xtremerat | 6e7c0cd4c136d2fcf86b2cd6dcee7c01115e52d7366acf250b38ae3290b615b0

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a261d05e838a359419f5dbc7651b95b8.exe
Size 280KB
Sample240224-wfqecaaa33
SHA256 6e7c0cd4c136d2fcf86b2cd6dcee7c01115e52d7366acf250b38ae3290b615b0
MD5 a261d05e838a359419f5dbc7651b95b8
SHA1 e60721c1d45391d504fbd5d60c4c662f315b282c
SHA512 ced39503e7ab396e90f5f90971066a1483ddc61c18c9cdb1106a45bac946de03642a9a3f1cf9cf628114bc5a6a894b93adf4a2aad0d16487c71c4df3e15a94aa
SSDEEP 6144:RzG8nriOnW/rGgGTVI7oMtzSokDp77d8w1Ya8B0jJynO4n:x1DYrKy7VfO2w1IE4n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

backtrack5.no-ip.info

Signatures

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/2568-42-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2568-45-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2568-46-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2568-49-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1360-51-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2568-52-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1360-54-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation	a261d05e838a359419f5dbc7651b95b8.exe

Executes dropped EXE 2 IoCs

pid	Process
3328	stub28x222.exe
2568	stub28x222.EXE

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000231f9-27.dat	upx
behavioral2/memory/3328-36-0x0000000000400000-0x000000000045A000-memory.dmp	upx
behavioral2/memory/3328-47-0x0000000000400000-0x000000000045A000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3328 set thread context of 2568	3328	stub28x222.exe	89

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\æÖÚíÇÊ ÇáÌäÓ ÇáÍÏíË.pdf	a261d05e838a359419f5dbc7651b95b8.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	a261d05e838a359419f5dbc7651b95b8.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	a261d05e838a359419f5dbc7651b95b8.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\stub28x222.exe	a261d05e838a359419f5dbc7651b95b8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3564	1360	WerFault.exe	91
1204	1360	WerFault.exe	91

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings	a261d05e838a359419f5dbc7651b95b8.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3104	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3328	stub28x222.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe
3104	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3328	228	a261d05e838a359419f5dbc7651b95b8.exe	88
PID 228 wrote to memory of 3328	228	a261d05e838a359419f5dbc7651b95b8.exe	88
PID 228 wrote to memory of 3328	228	a261d05e838a359419f5dbc7651b95b8.exe	88
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 3328 wrote to memory of 2568	3328	stub28x222.exe	89
PID 228 wrote to memory of 3104	228	a261d05e838a359419f5dbc7651b95b8.exe	90
PID 228 wrote to memory of 3104	228	a261d05e838a359419f5dbc7651b95b8.exe	90
PID 228 wrote to memory of 3104	228	a261d05e838a359419f5dbc7651b95b8.exe	90
PID 2568 wrote to memory of 1360	2568	stub28x222.EXE	91
PID 2568 wrote to memory of 1360	2568	stub28x222.EXE	91
PID 2568 wrote to memory of 1360	2568	stub28x222.EXE	91
PID 2568 wrote to memory of 1360	2568	stub28x222.EXE	91
PID 2568 wrote to memory of 4460	2568	stub28x222.EXE	93
PID 2568 wrote to memory of 4460	2568	stub28x222.EXE	93
PID 2568 wrote to memory of 4460	2568	stub28x222.EXE	93
PID 3104 wrote to memory of 2576	3104	AcroRd32.exe	102
PID 3104 wrote to memory of 2576	3104	AcroRd32.exe	102
PID 3104 wrote to memory of 2576	3104	AcroRd32.exe	102
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3216	2576	RdrCEF.exe	103

