Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
3cd4736e078626a00f2c36d6e5f09a1c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3cd4736e078626a00f2c36d6e5f09a1c.exe
Resource
win10v2004-20231215-en
General
-
Target
3cd4736e078626a00f2c36d6e5f09a1c.exe
-
Size
556KB
-
MD5
3cd4736e078626a00f2c36d6e5f09a1c
-
SHA1
f7fddc294a13c78d12730dd1f4ee8c49055d1379
-
SHA256
3a7be50f09bf3dd2a494aae3c79c938cfb70c77b348dab82737f8d783e49193a
-
SHA512
e80e12af806220aed99a0dfa17d76ed35f05f174fe9e9b3ce5500fb80b0fa3379e507af133e644cf122397e1c83b76535d010ce7bfe005fb810dd66528e23e3e
-
SSDEEP
12288:07Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:07L1yMgcnOds44Fp2PWUDI8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\b72f5ba2\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" NB4wr66jY4.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rieseu.exe -
Deletes itself 1 IoCs
pid Process 2088 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2340 NB4wr66jY4.exe 2796 rieseu.exe 2840 2xek.exe 2824 2xek.exe 3068 2xek.exe 2832 2xek.exe 2276 2xek.exe 268 2xek.exe 3040 3xek.exe 336 csrss.exe 308 X -
Loads dropped DLL 17 IoCs
pid Process 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 2340 NB4wr66jY4.exe 2340 NB4wr66jY4.exe 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 3040 3xek.exe 3040 3xek.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/3068-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-59-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/3068-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-63-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2832-55-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2832-67-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2276-69-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2276-71-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2276-84-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2276-86-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/268-89-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/268-91-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2276-88-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/268-97-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/268-102-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/268-101-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/268-100-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2276-81-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/268-107-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/3068-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-156-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /N" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /w" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /P" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /F" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /t" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /n" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /C" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /B" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /S" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /Q" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /o" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /Z" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /i" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /Y" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /j" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /d" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /k" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /a" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /T" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /K" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /X" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /q" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /G" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /A" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /c" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /E" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /v" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /x" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /J" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /z" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /D" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /m" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /r" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /V" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /u" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /b" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /h" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /e" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /l" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /H" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /p" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /U" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /g" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /I" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /L" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /O" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /R" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /W" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /s" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /f" rieseu.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /z" NB4wr66jY4.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /y" rieseu.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2xek.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2xek.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2840 set thread context of 2824 2840 2xek.exe 41 PID 2840 set thread context of 3068 2840 2xek.exe 40 PID 2840 set thread context of 2832 2840 2xek.exe 39 PID 2840 set thread context of 2276 2840 2xek.exe 33 PID 2840 set thread context of 268 2840 2xek.exe 31 PID 3040 set thread context of 2464 3040 3xek.exe 44 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process 2308 2832 WerFault.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1148 tasklist.exe 428 tasklist.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \registry\machine\Software\Classes\Interface\{8e8e4083-5159-4c3c-771c-7aa7863b639b} 3xek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8e8e4083-5159-4c3c-771c-7aa7863b639b}\u = "188" 3xek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8e8e4083-5159-4c3c-771c-7aa7863b639b}\cid = "9686642132157342285" 3xek.