3a7be50f09bf3dd2a494aae3c79c938cfb70c77b348dab82737f8d783e49193a

Analysis

max time kernel
148s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cd4736e078626a00f2c36d6e5f09a1c.exe
Size

556KB
MD5

3cd4736e078626a00f2c36d6e5f09a1c
SHA1

f7fddc294a13c78d12730dd1f4ee8c49055d1379
SHA256

3a7be50f09bf3dd2a494aae3c79c938cfb70c77b348dab82737f8d783e49193a
SHA512

e80e12af806220aed99a0dfa17d76ed35f05f174fe9e9b3ce5500fb80b0fa3379e507af133e644cf122397e1c83b76535d010ce7bfe005fb810dd66528e23e3e
SSDEEP

12288:07Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:07L1yMgcnOds44Fp2PWUDI8

Score

10^/10

evasion persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\b72f5ba2\\X"	Explorer.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	NB4wr66jY4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rieseu.exe

Deletes itself 1 IoCs

pid	Process
2088	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2340	NB4wr66jY4.exe
2796	rieseu.exe
2840	2xek.exe
2824	2xek.exe
3068	2xek.exe
2832	2xek.exe
2276	2xek.exe
268	2xek.exe
3040	3xek.exe
336	csrss.exe
308	X

Loads dropped DLL 17 IoCs

pid	Process
1544	3cd4736e078626a00f2c36d6e5f09a1c.exe
1544	3cd4736e078626a00f2c36d6e5f09a1c.exe
2340	NB4wr66jY4.exe
2340	NB4wr66jY4.exe
1544	3cd4736e078626a00f2c36d6e5f09a1c.exe
1544	3cd4736e078626a00f2c36d6e5f09a1c.exe
2308	WerFault.exe
2308	WerFault.exe
2308	WerFault.exe
2308	WerFault.exe
2308	WerFault.exe
2308	WerFault.exe
2308	WerFault.exe
1544	3cd4736e078626a00f2c36d6e5f09a1c.exe
1544	3cd4736e078626a00f2c36d6e5f09a1c.exe
3040	3xek.exe
3040	3xek.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3068-57-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2832-59-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/3068-58-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2832-63-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2832-55-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2832-67-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2276-69-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/2276-71-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/2276-84-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/2276-86-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/268-89-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/268-91-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2276-88-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/268-97-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/268-102-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/268-101-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/268-100-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2276-81-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/268-107-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/3068-54-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/3068-49-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/3068-45-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/3068-43-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/3068-149-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2276-156-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	31.193.3.240
Destination IP	31.193.3.240
Destination IP	31.193.3.240
Destination IP	31.193.3.240
Destination IP	31.193.3.240

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /N"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /w"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /P"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /F"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /t"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /n"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /C"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /B"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /S"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /Q"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /o"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /Z"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /i"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /Y"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /j"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /d"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /k"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /a"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /T"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /K"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /X"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /q"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /G"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /A"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /c"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /E"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /v"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /x"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /J"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /z"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /D"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /m"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /r"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /V"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /u"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /b"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /h"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /e"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /l"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /H"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /p"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /U"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /g"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /I"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /L"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /O"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /R"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /W"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /s"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /f"	rieseu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /z"	NB4wr66jY4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rieseu = "C:\\Users\\Admin\\rieseu.exe /y"	rieseu.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2xek.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	2xek.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 2824	2840	2xek.exe	41
PID 2840 set thread context of 3068	2840	2xek.exe	40
PID 2840 set thread context of 2832	2840	2xek.exe	39
PID 2840 set thread context of 2276	2840	2xek.exe	33
PID 2840 set thread context of 268	2840	2xek.exe	31
PID 3040 set thread context of 2464	3040	3xek.exe	44

