df2add0666857804a0f053b5b6b9bfed60cdd68b8

SHA512
47663db9555d957f22648c974b4ea4d9dbd522c74313ad2ded2bcd3a97afe4e29068a27a4264317411b0166f6132781d042e7a641b1f32b5986d2979220a7875

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE05.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Roaming\log\log.exe

Filesize
84KB

MD5
2b18e61f9453dae4596a06a8345bdefa

SHA1
79cb55ae32b56802e46c297c4d8f133bd8b6e5de

SHA256
69ac413091ad2fdc7db4edfc9160dad635596a4e31ec5dcd258e132a9e116cd8

SHA512
ac096e41597f8545395105bf402d7d8293320cbfd6c794303c2c3d6eeeefb6a480fc8b80e2b43122cc9f293370e7c0803d023deb150ae0063d27e9628d7d0bcc

Download Submit
memory/1020-928-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1020-1245-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1956-167-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/1956-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2168-437-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2168-443-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2168-925-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2168-1070-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2352-1062-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2352-1085-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2352-1066-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2796-1083-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2796-1243-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads