Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:18
Static task
static1
Behavioral task
behavioral1
Sample
75129aa64ee308f0e0755c9a7fdb30c5.exe
Resource
win7-20231215-en
General
-
Target
75129aa64ee308f0e0755c9a7fdb30c5.exe
-
Size
556KB
-
MD5
75129aa64ee308f0e0755c9a7fdb30c5
-
SHA1
61032ff1e1186fe131bcc098513d980b6c04df0a
-
SHA256
13dd6a998bbcb295ebfbb6e82b14adfdca5a89d48448384acb26657f749f1058
-
SHA512
0a1085e251988806ecd3a8b56c48def1be56d1a2429bbe3895bc07fa7ca33c3209b472f9d46e9b368d7183215ab73d319bc874478ad1ea3d14e9fd1ffe63abb9
-
SSDEEP
12288:67Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:67L1yMgcnOds44Fp2PWUDI8
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
woudeb.exeNB4wr66jY4.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" woudeb.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" NB4wr66jY4.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
75129aa64ee308f0e0755c9a7fdb30c5.exeNB4wr66jY4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 75129aa64ee308f0e0755c9a7fdb30c5.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation NB4wr66jY4.exe -
Executes dropped EXE 10 IoCs
Processes:
NB4wr66jY4.exewoudeb.exe2xek.exe2xek.exe2xek.exe2xek.exe2xek.exe2xek.exe3xek.exeXpid process 1740 NB4wr66jY4.exe 5100 woudeb.exe 5068 2xek.exe 3096 2xek.exe 1916 2xek.exe 4896 2xek.exe 3692 2xek.exe 1164 2xek.exe 2168 3xek.exe 4396 X -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1916-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-52-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1916-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-59-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4896-57-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/4896-61-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3692-68-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/3692-65-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1164-64-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/1164-69-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/1164-70-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/1164-76-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/1916-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-92-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3692-93-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 53 IoCs
Processes:
woudeb.exeNB4wr66jY4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /h" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /O" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /W" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /e" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /F" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /i" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /d" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /w" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /a" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /D" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /c" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /C" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /Y" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /M" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /E" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /H" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /g" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /q" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /n" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /u" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /R" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /k" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /J" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /l" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /S" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /A" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /r" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /X" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /B" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /t" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /K" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /I" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /p" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /z" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /N" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /V" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /P" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /Q" NB4wr66jY4.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /j" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /Z" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /Q" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /G" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /T" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /f" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /v" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /s" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /b" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /U" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /L" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /x" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /y" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /m" woudeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudeb = "C:\\Users\\Admin\\woudeb.exe /o" woudeb.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2xek.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2xek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2xek.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
2xek.exedescription pid process target process PID 5068 set thread context of 3096 5068 2xek.exe 2xek.exe PID 5068 set thread context of 1916 5068 2xek.exe 2xek.exe PID 5068 set thread context of 4896 5068 2xek.exe 2xek.exe PID 5068 set thread context of 3692 5068 2xek.exe 2xek.exe PID 5068 set thread context of 1164 5068 2xek.exe 2xek.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4156 3096 WerFault.exe 2xek.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 1424 tasklist.exe 3136 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
NB4wr66jY4.exe2xek.exe3xek.exeXwoudeb.exepid process 1740 NB4wr66jY4.exe 1740 NB4wr66jY4.exe 1740 NB4wr66jY4.exe 1740 NB4wr66jY4.exe 1916 2xek.exe 1916 2xek.exe 2168 3xek.exe 2168 3xek.exe 4396 X 4396 X 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 1916 2xek.exe 1916 2xek.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe 5100 woudeb.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
tasklist.exe3xek.exeExplorer.EXEtasklist.exedescription pid process Token: SeDebugPrivilege 1424 tasklist.exe Token: SeDebugPrivilege 2168 3xek.exe Token: SeDebugPrivilege 2168 3xek.exe Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE Token: SeDebugPrivilege 3136 tasklist.exe Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
75129aa64ee308f0e0755c9a7fdb30c5.exeNB4wr66jY4.exewoudeb.exe2xek.exe2xek.exe2xek.exepid process 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe 1740 NB4wr66jY4.exe 5100 woudeb.exe 5068 2xek.exe 3692 2xek.exe 1164 2xek.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3408 Explorer.EXE -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