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
2308	2832	WerFault.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1148	tasklist.exe
428	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{8e8e4083-5159-4c3c-771c-7aa7863b639b}	3xek.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8e8e4083-5159-4c3c-771c-7aa7863b639b}\u = "188"	3xek.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8e8e4083-5159-4c3c-771c-7aa7863b639b}\cid = "9686642132157342285"	3xek.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2340	NB4wr66jY4.exe
2340	NB4wr66jY4.exe
3068	2xek.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
3068	2xek.exe
2796	rieseu.exe
3040	3xek.exe
3040	3xek.exe
3040	3xek.exe
3040	3xek.exe
308	X
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe
2796	rieseu.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1148	tasklist.exe
Token: SeDebugPrivilege	3040	3xek.exe
Token: SeDebugPrivilege	3040	3xek.exe
Token: SeDebugPrivilege	428	tasklist.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1544	3cd4736e078626a00f2c36d6e5f09a1c.exe
2340	NB4wr66jY4.exe
2796	rieseu.exe
2840	2xek.exe
2276	2xek.exe
268	2xek.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2340	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	27
PID 1544 wrote to memory of 2340	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	27
PID 1544 wrote to memory of 2340	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	27
PID 1544 wrote to memory of 2340	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	27
PID 2340 wrote to memory of 2796	2340	NB4wr66jY4.exe	29
PID 2340 wrote to memory of 2796	2340	NB4wr66jY4.exe	29
PID 2340 wrote to memory of 2796	2340	NB4wr66jY4.exe	29
PID 2340 wrote to memory of 2796	2340	NB4wr66jY4.exe	29
PID 1544 wrote to memory of 2840	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	30
PID 1544 wrote to memory of 2840	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	30
PID 1544 wrote to memory of 2840	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	30
PID 1544 wrote to memory of 2840	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	30
PID 2840 wrote to memory of 2824	2840	2xek.exe	41
PID 2840 wrote to memory of 2824	2840	2xek.exe	41
PID 2840 wrote to memory of 2824	2840	2xek.exe	41
PID 2840 wrote to memory of 2824	2840	2xek.exe	41
PID 2840 wrote to memory of 2824	2840	2xek.exe	41
PID 2840 wrote to memory of 3068	2840	2xek.exe	40
PID 2840 wrote to memory of 3068	2840	2xek.exe	40
PID 2840 wrote to memory of 3068	2840	2xek.exe	40
PID 2840 wrote to memory of 3068	2840	2xek.exe	40
PID 2840 wrote to memory of 3068	2840	2xek.exe	40
PID 2840 wrote to memory of 3068	2840	2xek.exe	40
PID 2840 wrote to memory of 3068	2840	2xek.exe	40
PID 2840 wrote to memory of 3068	2840	2xek.exe	40
PID 2840 wrote to memory of 2832	2840	2xek.exe	39
PID 2840 wrote to memory of 2832	2840	2xek.exe	39
PID 2840 wrote to memory of 2832	2840	2xek.exe	39
PID 2840 wrote to memory of 2832	2840	2xek.exe	39
PID 2840 wrote to memory of 2832	2840	2xek.exe	39
PID 2840 wrote to memory of 2832	2840	2xek.exe	39
PID 2840 wrote to memory of 2832	2840	2xek.exe	39
PID 2840 wrote to memory of 2832	2840	2xek.exe	39
PID 2840 wrote to memory of 2276	2840	2xek.exe	33
PID 2840 wrote to memory of 2276	2840	2xek.exe	33
PID 2840 wrote to memory of 2276	2840	2xek.exe	33
PID 2840 wrote to memory of 2276	2840	2xek.exe	33
PID 2832 wrote to memory of 2308	2832	2xek.exe	32
PID 2832 wrote to memory of 2308	2832	2xek.exe	32
PID 2832 wrote to memory of 2308	2832	2xek.exe	32
PID 2832 wrote to memory of 2308	2832	2xek.exe	32
PID 2840 wrote to memory of 2276	2840	2xek.exe	33
PID 2840 wrote to memory of 2276	2840	2xek.exe	33
PID 2840 wrote to memory of 2276	2840	2xek.exe	33
PID 2840 wrote to memory of 2276	2840	2xek.exe	33
PID 2840 wrote to memory of 268	2840	2xek.exe	31
PID 2840 wrote to memory of 268	2840	2xek.exe	31
PID 2840 wrote to memory of 268	2840	2xek.exe	31
PID 2840 wrote to memory of 268	2840	2xek.exe	31
PID 2840 wrote to memory of 268	2840	2xek.exe	31
PID 2840 wrote to memory of 268	2840	2xek.exe	31
PID 2840 wrote to memory of 268	2840	2xek.exe	31
PID 2840 wrote to memory of 268	2840	2xek.exe	31
PID 1544 wrote to memory of 3040	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	34
PID 1544 wrote to memory of 3040	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	34
PID 1544 wrote to memory of 3040	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	34
PID 1544 wrote to memory of 3040	1544	3cd4736e078626a00f2c36d6e5f09a1c.exe	34
PID 2340 wrote to memory of 1896	2340	NB4wr66jY4.exe	37
PID 2340 wrote to memory of 1896	2340	NB4wr66jY4.exe	37
PID 2340 wrote to memory of 1896	2340	NB4wr66jY4.exe	37
PID 2340 wrote to memory of 1896	2340	NB4wr66jY4.exe	37
PID 1896 wrote to memory of 1148	1896	cmd.exe	36
PID 1896 wrote to memory of 1148	1896	cmd.exe	36
PID 1896 wrote to memory of 1148	1896	cmd.exe	36