C:\Users\Admin\AppData\Local\Temp\a261d05e838a359419f5dbc7651b95b8.exe
"C:\Users\Admin\AppData\Local\Temp\a261d05e838a359419f5dbc7651b95b8.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Company\NewProduct\stub28x222.exe
  "C:\Program Files (x86)\Company\NewProduct\stub28x222.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files (x86)\Company\NewProduct\stub28x222.EXE
    "C:\Program Files (x86)\Company\NewProduct\stub28x222.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 480
        5⤵
        Program crash
        
        PID:3564
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 488
        5⤵
        Program crash
        
        PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4460
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Program Files (x86)\Company\NewProduct\æÖÚíÇÊ ÇáÌäÓ ÇáÍÏíË.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=21181219065A63329A4006F32A07D9E8 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=400A9D6208F0F28B39BD962033609C01 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=400A9D6208F0F28B39BD962033609C01 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E191C68E766B714065C3352B2D1075E8 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EF3B0F4839105288E11FB2E9DC185A65 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F306691F7CB8B08E2C16BCEE97F154B8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F306691F7CB8B08E2C16BCEE97F154B8 --renderer-client-id=6 --mojo-platform-channel-handle=2436 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EC3AB62F106D506F29CED483F99D7172 --mojo-platform-channel-handle=2784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1360 -ip 1360
1⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1360 -ip 1360
1⤵
PID:2580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

stub28x222.exe

Path C:\Program Files (x86)\Company\NewProduct\stub28x222.exe
Size 81KB
SHA256 218d1b8d4a6e51a5fcdf869538fb158795887a4e3d15eced8226d234bac410e6
MD5 99f700c92c12fda98cee10c417c7fbc9
SHA1 e37a89c471c26445f1085c37fdba086a14e142fa
SHA512 5258b9e737bd2981ac0676b93a05304f9207493be8d359375cab666b188c73e352306359df8b0840cefa234ba9fa110e6ae879fb0f0801146ed7cb481d6019e5
SSDEEP 1536:xpPIqXnrZDGb6fZtEwQYBEpRj3Tkc+AH+oQe1YmYMTWzqQb:zFZDGkZtdQhRjjkc+CT1vWb
MD5 SHA1 SHA512 SSDEEP

Submit Download

æÖÚíÇÊ ÇáÌäÓ ÇáÍÏíË.pdf

Path C:\Program Files (x86)\Company\NewProduct\æÖÚíÇÊ ÇáÌäÓ ÇáÍÏíË.pdf
Size 38KB
SHA256 dbcd732ba9eda2ace06e5e841fce206d1f81a67e2d497fc1908547c289c13ee1
MD5 b6a5bb5fe90300f258b3e2d1ec5a7429
SHA1 b04188fc41523a4e78c39a3cfcd208b4c8a80647
SHA512 2860fcbfb4cff295a62fa9beac10f8d7981aff6af9a4aa868532b8bc7a66576f0c9627f74bcb20f478b2772e221660401c65827a8af56d7068e10106fbae379e
SSDEEP 768:GbZZwJVy8cHyVO5rAyC4Sfqle7ooTC0Cy2E06V2wGrYruwBIs+ZFKxJnA+TYqU:2Qbx8NAyCP57owLCPo2Grursw9+nU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 a8fa5abf7b4d9a80ad14b9530b386969b718ed3be4fe35be28b8ec4c51d90052
MD5 7d451cec1bd568a5b25281363e569c97
SHA1 76cdd17b2c6bdfb7aa28cf84a92e3d36de1d5da2
SHA512 98cb4dab897d1f212a2707a37c7a0088113dfbe3afc233c3577c63bf648156bc78c58249bc2fb51a1c058905582bc995c25730c029c51a62bb596f880881f317
SSDEEP 384:ye2dThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:N+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-50-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1360-51-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1360-54-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2568-49-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2568-46-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2568-52-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2568-45-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2568-42-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/3104-191-0x000000000B1D0000-0x000000000B47B000-memory.dmp

Download

memory/3328-47-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/3328-36-0x0000000000400000-0x000000000045A000-memory.dmp

Download