Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 18:27
Behavioral task
behavioral1
Sample
8d0a42410cef8bb15fd372a3676ac3d4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8d0a42410cef8bb15fd372a3676ac3d4.exe
Resource
win10v2004-20231222-en
General
-
Target
8d0a42410cef8bb15fd372a3676ac3d4.exe
-
Size
856KB
-
MD5
8d0a42410cef8bb15fd372a3676ac3d4
-
SHA1
40af8a948e2bd9845e511842b631fbd1858fb02b
-
SHA256
747bc5eb611f174f110900d2466ee7a061f934ffb64932db2fad4af386731088
-
SHA512
da1894b627f04ad01cf3363b08fd1d7150e0fed5ba63e0aa27c51965a88f1df29292b183a71fa80f61fdd69451b6551840d301c0b2ceb13ac807af38232ded6a
-
SSDEEP
12288:cJjCWhgzbBK8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgP1PikA43xsr4Y2a6A2nChuUr
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zaoero.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" HM23Yh.exe -
ModiLoader Second Stage 10 IoCs
resource yara_rule behavioral2/memory/2712-4-0x0000000000400000-0x0000000000420000-memory.dmp modiloader_stage2 behavioral2/memory/1344-6-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral2/memory/1344-7-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral2/files/0x00020000000228c7-51.dat modiloader_stage2 behavioral2/files/0x00020000000228c7-59.dat modiloader_stage2 behavioral2/memory/1424-61-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/files/0x0016000000023113-64.dat modiloader_stage2 behavioral2/memory/1908-72-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/1344-74-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral2/memory/1344-127-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation HM23Yh.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 8d0a42410cef8bb15fd372a3676ac3d4.exe -
Executes dropped EXE 10 IoCs
pid Process 1248 HM23Yh.exe 816 zaoero.exe 1424 awhost.exe 3500 awhost.exe 1908 bwhost.exe 4852 bwhost.exe 4808 cwhost.exe 2404 dwhost.exe 2812 X 1576 ewhost.exe -
resource yara_rule behavioral2/memory/1344-0-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/1344-1-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/1344-5-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/1344-6-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/1344-7-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/4852-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4852-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1344-74-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/4852-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4852-73-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4852-77-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4852-103-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1344-127-0x0000000000400000-0x000000000052D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /k" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /c" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /O" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /N" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /q" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /r" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /X" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /a" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /W" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /G" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /u" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /B" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /R" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /b" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /i" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /C" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /f" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /H" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /E" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /d" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /P" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /Y" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /Z" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /A" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /z" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /g" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /J" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /n" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /K" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /x" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /y" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /F" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /Q" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /T" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /m" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /j" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /w" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /I" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /v" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /t" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /p" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /s" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /L" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /D" HM23Yh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /U" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /l" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /o" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /M" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /V" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /e" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /h" zaoero.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /D" zaoero.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum awhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 awhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum bwhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 bwhost.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2712 set thread context of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 1424 set thread context of 3500 1424 awhost.exe 103 PID 1908 set thread context of 4852 1908 bwhost.exe 105 PID 2404 set thread context of 2088 2404 dwhost.exe 111 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1180 tasklist.exe 4964 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1248 HM23Yh.exe 1248 HM23Yh.exe 1248 HM23Yh.exe 1248 HM23Yh.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 3500 awhost.exe 3500 awhost.exe 816 zaoero.exe 816 zaoero.exe 3500 awhost.exe 3500 awhost.exe 3500 awhost.exe 3500 awhost.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 4852 bwhost.exe 4852 bwhost.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 3500 awhost.exe 3500 awhost.exe 3500 awhost.exe 3500 awhost.exe 816 zaoero.exe 816 zaoero.exe 2812 X 2812 X 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 3500 awhost.exe 3500 awhost.exe 3500 awhost.exe 3500 awhost.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe 816 zaoero.