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:336

C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe
"C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\NB4wr66jY4.exe
  C:\Users\Admin\NB4wr66jY4.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\rieseu.exe
    "C:\Users\Admin\rieseu.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2796
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1896
- C:\Users\Admin\2xek.exe
  C:\Users\Admin\2xek.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\2xek.exe
    "C:\Users\Admin\2xek.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:268
- - C:\Users\Admin\2xek.exe
    "C:\Users\Admin\2xek.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
- - C:\Users\Admin\2xek.exe
    "C:\Users\Admin\2xek.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2832
- - C:\Users\Admin\2xek.exe
    "C:\Users\Admin\2xek.exe"
    3⤵
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3068
- - C:\Users\Admin\2xek.exe
    "C:\Users\Admin\2xek.exe"
    3⤵
    - Executes dropped EXE
    PID:2824
- C:\Users\Admin\3xek.exe
  C:\Users\Admin\3xek.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- - C:\Users\Admin\AppData\Local\b72f5ba2\X
    *0*bc*7992224d*31.193.3.240:53
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:2464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del 3cd4736e078626a00f2c36d6e5f09a1c.exe
  2⤵
  - Deletes itself
  PID:2088
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 100
1⤵
- Loads dropped DLL
- Program crash
PID:2308

C:\Windows\SysWOW64\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:964

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
6d03845f1d43e10908336ba602894baa

SHA1
e804767710e4c25c01705ca8290cbfc8ebe0ca0c

SHA256
523ee58ceeed3abcbc59b51f745ebfdf3bff774dd9792e3be0f3aeb63e8ab324

SHA512
632a2b6aed9dd21e35db28f131cf1c384eb4c553f3bbe05874ddbe6fa5fa9cbe2548033d420b057cad6d9e93b171c6baa4382194c151164ceb0fb924be29aa2b

Download Submit
memory/268-100-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/268-102-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/268-101-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/268-97-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/268-85-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/268-107-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/268-91-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/268-89-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/336-136-0x0000000001EF0000-0x0000000001EFB000-memory.dmp

Filesize
44KB

Download
memory/336-133-0x0000000001EF0000-0x0000000001EFB000-memory.dmp

Filesize
44KB

Download
memory/336-167-0x00000000029F0000-0x00000000029F2000-memory.dmp

Filesize
8KB

Download
memory/1244-155-0x0000000002A30000-0x0000000002A3B000-memory.dmp

Filesize
44KB

Download
memory/1244-127-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1244-128-0x00000000029F0000-0x00000000029F2000-memory.dmp

Filesize
8KB

Download
memory/1244-123-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1244-119-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1244-143-0x0000000002A20000-0x0000000002A2B000-memory.dmp

Filesize
44KB

Download
memory/1244-151-0x0000000002A00000-0x0000000002A08000-memory.dmp

Filesize
32KB

Download
memory/2276-84-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2276-88-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2276-81-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2276-86-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2276-156-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2276-69-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2276-66-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2276-71-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2340-60-0x00000000031A0000-0x0000000003C5A000-memory.dmp

Filesize
10.7MB

Download
memory/2824-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2832-63-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2832-52-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2832-55-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2832-67-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2832-59-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3040-118-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/3040-161-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/3040-169-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/3040-162-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/3040-117-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/3068-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-149-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download