Malware Analysis Report

2024-10-23 19:49

Sample ID 240311-mm9bcsgd53
Target 411c2e3611e8ee701918cfe17399da79.exe
SHA256 f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04
Tags
chaos remcos xworm zgrat remotehost persistence ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04

Threat Level: Known bad

The file 411c2e3611e8ee701918cfe17399da79.exe was found to be: Known bad.

Malicious Activity Summary

chaos remcos xworm zgrat remotehost persistence ransomware rat spyware stealer trojan

ZGRat

Detect ZGRat V1

Chaos

Detect Xworm Payload

Xworm

Remcos

Chaos Ransomware

Renames multiple (167) files with added filename extension

Renames multiple (192) files with added filename extension

Drops startup file

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Drops desktop.ini file(s)

Adds Run key to start application

Looks up external IP address via web service

Sets desktop wallpaper using registry

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Opens file in notepad (likely ransom note)

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-11 10:36

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-11 10:36

Reported

2024-03-11 10:38

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Remcos

rat remcos

Xworm

trojan rat xworm

ZGRat

rat zgrat

Renames multiple (167) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sysupdate.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" C:\Users\Admin\AppData\Local\Temp\sysupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" C:\Users\Admin\AppData\Local\Temp\sysupdate.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" C:\ProgramData\sysupdate\sysupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" C:\ProgramData\sysupdate\sysupdate.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\411c2e3611e8ee701918cfe17399da79 = "C:\\Users\\Admin\\AppData\\Roaming\\411c2e3611e8ee701918cfe17399da79.exe" C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2h7ztgj68.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\sysupdate.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\ProgramData\sysupdate\sysupdate.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2252 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2252 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2252 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2252 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 4192 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 4192 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 4192 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 3232 wrote to memory of 3652 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3232 wrote to memory of 3652 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3232 wrote to memory of 3652 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3232 wrote to memory of 3652 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3652 wrote to memory of 1968 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 3652 wrote to memory of 1968 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 3652 wrote to memory of 1968 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 3652 wrote to memory of 1968 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 3652 wrote to memory of 3004 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\shout.exe
PID 3652 wrote to memory of 3004 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\shout.exe
PID 3004 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\shout.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 3004 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\shout.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 3316 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 3316 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe

"C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe"

C:\Users\Admin\AppData\Local\Temp\sysupdate.exe

"C:\Users\Admin\AppData\Local\Temp\sysupdate.exe"

C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe

C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe

C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe

C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe

C:\ProgramData\sysupdate\sysupdate.exe

"C:\ProgramData\sysupdate\sysupdate.exe"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Users\Admin\AppData\Local\Temp\shout.exe

"C:\Users\Admin\AppData\Local\Temp\shout.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 23.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 gamemodz.duckdns.org udp
NL 45.128.96.133:2404 gamemodz.duckdns.org tcp
NL 45.128.96.133:2404 gamemodz.duckdns.org tcp
US 8.8.8.8:53 geoplugin.net udp
US 8.8.8.8:53 133.96.128.45.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
NL 178.237.33.50:80 geoplugin.net tcp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
NL 45.128.96.133:7000 gamemodz.duckdns.org tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 140.191.110.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/2252-1-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/2252-0-0x0000000000460000-0x00000000006D6000-memory.dmp

memory/2252-2-0x0000000005090000-0x00000000052C0000-memory.dmp

memory/2252-3-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-4-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-6-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-8-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-10-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-12-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-14-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-16-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-18-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-20-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-22-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-24-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-26-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-28-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-30-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-32-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-34-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-36-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-38-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-40-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-42-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-44-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-46-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-48-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-50-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-52-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-54-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-56-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-58-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-60-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-62-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-64-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-66-0x0000000005090000-0x00000000052BA000-memory.dmp

memory/2252-3089-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/2252-4780-0x0000000005010000-0x0000000005020000-memory.dmp

memory/2252-4781-0x00000000056B0000-0x00000000056B1000-memory.dmp

memory/2252-4782-0x0000000005700000-0x0000000005778000-memory.dmp

memory/2252-4783-0x00000000058C0000-0x000000000590C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sysupdate.exe

MD5 bdfa7710dfc213d8babcd7348440deeb
SHA1 ecd7d6ad5a3e0cc8c24ce1f12a40b0c86a769f98
SHA256 79ec51c588fccbe876f58de8a0256e27de65aa14f245615c42bd92cc640063fe
SHA512 663eb74fba1e38d3f930c0d73787309f86b85852cbccae1b44d3056a6073a95494c1526dc98d132f84a71e379babc5bd6819e76643f82fcd5591e264825fb2ee

memory/2252-4792-0x0000000006710000-0x0000000006CB4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\411c2e3611e8ee701918cfe17399da79.exe.log