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2340 NB4wr66jY4.exe 2340 NB4wr66jY4.exe 3068 2xek.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 3068 2xek.exe 2796 rieseu.exe 3040 3xek.exe 3040 3xek.exe 3040 3xek.exe 3040 3xek.exe 308 X 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe 2796 rieseu.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1148 tasklist.exe Token: SeDebugPrivilege 3040 3xek.exe Token: SeDebugPrivilege 3040 3xek.exe Token: SeDebugPrivilege 428 tasklist.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 2340 NB4wr66jY4.exe 2796 rieseu.exe 2840 2xek.exe 2276 2xek.exe 268 2xek.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1544 wrote to memory of 2340 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 27 PID 1544 wrote to memory of 2340 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 27 PID 1544 wrote to memory of 2340 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 27 PID 1544 wrote to memory of 2340 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 27 PID 2340 wrote to memory of 2796 2340 NB4wr66jY4.exe 29 PID 2340 wrote to memory of 2796 2340 NB4wr66jY4.exe 29 PID 2340 wrote to memory of 2796 2340 NB4wr66jY4.exe 29 PID 2340 wrote to memory of 2796 2340 NB4wr66jY4.exe 29 PID 1544 wrote to memory of 2840 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 30 PID 1544 wrote to memory of 2840 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 30 PID 1544 wrote to memory of 2840 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 30 PID 1544 wrote to memory of 2840 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 30 PID 2840 wrote to memory of 2824 2840 2xek.exe 41 PID 2840 wrote to memory of 2824 2840 2xek.exe 41 PID 2840 wrote to memory of 2824 2840 2xek.exe 41 PID 2840 wrote to memory of 2824 2840 2xek.exe 41 PID 2840 wrote to memory of 2824 2840 2xek.exe 41 PID 2840 wrote to memory of 3068 2840 2xek.exe 40 PID 2840 wrote to memory of 3068 2840 2xek.exe 40 PID 2840 wrote to memory of 3068 2840 2xek.exe 40 PID 2840 wrote to memory of 3068 2840 2xek.exe 40 PID 2840 wrote to memory of 3068 2840 2xek.exe 40 PID 2840 wrote to memory of 3068 2840 2xek.exe 40 PID 2840 wrote to memory of 3068 2840 2xek.exe 40 PID 2840 wrote to memory of 3068 2840 2xek.exe 40 PID 2840 wrote to memory of 2832 2840 2xek.exe 39 PID 2840 wrote to memory of 2832 2840 2xek.exe 39 PID 2840 wrote to memory of 2832 2840 2xek.exe 39 PID 2840 wrote to memory of 2832 2840 2xek.exe 39 PID 2840 wrote to memory of 2832 2840 2xek.exe 39 PID 2840 wrote to memory of 2832 2840 2xek.exe 39 PID 2840 wrote to memory of 2832 2840 2xek.exe 39 PID 2840 wrote to memory of 2832 2840 2xek.exe 39 PID 2840 wrote to memory of 2276 2840 2xek.exe 33 PID 2840 wrote to memory of 2276 2840 2xek.exe 33 PID 2840 wrote to memory of 2276 2840 2xek.exe 33 PID 2840 wrote to memory of 2276 2840 2xek.exe 33 PID 2832 wrote to memory of 2308 2832 2xek.exe 32 PID 2832 wrote to memory of 2308 2832 2xek.exe 32 PID 2832 wrote to memory of 2308 2832 2xek.exe 32 PID 2832 wrote to memory of 2308 2832 2xek.exe 32 PID 2840 wrote to memory of 2276 2840 2xek.exe 33 PID 2840 wrote to memory of 2276 2840 2xek.exe 33 PID 2840 wrote to memory of 2276 2840 2xek.exe 33 PID 2840 wrote to memory of 2276 2840 2xek.exe 33 PID 2840 wrote to memory of 268 2840 2xek.exe 31 PID 2840 wrote to memory of 268 2840 2xek.exe 31 PID 2840 wrote to memory of 268 2840 2xek.exe 31 PID 2840 wrote to memory of 268 2840 2xek.exe 31 PID 2840 wrote to memory of 268 2840 2xek.exe 31 PID 2840 wrote to memory of 268 2840 2xek.exe 31 PID 2840 wrote to memory of 268 2840 2xek.exe 31 PID 2840 wrote to memory of 268 2840 2xek.exe 31 PID 1544 wrote to memory of 3040 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 34 PID 1544 wrote to memory of 3040 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 34 PID 1544 wrote to memory of 3040 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 34 PID 1544 wrote to memory of 3040 1544 3cd4736e078626a00f2c36d6e5f09a1c.exe 34 PID 2340 wrote to memory of 1896 2340 NB4wr66jY4.exe 37 PID 2340 wrote to memory of 1896 2340 NB4wr66jY4.exe 37 PID 2340 wrote to memory of 1896 2340 NB4wr66jY4.exe 37 PID 2340 wrote to memory of 1896 2340 NB4wr66jY4.exe 37 PID 1896 wrote to memory of 1148 1896 cmd.exe 36 PID 1896 wrote to memory of 1148 1896 cmd.exe 36 PID 1896 wrote to memory of 1148 1896 cmd.exe 36
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:336
-
C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe"C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\NB4wr66jY4.exeC:\Users\Admin\NB4wr66jY4.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\rieseu.exe"C:\Users\Admin\rieseu.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2796
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1896
-
-
-
C:\Users\Admin\2xek.exeC:\Users\Admin\2xek.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:268
-
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2276
-
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832
-
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"3⤵
- Executes dropped EXE
PID:2824
-
-
-
C:\Users\Admin\3xek.exeC:\Users\Admin\3xek.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040 -
C:\Users\Admin\AppData\Local\b72f5ba2\X*0*bc*7992224d*31.193.3.240:533⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:308
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2464
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 3cd4736e078626a00f2c36d6e5f09a1c.exe2⤵
- Deletes itself
PID:2088 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:428
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
PID:1244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 1001⤵
- Loads dropped DLL
- Program crash
PID:2308
-
C:\Windows\SysWOW64\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:964
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1892
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56d03845f1d43e10908336ba602894baa
SHA1e804767710e4c25c01705ca8290cbfc8ebe0ca0c
SHA256523ee58ceeed3abcbc59b51f745ebfdf3bff774dd9792e3be0f3aeb63e8ab324
SHA512632a2b6aed9dd21e35db28f131cf1c384eb4c553f3bbe05874ddbe6fa5fa9cbe2548033d420b057cad6d9e93b171c6baa4382194c151164ceb0fb924be29aa2b