75129aa64ee308f0e0755c9a7fdb30c5.exeNB4wr66jY4.execmd.exe2xek.exe3xek.exeXcmd.exedescription pid process target process PID 1332 wrote to memory of 1740 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe NB4wr66jY4.exe PID 1332 wrote to memory of 1740 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe NB4wr66jY4.exe PID 1332 wrote to memory of 1740 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe NB4wr66jY4.exe PID 1740 wrote to memory of 5100 1740 NB4wr66jY4.exe woudeb.exe PID 1740 wrote to memory of 5100 1740 NB4wr66jY4.exe woudeb.exe PID 1740 wrote to memory of 5100 1740 NB4wr66jY4.exe woudeb.exe PID 1740 wrote to memory of 2672 1740 NB4wr66jY4.exe cmd.exe PID 1740 wrote to memory of 2672 1740 NB4wr66jY4.exe cmd.exe PID 1740 wrote to memory of 2672 1740 NB4wr66jY4.exe cmd.exe PID 1332 wrote to memory of 5068 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe 2xek.exe PID 1332 wrote to memory of 5068 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe 2xek.exe PID 1332 wrote to memory of 5068 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe 2xek.exe PID 2672 wrote to memory of 1424 2672 cmd.exe tasklist.exe PID 2672 wrote to memory of 1424 2672 cmd.exe tasklist.exe PID 2672 wrote to memory of 1424 2672 cmd.exe tasklist.exe PID 5068 wrote to memory of 3096 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3096 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3096 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3096 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1916 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1916 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1916 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1916 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1916 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1916 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1916 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1916 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 4896 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 4896 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 4896 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 4896 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 4896 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 4896 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 4896 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 4896 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3692 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3692 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3692 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3692 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3692 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3692 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3692 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 3692 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1164 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1164 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1164 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1164 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1164 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1164 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1164 5068 2xek.exe 2xek.exe PID 5068 wrote to memory of 1164 5068 2xek.exe 2xek.exe PID 1332 wrote to memory of 2168 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe 3xek.exe PID 1332 wrote to memory of 2168 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe 3xek.exe PID 1332 wrote to memory of 2168 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe 3xek.exe PID 2168 wrote to memory of 4396 2168 3xek.exe X PID 2168 wrote to memory of 4396 2168 3xek.exe X PID 4396 wrote to memory of 3408 4396 X Explorer.EXE PID 1332 wrote to memory of 2480 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe cmd.exe PID 1332 wrote to memory of 2480 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe cmd.exe PID 1332 wrote to memory of 2480 1332 75129aa64ee308f0e0755c9a7fdb30c5.exe cmd.exe PID 2480 wrote to memory of 3136 2480 cmd.exe tasklist.exe PID 2480 wrote to memory of 3136 2480 cmd.exe tasklist.exe PID 2480 wrote to memory of 3136 2480 cmd.exe tasklist.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\75129aa64ee308f0e0755c9a7fdb30c5.exe"C:\Users\Admin\AppData\Local\Temp\75129aa64ee308f0e0755c9a7fdb30c5.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\NB4wr66jY4.exeC:\Users\Admin\NB4wr66jY4.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\woudeb.exe"C:\Users\Admin\woudeb.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5100 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1424 -
C:\Users\Admin\2xek.exeC:\Users\Admin\2xek.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 805⤵
- Program crash
PID:4156 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1916 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3692 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1164 -
C:\Users\Admin\3xek.exeC:\Users\Admin\3xek.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\377daf6e\X*0*bc*4f3a9532*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 75129aa64ee308f0e0755c9a7fdb30c5.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3096 -ip 30961⤵PID:4292
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\3xek.exeFilesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
C:\Users\Admin\AppData\Local\377daf6e\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
C:\Users\Admin\NB4wr66jY4.exeFilesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
C:\Users\Admin\woudeb.exeFilesize
224KB
MD5d7cb4ef4bbc9d7630b79c69ef6db698a
SHA1637e17876afa6f3d7698060b0120874d23e27b27
SHA2561a558f666dbe3d57a647037197b260f388e452e69050bd165e7cf6c7aac7e941
SHA512cb4be5b46da043d6d83aa3bc82bd4b63e0d223f34869cfe83a0cd250356250dd802efc2ff704aaaa07dd31cf448354f8cb0e59b912f1c104628a9e9738da6054
-
memory/1164-64-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1164-76-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1164-70-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1164-69-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1916-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1916-90-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1916-53-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1916-49-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2168-82-0x0000000030670000-0x00000000306C7000-memory.dmpFilesize
348KB
-
memory/2168-83-0x0000000000750000-0x0000000000850000-memory.dmpFilesize
1024KB
-
memory/2168-89-0x0000000030670000-0x00000000306C7000-memory.dmpFilesize
348KB
-
memory/3408-94-0x0000000002580000-0x0000000002588000-memory.dmpFilesize
32KB
-
memory/3692-65-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3692-68-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3692-59-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3692-93-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4896-57-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4896-92-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4896-52-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4896-61-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB