Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 18:27
Behavioral task
behavioral1
Sample
8d0a42410cef8bb15fd372a3676ac3d4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8d0a42410cef8bb15fd372a3676ac3d4.exe
Resource
win10v2004-20231222-en
General
-
Target
8d0a42410cef8bb15fd372a3676ac3d4.exe
-
Size
856KB
-
MD5
8d0a42410cef8bb15fd372a3676ac3d4
-
SHA1
40af8a948e2bd9845e511842b631fbd1858fb02b
-
SHA256
747bc5eb611f174f110900d2466ee7a061f934ffb64932db2fad4af386731088
-
SHA512
da1894b627f04ad01cf3363b08fd1d7150e0fed5ba63e0aa27c51965a88f1df29292b183a71fa80f61fdd69451b6551840d301c0b2ceb13ac807af38232ded6a
-
SSDEEP
12288:cJjCWhgzbBK8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgP1PikA43xsr4Y2a6A2nChuUr
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\9b7b7593\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" HM23Yh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" soice.exe -
ModiLoader Second Stage 11 IoCs
resource yara_rule behavioral1/memory/1792-10-0x0000000000400000-0x0000000000420000-memory.dmp modiloader_stage2 behavioral1/memory/2980-13-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral1/memory/2980-14-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral1/files/0x00340000000144df-44.dat modiloader_stage2 behavioral1/memory/2808-74-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral1/files/0x00340000000144eb-76.dat modiloader_stage2 behavioral1/memory/2980-98-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral1/memory/1840-95-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral1/memory/2980-111-0x00000000002B0000-0x00000000002F4000-memory.dmp modiloader_stage2 behavioral1/memory/2980-112-0x00000000002B0000-0x00000000002F4000-memory.dmp modiloader_stage2 behavioral1/memory/2980-213-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 1956 cmd.exe -
Executes dropped EXE 12 IoCs
pid Process 2760 HM23Yh.exe 2820 soice.exe 2808 awhost.exe 1532 awhost.exe 1840 bwhost.exe 1896 bwhost.exe 500 cwhost.exe 2184 dwhost.exe 336 csrss.exe 2228 X 1100 Explorer.EXE 852 ewhost.exe -
Loads dropped DLL 18 IoCs
pid Process 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2760 HM23Yh.exe 2760 HM23Yh.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2184 dwhost.exe 2184 dwhost.exe 2184 dwhost.exe 2228 X 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe -
resource yara_rule behavioral1/memory/2980-2-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2980-3-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2980-6-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2980-12-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2980-13-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2980-14-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/1896-86-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1896-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1896-90-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2980-98-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/1896-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1896-102-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1896-101-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1896-103-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1896-171-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2980-213-0x0000000000400000-0x000000000052D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /J" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /a" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /Z" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /n" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /W" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /V" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /k" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /j" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /H" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /y" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /v" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /w" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /f" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /G" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /u" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /D" HM23Yh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /L" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /R" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /M" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /N" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /A" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /K" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /U" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /h" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /l" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /x" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /B" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /X" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /F" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /q" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /T" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /S" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /Q" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /D" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /o" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /I" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /E" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /e" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /c" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /z" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /p" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /C" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /s" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /P" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /m" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /Y" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /t" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /g" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /d" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /b" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /O" soice.