MD5 ef1b4e3bfd6facbbb8d6a12f5f5e32de
SHA1 8f3ef66bf86f1697c520303c78b11d58165d146f
SHA256 c652040e1a2f251b1b9e69419d6a53a91e850ea48491b3c54c2ff4a4a2907cd1
SHA512 b6329c2a18217008c5e3544313cd1c7135468c5fb45e5104b9fa2f55a1f14804e66b6b9afcaa8e813cb522f536c06dba32f3afd469c4958a7c57d7df4c0e7315

memory/4972-4800-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/4972-4798-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2252-4799-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/4972-4801-0x0000000005100000-0x000000000519C000-memory.dmp

C:\ProgramData\sysupdate\sysupdate.exe

MD5 596fc315518c02e6d8ba4928c423c144
SHA1 6877aecb595df472a9a32ece49572d5e7ad54dd4
SHA256 412358ec9fcd5f157f225ade2a4b95797e47b8e01765f62fd4069185776e42e1
SHA512 46c2662bf0ec93e552a182c40aa64ca9be49065e1570ca4253dae87649faf52af5449430b866bb677d6bc1ca2bea59baac96cebd3f4eb7df05cb128af51a43be

C:\ProgramData\sysupdate\sysupdate.exe

MD5 c9a771e4f55f9d596156d7b9faf7ba6a
SHA1 31975299025f60ba703fcae49995c243d04a0d30
SHA256 cb861974b1816e5252f279e93f649d35942e7019e9893d020d6b38f14284c45d
SHA512 1ec182e372b229f977945b4fb975cea95939b6879f677f0cb4d4843dbb93cd96ea41047bf9baab38a163e5a398cb6810bf501de9eb501494c1a2dcce9746500e

memory/3652-4838-0x0000000000620000-0x00000000006A2000-memory.dmp

memory/1968-4843-0x0000000000EC0000-0x0000000000F42000-memory.dmp

memory/4972-4849-0x00000000051A0000-0x0000000005206000-memory.dmp

memory/4972-4850-0x0000000005070000-0x0000000005080000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\shout.exe

MD5 7051dcbe9a0837a312b09a5ae3b42430
SHA1 3553ff8725a57929e438228bf141b695c13cecb4
SHA256 ce750c7054359e9e88556d48f7eea341374b74f494caed48251185b54c9ed644
SHA512 2e82160bff1fbdd6f6a9f0210dfaf831650fdefdf8e3bb70c3c2717122b107ef3610c5c5f55908843df7ba3bd3bbefc40b9d1dda07877083cbd2ab8b090a276c

memory/3004-4864-0x0000000000820000-0x000000000083C000-memory.dmp

memory/3004-4866-0x00007FFDB10B0000-0x00007FFDB1B71000-memory.dmp

memory/3316-4881-0x00007FFDB10B0000-0x00007FFDB1B71000-memory.dmp

memory/3004-4880-0x00007FFDB10B0000-0x00007FFDB1B71000-memory.dmp

C:\Users\Admin\Documents\read_it.txt

MD5 ee20a3aaf13c2d8805ede471f1f3ed3c
SHA1 bac14bc149af77885de0f6997fe3f3bf3f9686ad
SHA256 b9afbd14a42e996a8de6eba45b8a6df17a958f1b269913eab89484f62d373919
SHA512 8dea66d1bb1ee359b61fa32e3a45a1d66cf8987fdbec4218ef258b58aaaf9475e77bff2d40f9f28f4a75f321de6f86de6f42ab3cd7afee4e213ffbe3ae03f714

memory/4972-4934-0x0000000006D30000-0x0000000006DC2000-memory.dmp

memory/4972-5271-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/3652-5272-0x0000000000620000-0x00000000006A2000-memory.dmp

memory/4972-5273-0x0000000005070000-0x0000000005080000-memory.dmp

memory/3316-5274-0x00007FFDB10B0000-0x00007FFDB1B71000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-11 10:36

Reported

2024-03-11 10:38

Platform

win7-20231129-en

Max time kernel

148s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Remcos

rat remcos

Xworm

trojan rat xworm

ZGRat

rat zgrat

Renames multiple (192) files with added filename extension

ransomware

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" C:\ProgramData\sysupdate\sysupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" C:\ProgramData\sysupdate\sysupdate.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\411c2e3611e8ee701918cfe17399da79 = "C:\\Users\\Admin\\AppData\\Roaming\\411c2e3611e8ee701918cfe17399da79.exe" C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" C:\Users\Admin\AppData\Local\Temp\sysupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\"" C:\Users\Admin\AppData\Local\Temp\sysupdate.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jw4yz9rc1.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\ProgramData\sysupdate\sysupdate.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A
Token: SeRestorePrivilege N/A C:\ProgramData\sysupdate\sysupdate.exe N/A
Token: SeBackupPrivilege N/A C:\ProgramData\sysupdate\sysupdate.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\shout.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2936 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2936 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2936 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2936 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2936 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2936 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2936 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
PID 2936 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2936 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2936 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2936 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2936 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2936 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2936 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2936 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2936 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe
PID 2472 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 2472 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 2472 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 2472 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 2472 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 2472 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 2472 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\sysupdate.exe C:\ProgramData\sysupdate\sysupdate.exe
PID 1892 wrote to memory of 2328 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1892 wrote to memory of 2328 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1892 wrote to memory of 2328 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1892 wrote to memory of 2328 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1892 wrote to memory of 2328 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1892 wrote to memory of 2328 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1892 wrote to memory of 2328 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1892 wrote to memory of 2328 N/A C:\ProgramData\sysupdate\sysupdate.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2328 wrote to memory of 2320 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2328 wrote to memory of 2320 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2328 wrote to memory of 2320 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2328 wrote to memory of 2320 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2328 wrote to memory of 2320 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2328 wrote to memory of 2320 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2328 wrote to memory of 2320 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2328 wrote to memory of 2320 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2328 wrote to memory of 2780 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\shout.exe
PID 2328 wrote to memory of 2780 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\shout.exe
PID 2328 wrote to memory of 2780 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\shout.exe
PID 2328 wrote to memory of 2780 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\shout.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\shout.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\shout.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\shout.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2100 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2100 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2100 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe