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 4964 tasklist.exe Token: SeDebugPrivilege 2404 dwhost.exe Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeDebugPrivilege 1180 tasklist.exe Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 1248 HM23Yh.exe 816 zaoero.exe 1576 ewhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3428 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 2712 wrote to memory of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 2712 wrote to memory of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 2712 wrote to memory of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 2712 wrote to memory of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 2712 wrote to memory of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 2712 wrote to memory of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 2712 wrote to memory of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 2712 wrote to memory of 1344 2712 8d0a42410cef8bb15fd372a3676ac3d4.exe 93 PID 1344 wrote to memory of 1248 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 94 PID 1344 wrote to memory of 1248 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 94 PID 1344 wrote to memory of 1248 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 94 PID 1248 wrote to memory of 816 1248 HM23Yh.exe 96 PID 1248 wrote to memory of 816 1248 HM23Yh.exe 96 PID 1248 wrote to memory of 816 1248 HM23Yh.exe 96 PID 1248 wrote to memory of 3268 1248 HM23Yh.exe 97 PID 1248 wrote to memory of 3268 1248 HM23Yh.exe 97 PID 1248 wrote to memory of 3268 1248 HM23Yh.exe 97 PID 3268 wrote to memory of 4964 3268 cmd.exe 99 PID 3268 wrote to memory of 4964 3268 cmd.exe 99 PID 3268 wrote to memory of 4964 3268 cmd.exe 99 PID 1344 wrote to memory of 1424 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 100 PID 1344 wrote to memory of 1424 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 100 PID 1344 wrote to memory of 1424 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 100 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1424 wrote to memory of 3500 1424 awhost.exe 103 PID 1344 wrote to memory of 1908 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 104 PID 1344 wrote to memory of 1908 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 104 PID 1344 wrote to memory of 1908 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 104 PID 1908 wrote to memory of 4852 1908 bwhost.exe 105 PID 1908 wrote to memory of 4852 1908 bwhost.exe 105 PID 1908 wrote to memory of 4852 1908 bwhost.exe 105 PID 1908 wrote to memory of 4852 1908 bwhost.exe 105 PID 1908 wrote to memory of 4852 1908 bwhost.exe 105 PID 1908 wrote to memory of 4852 1908 bwhost.exe 105 PID 1908 wrote to memory of 4852 1908 bwhost.exe 105 PID 1908 wrote to memory of 4852 1908 bwhost.exe 105 PID 1908 wrote to memory of 4852 1908 bwhost.exe 105 PID 1344 wrote to memory of 4808 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 106 PID 1344 wrote to memory of 4808 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 106 PID 1344 wrote to memory of 4808 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 106 PID 4808 wrote to memory of 4508 4808 cwhost.exe 107 PID 4808 wrote to memory of 4508 4808 cwhost.exe 107 PID 4808 wrote to memory of 4508 4808 cwhost.exe 107 PID 4808 wrote to memory of 4508 4808 cwhost.exe 107 PID 1344 wrote to memory of 2404 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 108 PID 1344 wrote to memory of 2404 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 108 PID 1344 wrote to memory of 2404 1344 8d0a42410cef8bb15fd372a3676ac3d4.exe 108 PID 2404 wrote to memory of 2812 2404 dwhost.exe 109 PID 2404 wrote to memory of 2812 2404 dwhost.exe 109 PID 2812 wrote to memory of 3428 2812 X 61 PID 2404 wrote to memory of 2088 2404 dwhost.exe 111 PID 2404 wrote to memory of 2088 2404 dwhost.exe 111 PID 2404 wrote to memory of 2088 2404 dwhost.exe 111 PID 2404 wrote to memory of 2088 2404 dwhost.exe 111
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe"C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe8d0a42410cef8bb15fd372a3676ac3d4.exe3⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\HM23Yh.exeC:\Users\Admin\HM23Yh.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\zaoero.exe"C:\Users\Admin\zaoero.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:816
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe5⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-
-
-
C:\Users\Admin\awhost.exeC:\Users\Admin\awhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\awhost.exeawhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3500
-
-
-
C:\Users\Admin\bwhost.exeC:\Users\Admin\bwhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\bwhost.exebwhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\explorer.exe000001D8*5⤵PID:4508
-
-
-
C:\Users\Admin\dwhost.exeC:\Users\Admin\dwhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\f8310c6e\X193.105.154.210:805⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2812
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵PID:2088
-
-
-
C:\Users\Admin\ewhost.exeC:\Users\Admin\ewhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 8d0a42410cef8bb15fd372a3676ac3d4.exe4⤵PID:4576
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5686b479b0ee164cf1744a8be359ebb7d
SHA18615e8f967276a85110b198d575982a958581a07
SHA256fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b
SHA5127ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64
-
Filesize
224KB
MD5b9204dce58a6e81de3b3306eb6cb03e5
SHA1ceb777de961f82c42b9b71dca67b8e56a31908a3
SHA256438f71f74c972c3ed35a21bbc93cbc8dd1fb3cf17fd789ae730e60e53816b472
SHA512f555f397416efd33bf9591dd08ad27a4dfed1d26cbfb9d73dc4c3ae130da8ce254d4bfc1e70406f3c92565d28e045469b3ba3b172bd5d19c5876708bb1aa37ed
-
Filesize
270KB
MD55efdb148d618a6b6d2369fccd60f4212
SHA17e2045b55c33af87848088738215af2bf7ad0b9b
SHA256db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b
SHA512e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21
-
Filesize
185KB
MD5b07b737759893ad387d4f0a17eb77055
SHA1aa7b72ae3d985848e056f1f9c118dac24148bb5d
SHA25669f04e8360d20e5cd94859041ee5d76c5e01d09fd6b8ef5b71aaa7f83772d4b5
SHA51277ac990ab2605860c9ddb1d7210e3775141fd638413960ded1e7ed5a5d2061464eadfbf85cf3f2fe5d1e41a304219db453f2f46cd50229be47ea1c88156ad225
-
Filesize
157KB
MD52dd258fd2e5a7fccd81b8af93c08780b
SHA1a5373acdb7f4684b032954e9e754593ddcc827b2
SHA25600d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9
SHA51220048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df
-
Filesize
150KB
MD5d91ada984db5e7adbf2b80c2284c12f6
SHA131e9b27095ac041687b016006f41ea6e5222202d
SHA2568cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948
SHA5128a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748
-
Filesize
333KB
MD51aceb282a6d05fcc08f3f74f5483bf0a
SHA1778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b
SHA256d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d
SHA5125f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8
-
Filesize
36KB
MD54bcd12fdaa17197a658a5113af9120ec
SHA13ac79b0b793e390cf1dea82c1754ec34aab1ea46
SHA256e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96
SHA512dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd
-
Filesize
224KB
MD555ad3d3610ee9385d803247bc092fe9c
SHA12dd3f063e1508cf4527d4ace3276b21c0b5cd928
SHA256b08408af2e71b242addf461df2b4fb0c707ad7778d3abc2d966af896088ac915
SHA512f52228a6cdb0d1cf1f3994efe910b125d7f8100c46ef1bb094bd8a34808fc6d46be7352eadba1dd55b220fc2fde92fe2b76986ab0fc72a34e7eaf71db7ac426d