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\soice = "C:\\Users\\Admin\\soice.exe /r" soice.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum awhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 awhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum bwhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 bwhost.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1792 set thread context of 2980 1792 8d0a42410cef8bb15fd372a3676ac3d4.exe 28 PID 2808 set thread context of 1532 2808 awhost.exe 36 PID 1840 set thread context of 1896 1840 bwhost.exe 38 PID 2184 set thread context of 2320 2184 dwhost.exe 43 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2548 tasklist.exe 2892 tasklist.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \registry\machine\Software\Classes\Interface\{1a74ef5b-e0c8-3427-8f23-6f47e43457d2} explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1a74ef5b-e0c8-3427-8f23-6f47e43457d2}\u = "860049491" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1a74ef5b-e0c8-3427-8f23-6f47e43457d2}\cid = "3089948495662539957" explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2760 HM23Yh.exe 2760 HM23Yh.exe 2820 soice.exe 2820 soice.exe 1532 awhost.exe 2820 soice.exe 1532 awhost.exe 1532 awhost.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 1896 bwhost.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 1332 explorer.exe 1332 explorer.exe 1332 explorer.exe 2228 X 1532 awhost.exe 1532 awhost.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 1532 awhost.exe 1532 awhost.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 1532 awhost.exe 1532 awhost.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 1532 awhost.exe 1532 awhost.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 1532 awhost.exe 1532 awhost.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe 2820 soice.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2548 tasklist.exe Token: SeDebugPrivilege 1332 explorer.exe Token: SeDebugPrivilege 2892 tasklist.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 2760 HM23Yh.exe 2820 soice.exe 852 ewhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2980 1792 8d0a42410cef8bb15fd372a3676ac3d4.exe 28 PID 1792 wrote to memory of 2980 1792 8d0a42410cef8bb15fd372a3676ac3d4.exe 28 PID 1792 wrote to memory of 2980 1792 8d0a42410cef8bb15fd372a3676ac3d4.exe 28 PID 1792 wrote to memory of 2980 1792 8d0a42410cef8bb15fd372a3676ac3d4.exe 28 PID 1792 wrote to memory of 2980 1792 8d0a42410cef8bb15fd372a3676ac3d4.exe 28 PID 1792 wrote to memory of 2980 1792 8d0a42410cef8bb15fd372a3676ac3d4.exe 28 PID 1792 wrote to memory of 2980 1792 8d0a42410cef8bb15fd372a3676ac3d4.exe 28 PID 1792 wrote to memory of 2980 1792 8d0a42410cef8bb15fd372a3676ac3d4.exe 28 PID 2980 wrote to memory of 2760 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 29 PID 2980 wrote to memory of 2760 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 29 PID 2980 wrote to memory of 2760 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 29 PID 2980 wrote to memory of 2760 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 29 PID 2760 wrote to memory of 2820 2760 HM23Yh.exe 30 PID 2760 wrote to memory of 2820 2760 HM23Yh.exe 30 PID 2760 wrote to memory of 2820 2760 HM23Yh.exe 30 PID 2760 wrote to memory of 2820 2760 HM23Yh.exe 30 PID 2760 wrote to memory of 2788 2760 HM23Yh.exe 31 PID 2760 wrote to memory of 2788 2760 HM23Yh.exe 31 PID 2760 wrote to memory of 2788 2760 HM23Yh.exe 31 PID 2760 wrote to memory of 2788 2760 HM23Yh.exe 31 PID 2788 wrote to memory of 2548 2788 cmd.exe 33 PID 2788 wrote to memory of 2548 2788 cmd.exe 33 PID 2788 wrote to memory of 2548 2788 cmd.exe 33 PID 2788 wrote to memory of 2548 2788 cmd.exe 33 PID 2980 wrote to memory of 2808 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 35 PID 2980 wrote to memory of 2808 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 35 PID 2980 wrote to memory of 2808 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 35 PID 2980 wrote to memory of 2808 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 35 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2808 wrote to memory of 1532 2808 awhost.exe 36 PID 2980 wrote to memory of 1840 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 37 PID 2980 wrote to memory of 1840 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 37 PID 2980 wrote to memory of 1840 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 37 PID 2980 wrote to memory of 1840 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 37 PID 1840 wrote to memory of 1896 1840 bwhost.exe 38 PID 1840 wrote to memory of 1896 1840 bwhost.exe 38 PID 1840 wrote to memory of 1896 1840 bwhost.exe 38 PID 1840 wrote to memory of 1896 1840 bwhost.exe 38 PID 1840 wrote to memory of 1896 1840 bwhost.exe 38 PID 1840 wrote to memory of 1896 1840 bwhost.exe 38 PID 1840 wrote to memory of 1896 1840 bwhost.exe 38 PID 1840 wrote to memory of 1896 1840 bwhost.exe 38 PID 2980 wrote to memory of 500 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 39 PID 2980 wrote to memory of 500 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 39 PID 2980 wrote to memory of 500 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 39 PID 2980 wrote to memory of 500 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 39 PID 500 wrote to memory of 1332 500 cwhost.exe 40 PID 500 wrote to memory of 1332 500 cwhost.exe 40 PID 500 wrote to memory of 1332 500 cwhost.exe 40 PID 500 wrote to memory of 1332 500 cwhost.exe 40 PID 500 wrote to memory of 1332 500 cwhost.exe 40 PID 500 wrote to memory of 1332 500 cwhost.exe 40 PID 2980 wrote to memory of 2184 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 41 PID 2980 wrote to memory of 2184 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 41 PID 2980 wrote to memory of 2184 2980 8d0a42410cef8bb15fd372a3676ac3d4.exe 41