"C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe"

C:\Users\Admin\AppData\Local\Temp\sysupdate.exe

"C:\Users\Admin\AppData\Local\Temp\sysupdate.exe"

C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe

C:\Users\Admin\AppData\Local\Temp\411c2e3611e8ee701918cfe17399da79.exe

C:\ProgramData\sysupdate\sysupdate.exe

"C:\ProgramData\sysupdate\sysupdate.exe"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Users\Admin\AppData\Local\Temp\shout.exe

"C:\Users\Admin\AppData\Local\Temp\shout.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 gamemodz.duckdns.org udp
NL 45.128.96.133:2404 gamemodz.duckdns.org tcp
NL 45.128.96.133:2404 gamemodz.duckdns.org tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
NL 45.128.96.133:7000 gamemodz.duckdns.org tcp

Files

memory/2936-1-0x0000000074D90000-0x000000007547E000-memory.dmp

memory/2936-0-0x0000000000CC0000-0x0000000000F36000-memory.dmp

memory/2936-2-0x0000000004A20000-0x0000000004C50000-memory.dmp

memory/2936-6-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-8-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-12-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-14-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-16-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-18-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-10-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-22-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-24-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-20-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-28-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-26-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-30-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-4-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-32-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-3-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-34-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-36-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-38-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-42-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-40-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-44-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-48-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-50-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-46-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-52-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-54-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-56-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-58-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-62-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-64-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-66-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-60-0x0000000004A20000-0x0000000004C4A000-memory.dmp

memory/2936-4779-0x0000000004580000-0x00000000045C0000-memory.dmp

memory/2936-4780-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

memory/2936-4781-0x0000000004C50000-0x0000000004CC8000-memory.dmp

memory/2936-4782-0x0000000004500000-0x000000000454C000-memory.dmp

\Users\Admin\AppData\Local\Temp\sysupdate.exe

MD5 bdfa7710dfc213d8babcd7348440deeb
SHA1 ecd7d6ad5a3e0cc8c24ce1f12a40b0c86a769f98
SHA256 79ec51c588fccbe876f58de8a0256e27de65aa14f245615c42bd92cc640063fe
SHA512 663eb74fba1e38d3f930c0d73787309f86b85852cbccae1b44d3056a6073a95494c1526dc98d132f84a71e379babc5bd6819e76643f82fcd5591e264825fb2ee

memory/2936-4807-0x0000000074D90000-0x000000007547E000-memory.dmp

memory/2920-4813-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2920-4811-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2920-4848-0x00000000004F0000-0x0000000000530000-memory.dmp

\Users\Admin\AppData\Local\Temp\shout.exe

MD5 7051dcbe9a0837a312b09a5ae3b42430
SHA1 3553ff8725a57929e438228bf141b695c13cecb4
SHA256 ce750c7054359e9e88556d48f7eea341374b74f494caed48251185b54c9ed644
SHA512 2e82160bff1fbdd6f6a9f0210dfaf831650fdefdf8e3bb70c3c2717122b107ef3610c5c5f55908843df7ba3bd3bbefc40b9d1dda07877083cbd2ab8b090a276c

memory/2780-4856-0x0000000000D40000-0x0000000000D5C000-memory.dmp

memory/2780-4857-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

memory/2780-4864-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

memory/2100-4863-0x0000000001260000-0x000000000127C000-memory.dmp

memory/2100-4865-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

memory/2100-4867-0x0000000000320000-0x00000000003A0000-memory.dmp

C:\Users\Admin\Documents\read_it.txt

MD5 ee20a3aaf13c2d8805ede471f1f3ed3c
SHA1 bac14bc149af77885de0f6997fe3f3bf3f9686ad
SHA256 b9afbd14a42e996a8de6eba45b8a6df17a958f1b269913eab89484f62d373919
SHA512 8dea66d1bb1ee359b61fa32e3a45a1d66cf8987fdbec4218ef258b58aaaf9475e77bff2d40f9f28f4a75f321de6f86de6f42ab3cd7afee4e213ffbe3ae03f714

memory/2920-5306-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2920-5307-0x00000000004F0000-0x0000000000530000-memory.dmp

memory/2100-5308-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

memory/2100-5309-0x0000000000320000-0x00000000003A0000-memory.dmp