Analysis
- max time kernel
150s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
02/02/2024, 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe
- Size 468KB
- Sample240202-2w7apadahm
- SHA256 71f32e6dd42f755db98364d99f57560141e745af2854e05428ddaed2c5e643e1
- MD5 00caebdc408a5552b0fd089ef95d3d3a
- SHA1 de4eedc7581b2a9a73195359fb2b16706c4590ff
- SHA512 9b4e5cfb53ac66a71fa6a46b3f99df8753008095ef6c465545331d22a77faeddea0e9c97ebff25f26361de0e60be7b7bd5d8ddbfcaa1dd9ea09fa20ebb47c4c9
- SSDEEP 12288:A06ld0/XOW0fVb3uPjl5XthpFN2BNp/OqAo1/S:A0U0P4tDyf9PT2BN0qAS/S
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xuXKCQEP.exe - Executes dropped EXE 6 IoCs
pid Process 2284 xuXKCQEP.exe 1144 toast.exe 716 toast.exe 2672 voast.exe 2772 voast.exe 2084 woast.exe - Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /v" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /W" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /V" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /m" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /x" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /a" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /c" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /S" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /l" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /K" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /y" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /L" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /f" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /u" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /N" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /t" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /R" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /O" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /H" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /D" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /p" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /I" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /B" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /Z" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /e" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /M" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /s" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /U" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /Y" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /n" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /q" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /Q" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /J" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /z" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /E" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /o" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /A" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /g" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /d" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /b" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /j" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /r" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /P" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /F" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /h" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /G" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /i" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /w" xuXKCQEP.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /T" xuXKCQEP.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 5700 set thread context of 3676 5700 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 93 PID 1144 set thread context of 716 1144 toast.exe 96 PID 2672 set thread context of 2772 2672 voast.exe 98 PID 2772 set thread context of 3288 2772 voast.exe 99 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 716 toast.exe 716 toast.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 716 toast.exe 716 toast.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 716 toast.exe 716 toast.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 716 toast.exe 716 toast.exe 716 toast.exe 716 toast.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 716 toast.exe 716 toast.exe 716 toast.exe 716 toast.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 716 toast.exe 716 toast.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 716 toast.exe 716 toast.exe 2284 xuXKCQEP.exe 2284 xuXKCQEP.exe 716 toast.exe 716 toast.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 2284 xuXKCQEP.exe 2084 woast.exe - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 5700 wrote to memory of 3676 5700 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 93 PID 5700 wrote to memory of 3676 5700 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 93 PID 5700 wrote to memory of 3676 5700 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 93 PID 5700 wrote to memory of 3676 5700 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 93 PID 5700 wrote to memory of 3676 5700 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 93 PID 5700 wrote to memory of 3676 5700 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 93 PID 5700 wrote to memory of 3676 5700 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 93 PID 5700 wrote to memory of 3676 5700 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 93 PID 3676 wrote to memory of 2284 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 94 PID 3676 wrote to memory of 2284 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 94 PID 3676 wrote to memory of 2284 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 94 PID 3676 wrote to memory of 1144 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 95 PID 3676 wrote to memory of 1144 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 95 PID 3676 wrote to memory of 1144 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 95 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 1144 wrote to memory of 716 1144 toast.exe 96 PID 3676 wrote to memory of 2672 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 97 PID 3676 wrote to memory of 2672 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 97 PID 3676 wrote to memory of 2672 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 97 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2672 wrote to memory of 2772 2672 voast.exe 98 PID 2772 wrote to memory of 3288 2772 voast.exe 99 PID 2772 wrote to memory of 3288 2772 voast.exe 99 PID 2772 wrote to memory of 3288 2772 voast.exe 99 PID 3676 wrote to memory of 2084 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 103 PID 3676 wrote to memory of 2084 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 103 PID 3676 wrote to memory of 2084 3676 VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\VirusShare-00caebdc408a5552b0fd089ef95d3d3a.exeVirusShare-00caebdc408a5552b0fd089ef95d3d3a.exe2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\xuXKCQEP.exeC:\Users\Admin\xuXKCQEP.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2284
-
-
C:\Users\Admin\toast.exeC:\Users\Admin\toast.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\toast.exetoast.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:716
-
-
-
C:\Users\Admin\voast.exeC:\Users\Admin\voast.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\voast.exevoast.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\explorer.exe000000B0*5⤵PID:3288
-
-
-
-
C:\Users\Admin\woast.exeC:\Users\Admin\woast.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2084
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\toast.exe
- Size 152KB
- SHA256 83f8d74aa948dc8569f2f44174eb4da6e3bf0d6ef9293c8a92d882c2fda0e07c
- MD5 b6d3a09df822fcf55b889b57c5ad799e
- SHA1 dc44a91e89534819dcb18d18a42e2c0d3d3b649f
- SHA512 a7330d31a38361f41ae8385ff0541455fd098e874a29b0e8de3c92800fbe4ad2aa8a7a0374482d0e8a8db3363ca2e86c60216b9406eb306fe061bfde8086ebf1
- SSDEEP 3072:1zxiqjxOod0yce0JeHdbsRRSAsWGyoaSWaPVNeEVILLrDw:1zxi6ld0/XlwWsNkrD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\voast.exe
- Size 242KB
- SHA256 8c95e0048da1c72815701a5bb8000023b96433ad05e63e568ee28246c153ab04
- MD5 dc6332b873df679e69e099579c8bc22d
- SHA1 0341ad78eff722fae4142aa1da9e4be0116569f9
- SHA512 a6d9966765ede960b5f3929a61337d5582e40fae12cf5176dad9ec1ab608f4d73481ab1cc0ba168e162039fd3aabd75ceb16966b38999d9f71af2a5354fb7376
- SSDEEP 3072:ozxiqjxOod0yce0JeHdbsRRSAsWGyoaSWaPVNeEpIL/iVQqqf6NH5ts2kzpmzn9q:ozxi6ld0/XlwWsNGJTiHkVmzn9GUc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\woast.exe
- Size 24KB
- SHA256 1cc6a49d67f8f63801d0ffa3722f96405995e9f30958e5a368589591583932de
- MD5 f29656c436f7a25b63fe325b01a86a95
- SHA1 148fe98b4901aaf454118c89ec71f4d36bed05bc
- SHA512 d4eae9c9e02a1887ca30cd1750e73ade9d071594017e6d0d1cead2eff9c418b327752525fac130356d2454325e58ae54e24dd246784f15481ba2c01db7d097e7
- SSDEEP 192:TtOMqNq3fpjVMAn7hq5Dm2quUD94MDEZ:TtOPq3BjVMAntqx+9D94eEZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\xuXKCQEP.exe
- Size 156KB
- SHA256 5c3e9c19f2015acdfda9921a68d6822348d4f82b6b1d12d248264d1361d72ca9
- MD5 35362b609d4c80aa54977dd3c34f71a1
- SHA1 0f561d1d9aa9543d1e9f759b90f6ff6f8b18dd89
- SHA512 e96bc0bb4cea72ad7fa55af13a48e4d16c43b66238e663247db93a977d7f926241cae8a3672334cbe10ada0934401472e483d4067ace1358409068984949e9cb
- SSDEEP 3072:0zBMPJ4T2vaHfQmuKM7U6L9sxsHrl3B0mhQjUqvGlxE5j4oQP:qBy4Sva/QVK+SxsHrl3B0mhPq+cd
- MD5 SHA1 SHA512 SSDEEP