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe"C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe8d0a42410cef8bb15fd372a3676ac3d4.exe3⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\HM23Yh.exeC:\Users\Admin\HM23Yh.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\soice.exe"C:\Users\Admin\soice.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2820
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
-
-
C:\Users\Admin\awhost.exeC:\Users\Admin\awhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\awhost.exeawhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1532
-
-
-
C:\Users\Admin\bwhost.exeC:\Users\Admin\bwhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\bwhost.exebwhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1896
-
-
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Windows\explorer.exe00000088*5⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
-
C:\Users\Admin\dwhost.exeC:\Users\Admin\dwhost.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2184 -
C:\Users\Admin\AppData\Local\9b7b7593\X193.105.154.210:805⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2228
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵PID:2320
-
-
-
C:\Users\Admin\ewhost.exeC:\Users\Admin\ewhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:852
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 8d0a42410cef8bb15fd372a3676ac3d4.exe4⤵
- Deletes itself
PID:1956 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:876
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:1560
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
PID:336
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1608
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD59f07c4a67dbf752b6e32e815c0ac7728
SHA1faef5b8f91e00af204351136aa884ce790c70c55
SHA2567ead63d0c9b4261f952aeaacd5a61a99998df9a07f3b5d770e8e7c8910b76651
SHA512280cc13e0af907b5779cfda9902dea5618eae5e844e09912f2685c7df52ce9fa15b93eb05f71e52fae30d425a6fa540b29a78210414004f4ba4fc8c87408ce4e
-
Filesize
41KB
MD5686b479b0ee164cf1744a8be359ebb7d
SHA18615e8f967276a85110b198d575982a958581a07
SHA256fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b
SHA5127ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64
-
Filesize
36KB
MD54bcd12fdaa17197a658a5113af9120ec
SHA13ac79b0b793e390cf1dea82c1754ec34aab1ea46
SHA256e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96
SHA512dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd
-
Filesize
52KB
MD5c7570a7e24b29ee04a48c2c99da2587b
SHA1b6e3635a8de44b1635e8d362ac131e14281feb24
SHA256717cd7661c09701ee39c505d8b604ea3dd6c1151ef18e7ed1cab3832552ac34b
SHA51257479d2f5386ace8cc5e5ed543e6ad2c2b7b58accc849807d804a8cf0d03080f328f7b42442422fa1483a01ad473ca302f9eca97b9eb24e699e22db56641c572
-
Filesize
2KB
MD5a47ef07c79e7afc3fa7f2d111b89d04e
SHA129afc89ed82340e258f9e963554095ce98642291
SHA256ff7320b34a0247a4bb3cf5e9298ecdabe4d8f9b407793aab0f0cc0279b7b9815
SHA5129f0f3f5cc512c95f975f85d163ac621613990ffc3a71ede9907791bfad414745e1f9c0f6819b18a306e42f78802d8501383cf8fbde24535bdaaf9eaa363b1889
-
Filesize
224KB
MD5b9204dce58a6e81de3b3306eb6cb03e5
SHA1ceb777de961f82c42b9b71dca67b8e56a31908a3
SHA256438f71f74c972c3ed35a21bbc93cbc8dd1fb3cf17fd789ae730e60e53816b472
SHA512f555f397416efd33bf9591dd08ad27a4dfed1d26cbfb9d73dc4c3ae130da8ce254d4bfc1e70406f3c92565d28e045469b3ba3b172bd5d19c5876708bb1aa37ed
-
Filesize
270KB
MD55efdb148d618a6b6d2369fccd60f4212
SHA17e2045b55c33af87848088738215af2bf7ad0b9b
SHA256db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b
SHA512e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21
-
Filesize
157KB
MD52dd258fd2e5a7fccd81b8af93c08780b
SHA1a5373acdb7f4684b032954e9e754593ddcc827b2
SHA25600d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9
SHA51220048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df
-
Filesize
150KB
MD5d91ada984db5e7adbf2b80c2284c12f6
SHA131e9b27095ac041687b016006f41ea6e5222202d
SHA2568cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948
SHA5128a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748
-
Filesize
333KB
MD51aceb282a6d05fcc08f3f74f5483bf0a
SHA1778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b
SHA256d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d
SHA5125f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8
-
Filesize
224KB
MD5c8605857dbc3c225c771854d42e5eab2
SHA109222141916e074b9a062d5940191297b57e1016
SHA2562f3d9f1e17b1afe3db1edb08f29f2869cff5296395edff2ea34cf5494857f60c
SHA512c01a9a3cb230202bbd3a3ab33d5214aa72a5562c5794395404d4af4003c4c7c217cd0b0d3ad0f40176aa142f6dfabb9f7f4cde0ed762a6e5c79e2aa27ee40da6
-
Filesize
4KB
MD580dbc7d15fdf94f16bb4a739cd9c3f98
SHA1c0f3f20b360ce78cc153fa514e5f62c06f68feb7
SHA25620b2d1e1b5348ed92f7e2eaedba4348e446970c13c6226f34a816503aa956c91
SHA512cf8d820104ee3db4a103fb19d38267fe2f5095a29777bf3bcde95d4299360681cedd421251af92038da3f8709e68f101f7326ad9abdd087a59ca83adec87bc48
-
Filesize
5KB
MD578ab98fd9228277f2638fd93cd703016
SHA11640ee7f500074c155a5af431e9d125a4ec2cea5
SHA256e0517a9584af6cfd4f1e6d280e086b20fd576b90b32f9ddac916de03a53b766c
SHA512d98ed49a83d5b50737a674e4421cea4cbe353f80234d2d5a8df82995a0d81e9524f23919ca600afb98bc676a8f93e7c0df73c22cae9b3fc624027800ba9dcc76