2a0295f5bab05005fd6e3bf733fcb5e5f153674ad01b8aaf2179e05d8580f3c7

General

Target

b7433dc4de9676276bba102f171358aa.exe
Size

403KB
MD5

b7433dc4de9676276bba102f171358aa
SHA1

9c9f39850fe3a414651bab6c81b04b4d6d1523f0
SHA256

2a0295f5bab05005fd6e3bf733fcb5e5f153674ad01b8aaf2179e05d8580f3c7
SHA512

64a8e82899891fc809bf68c0c0a6f6d45e8b0dcba2445b77da2b2bc40895b48431aa8572096589450d48a2272200c4b17c0bc9539f5feaa46503cbfd3482b218
SSDEEP

6144:tBZn9oaRZ0RDG1NQv0Q/ldddHBDcuydIe/vgPux34toGwKMTMjexpnr90T:RlRZrNQv13ddH1crdrRxt4MgqrnyT

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

b7433dc4de9676276bba102f171358aa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \\bG02401AnHmA02401\\bG02401AnHmA02401.exe"	b7433dc4de9676276bba102f171358aa.exe

Deletes itself 1 IoCs

Processes:

bG02401AnHmA02401.exe

pid process

5008 bG02401AnHmA02401.exe
Executes dropped EXE 1 IoCs

Processes:

bG02401AnHmA02401.exe

pid process

5008 bG02401AnHmA02401.exe

pid	process
5008	bG02401AnHmA02401.exe

pid	process
5008	bG02401AnHmA02401.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1304-1-0x0000000000400000-0x00000000004CC000-memory.dmp	upx
behavioral2/memory/1304-81-0x0000000000400000-0x00000000004CC000-memory.dmp	upx
behavioral2/memory/1304-94-0x0000000000400000-0x00000000004CC000-memory.dmp	upx
behavioral2/memory/5008-95-0x0000000000400000-0x00000000004CC000-memory.dmp	upx
behavioral2/memory/5008-178-0x0000000000400000-0x00000000004CC000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bG02401AnHmA02401.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bG02401AnHmA02401 = "C:\\bG02401AnHmA02401\\bG02401AnHmA02401.exe"	bG02401AnHmA02401.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2644 1304 WerFault.exe b7433dc4de9676276bba102f171358aa.exe
4040 5008 WerFault.exe bG02401AnHmA02401.exe

pid	pid_target	process	target process
2644	1304	WerFault.exe	b7433dc4de9676276bba102f171358aa.exe
4040	5008	WerFault.exe	bG02401AnHmA02401.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

OfficeClickToRun.exeOfficeClickToRun.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,940 15,943 10,944 50,940 6,1329 15,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "7202265,41816131,39965824,7153487,17110988,5804129,7202269,17110992,41484365,24262478,9179409,17962391,508368333,17962392,25036127,24262477,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110988,7153487,39965824,41816131,7202265,5804129,17110992,7202269,41484365,24262478,9179409,17962391,508368333,17962392,25036127,24262477,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b7433dc4de9676276bba102f171358aa.exe

pid	process
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe
1304	b7433dc4de9676276bba102f171358aa.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b7433dc4de9676276bba102f171358aa.exebG02401AnHmA02401.exe

description pid process

Token: SeDebugPrivilege 1304 b7433dc4de9676276bba102f171358aa.exe
Token: SeDebugPrivilege 5008 bG02401AnHmA02401.exe

description	pid	process
Token: SeDebugPrivilege	1304	b7433dc4de9676276bba102f171358aa.exe
Token: SeDebugPrivilege	5008	bG02401AnHmA02401.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

sihost.exesihost.exesihost.exesihost.exebG02401AnHmA02401.exe

pid	process
5044	sihost.exe
2892	sihost.exe
2604	sihost.exe
1116	sihost.exe
5008	bG02401AnHmA02401.exe
5008	bG02401AnHmA02401.exe
5008	bG02401AnHmA02401.exe
5008	bG02401AnHmA02401.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

OfficeClickToRun.exeOfficeClickToRun.exe

pid process

3576 OfficeClickToRun.exe
1748 OfficeClickToRun.exe

pid	process
3576	OfficeClickToRun.exe
1748	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b7433dc4de9676276bba102f171358aa.exe

description	pid	process	target process
PID 1304 wrote to memory of 5008	1304	b7433dc4de9676276bba102f171358aa.exe	bG02401AnHmA02401.exe
PID 1304 wrote to memory of 5008	1304	b7433dc4de9676276bba102f171358aa.exe	bG02401AnHmA02401.exe
PID 1304 wrote to memory of 5008	1304	b7433dc4de9676276bba102f171358aa.exe	bG02401AnHmA02401.exe

C:\Users\Admin\AppData\Local\Temp\b7433dc4de9676276bba102f171358aa.exe
"C:\Users\Admin\AppData\Local\Temp\b7433dc4de9676276bba102f171358aa.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 840
2⤵
- Program crash
PID:2644

C:\bG02401AnHmA02401\bG02401AnHmA02401.exe
"\bG02401AnHmA02401\bG02401AnHmA02401.exe" "C:\Users\Admin\AppData\Local\Temp\b7433dc4de9676276bba102f171358aa.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 840
3⤵
- Program crash
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1304 -ip 1304
1⤵
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:8
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5008 -ip 5008
1⤵
PID:4760

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3576

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:5044

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:2892

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4380

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1748

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:2604

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:1116

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\bG02401AnHmA02401\bG02401AnHmA02401.exe
Filesize
403KB

MD5
ef4253e4e5f02525c366ed9ffdcd8ad2

SHA1
e7a3115d7e8b53c066627b0e8a94a4852b41a55f

SHA256
13d78282302efbd787ebe0b508915862a9e0e51f2e6fa93acf6bc70da365f2c9

SHA512
78414311fa645f823e20281ebe879aca7a612157b330c7fe003599fed2a778f07dcb10b2906ffea95ddc3739db36ed0ba912746f83d92e712cc2187a68b40157

Download Submit
memory/1304-0-0x00000000006A0000-0x00000000006A3000-memory.dmp

Filesize
12KB

Download
memory/1304-1-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1304-2-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1304-81-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1304-94-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5008-95-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5008-96-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/5008-178-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads