Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:18
Static task
static1
Behavioral task
behavioral1
Sample
75129aa64ee308f0e0755c9a7fdb30c5.exe
Resource
win7-20231215-en
General
-
Target
75129aa64ee308f0e0755c9a7fdb30c5.exe
-
Size
556KB
-
MD5
75129aa64ee308f0e0755c9a7fdb30c5
-
SHA1
61032ff1e1186fe131bcc098513d980b6c04df0a
-
SHA256
13dd6a998bbcb295ebfbb6e82b14adfdca5a89d48448384acb26657f749f1058
-
SHA512
0a1085e251988806ecd3a8b56c48def1be56d1a2429bbe3895bc07fa7ca33c3209b472f9d46e9b368d7183215ab73d319bc874478ad1ea3d14e9fd1ffe63abb9
-
SSDEEP
12288:67Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:67L1yMgcnOds44Fp2PWUDI8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\efb26d8c\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
NB4wr66jY4.exewonoz.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" NB4wr66jY4.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wonoz.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1744 cmd.exe -
Executes dropped EXE 11 IoCs
Processes:
NB4wr66jY4.exewonoz.exe2xek.exe2xek.exe2xek.exe2xek.exe2xek.exe2xek.exe3xek.execsrss.exeXpid process 1988 NB4wr66jY4.exe 2908 wonoz.exe 2820 2xek.exe 2072 2xek.exe 2576 2xek.exe 2596 2xek.exe 2632 2xek.exe 2628 2xek.exe 568 3xek.exe 336 csrss.exe 2004 X -
Loads dropped DLL 17 IoCs
Processes:
75129aa64ee308f0e0755c9a7fdb30c5.exeNB4wr66jY4.exeWerFault.exe3xek.exepid process 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 1988 NB4wr66jY4.exe 1988 NB4wr66jY4.exe 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 2588 WerFault.exe 568 3xek.exe 568 3xek.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-57-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2576-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-59-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2576-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-62-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2632-67-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2596-70-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2632-69-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2632-84-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2632-87-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2632-88-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2628-90-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2628-86-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2628-95-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2628-98-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2632-74-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2628-101-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2628-100-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2628-106-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2576-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-155-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 51 IoCs
Processes:
wonoz.exeNB4wr66jY4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /w" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /s" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /H" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /d" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /V" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /L" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /Y" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /M" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /E" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /p" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /x" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /A" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /h" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /Z" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /T" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /k" NB4wr66jY4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /W" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /G" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /u" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /F" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /U" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /t" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /n" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /K" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /D" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /m" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /k" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /N" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /v" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /a" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /f" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /j" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /l" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /q" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /Q" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /C" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /g" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /r" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /B" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /o" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /I" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /S" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /J" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /y" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /O" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /X" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /z" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /c" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /P" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /i" wonoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wonoz = "C:\\Users\\Admin\\wonoz.exe /R" wonoz.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2xek.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2xek.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2xek.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
2xek.exe3xek.exedescription pid process target process PID 2820 set thread context of 2072 2820 2xek.exe 2xek.exe PID 2820 set thread context of 2576 2820 2xek.exe 2xek.exe PID 2820 set thread context of 2596 2820 2xek.exe 2xek.exe PID 2820 set thread context of 2632 2820 2xek.exe 2xek.exe PID 2820 set thread context of 2628 2820 2xek.exe 2xek.exe PID 568 set thread context of 1020 568 3xek.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2588 2596 WerFault.exe 2xek.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 1672 tasklist.exe 1760 tasklist.exe -
Modifies registry class 3 IoCs
Processes:
3xek.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{608520b7-739c-b2d0-52f0-b848cb1c2d9c}\u = "188" 3xek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{608520b7-739c-b2d0-52f0-b848cb1c2d9c}\cid = "6116835977078809110" 3xek.exe Key created \registry\machine\Software\Classes\Interface\{608520b7-739c-b2d0-52f0-b848cb1c2d9c} 3xek.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
NB4wr66jY4.exe2xek.exewonoz.exe3xek.exeXpid process 1988 NB4wr66jY4.exe 1988 NB4wr66jY4.exe 2576 2xek.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 568 3xek.exe 568 3xek.exe 568 3xek.exe 2908 wonoz.exe 2576 2xek.exe 2908 wonoz.exe 568 3xek.exe 2004 X 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe 2908 wonoz.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
3xek.exetasklist.exetasklist.exedescription pid process Token: SeDebugPrivilege 568 3xek.exe Token: SeDebugPrivilege 568 3xek.exe Token: SeDebugPrivilege 1672 tasklist.exe Token: SeDebugPrivilege 1760 tasklist.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
75129aa64ee308f0e0755c9a7fdb30c5.exeNB4wr66jY4.exewonoz.exe2xek.exe2xek.exe2xek.exepid process 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 1988 NB4wr66jY4.exe 2908 wonoz.exe 2820 2xek.exe 2632 2xek.exe 2628 2xek.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
csrss.exepid process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
75129aa64ee308f0e0755c9a7fdb30c5.exeNB4wr66jY4.exe2xek.exe2xek.exe3xek.execmd.exedescription pid process target process PID 2268 wrote to memory of 1988 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe NB4wr66jY4.exe PID 2268 wrote to memory of 1988 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe NB4wr66jY4.exe PID 2268 wrote to memory of 1988 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe NB4wr66jY4.exe PID 2268 wrote to memory of 1988 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe NB4wr66jY4.exe PID 1988 wrote to memory of 2908 1988 NB4wr66jY4.exe wonoz.exe PID 1988 wrote to memory of 2908 1988 NB4wr66jY4.exe wonoz.exe PID 1988 wrote to memory of 2908 1988 NB4wr66jY4.exe wonoz.exe PID 1988 wrote to memory of 2908 1988 NB4wr66jY4.exe wonoz.exe PID 2268 wrote to memory of 2820 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 2xek.exe PID 2268 wrote to memory of 2820 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 2xek.exe PID 2268 wrote to memory of 2820 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 2xek.exe PID 2268 wrote to memory of 2820 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 2xek.exe PID 2820 wrote to memory of 2072 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2072 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2072 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2072 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2072 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2576 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2576 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2576 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2576 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2576 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2576 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2576 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2576 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2596 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2596 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2596 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2596 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2596 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2596 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2596 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2596 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2632 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2632 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2632 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2632 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2632 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2632 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2632 2820 2xek.exe 2xek.exe PID 2596 wrote to memory of 2588 2596 2xek.exe WerFault.exe PID 2596 wrote to memory of 2588 2596 2xek.exe WerFault.exe PID 2596 wrote to memory of 2588 2596 2xek.exe WerFault.exe PID 2596 wrote to memory of 2588 2596 2xek.exe WerFault.exe PID 2820 wrote to memory of 2632 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2628 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2628 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2628 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2628 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2628 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2628 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2628 2820 2xek.exe 2xek.exe PID 2820 wrote to memory of 2628 2820 2xek.exe 2xek.exe PID 2268 wrote to memory of 568 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 3xek.exe PID 2268 wrote to memory of 568 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 3xek.exe PID 2268 wrote to memory of 568 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 3xek.exe PID 2268 wrote to memory of 568 2268 75129aa64ee308f0e0755c9a7fdb30c5.exe 3xek.exe PID 568 wrote to memory of 1208 568 3xek.exe Explorer.EXE PID 1988 wrote to memory of 2264 1988 NB4wr66jY4.exe cmd.exe PID 1988 wrote to memory of 2264 1988 NB4wr66jY4.exe cmd.exe PID 1988 wrote to memory of 2264 1988 NB4wr66jY4.exe cmd.exe PID 1988 wrote to memory of 2264 1988 NB4wr66jY4.exe cmd.exe PID 2264 wrote to memory of 1672 2264 cmd.exe tasklist.exe PID 2264 wrote to memory of 1672 2264 cmd.exe tasklist.exe
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:336
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\75129aa64ee308f0e0755c9a7fdb30c5.exe"C:\Users\Admin\AppData\Local\Temp\75129aa64ee308f0e0755c9a7fdb30c5.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\NB4wr66jY4.exeC:\Users\Admin\NB4wr66jY4.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\wonoz.exe"C:\Users\Admin\wonoz.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1672 -
C:\Users\Admin\2xek.exeC:\Users\Admin\2xek.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2576 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 1005⤵
- Loads dropped DLL
- Program crash
PID:2588 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2632 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2628 -
C:\Users\Admin\3xek.exeC:\Users\Admin\3xek.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\efb26d8c\X*0*bc*ab1ca216*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1020
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 75129aa64ee308f0e0755c9a7fdb30c5.exe3⤵
- Deletes itself
PID:1744 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:2756
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1516
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\system32\consrv.dllFilesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
\Users\Admin\3xek.exeFilesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
\Users\Admin\AppData\Local\efb26d8c\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
\Users\Admin\NB4wr66jY4.exeFilesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
\Users\Admin\wonoz.exeFilesize
224KB
MD5651d0151536c4fdf805d09cd02a93c7d
SHA18fdf9c507892b65612e3ee7d1ee071b934cf301d
SHA2568d3b65393a3ada2012281313cb4d5f90a530901a743308d5f9ba3e7554528d1a
SHA512bbf9200e14a5448b5e13dce828be86a71407cc89e00d2fa63b670c2094bc655f5d112c39c3925c661309961e137ed5fb8de6cc7fd769e9037183e1ba0aaf4dfb
-
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}Filesize
2KB
MD56d03845f1d43e10908336ba602894baa
SHA1e804767710e4c25c01705ca8290cbfc8ebe0ca0c
SHA256523ee58ceeed3abcbc59b51f745ebfdf3bff774dd9792e3be0f3aeb63e8ab324
SHA512632a2b6aed9dd21e35db28f131cf1c384eb4c553f3bbe05874ddbe6fa5fa9cbe2548033d420b057cad6d9e93b171c6baa4382194c151164ceb0fb924be29aa2b
-
memory/336-136-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/336-138-0x0000000000AF0000-0x0000000000AFB000-memory.dmpFilesize
44KB
-
memory/336-139-0x0000000000AF0000-0x0000000000AFB000-memory.dmpFilesize
44KB
-
memory/568-161-0x0000000030670000-0x00000000306C7000-memory.dmpFilesize
348KB
-
memory/568-163-0x00000000005F0000-0x00000000006F0000-memory.dmpFilesize
1024KB
-
memory/568-117-0x00000000005F0000-0x00000000006F0000-memory.dmpFilesize
1024KB
-
memory/568-116-0x0000000030670000-0x00000000306C7000-memory.dmpFilesize
348KB
-
memory/568-169-0x0000000030670000-0x00000000306C7000-memory.dmpFilesize
348KB
-
memory/1208-128-0x0000000002A20000-0x0000000002A26000-memory.dmpFilesize
24KB
-
memory/1208-170-0x0000000002A50000-0x0000000002A5B000-memory.dmpFilesize
44KB
-
memory/1208-157-0x0000000002A50000-0x0000000002A5B000-memory.dmpFilesize
44KB
-
memory/1208-147-0x0000000002A20000-0x0000000002A28000-memory.dmpFilesize
32KB
-
memory/1208-145-0x0000000002A40000-0x0000000002A4B000-memory.dmpFilesize
44KB
-
memory/1208-119-0x0000000002A20000-0x0000000002A26000-memory.dmpFilesize
24KB
-
memory/1208-121-0x0000000002A10000-0x0000000002A12000-memory.dmpFilesize
8KB
-
memory/1208-124-0x0000000002A20000-0x0000000002A26000-memory.dmpFilesize
24KB
-
memory/1988-37-0x00000000031E0000-0x0000000003C9A000-memory.dmpFilesize
10.7MB
-
memory/2072-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2576-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2576-132-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2576-42-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2576-46-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2576-54-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2576-50-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2576-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2596-53-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2596-70-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2596-57-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2596-59-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2596-62-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2628-100-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2628-101-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2628-98-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2628-95-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2628-86-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2628-90-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2628-106-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2628-83-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2632-84-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2632-155-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2632-69-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2632-67-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2632-65-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2632-87-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2632-88-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2632-74-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB