dd553e2f43b96763bb55b99960df399fb7f44cb02fd7d1eb82b89bc91632423e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca7e819ec3588ec3855873a92eb10528.exe
Size

468KB
MD5

ca7e819ec3588ec3855873a92eb10528
SHA1

d03a6377af778a751a520d616ceccc6caa78e777
SHA256

dd553e2f43b96763bb55b99960df399fb7f44cb02fd7d1eb82b89bc91632423e
SHA512

39686e09975f004f9a43376bee6f6337c6deb6701b479ac506b17d235114494535fb7748a530a46c4d2f4a68f2afb7fd2de7bb1d445365da51e68c510ba41ff5
SSDEEP

12288:A06ld0/XOW0AVb3uPjl5XthpFN2BNp/OqAo1/S:A0U0P40Dyf9PT2BN0qAS/S

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	xuXKCQEP.exe

Executes dropped EXE 6 IoCs

pid	Process
2360	xuXKCQEP.exe
4604	toast.exe
1044	toast.exe
4464	voast.exe
208	voast.exe
4996	woast.exe

Adds Run key to start application 2 TTPs 47 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /o"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /h"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /D"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /f"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /B"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /H"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /r"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /y"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /V"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /v"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /S"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /t"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /P"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /G"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /J"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /z"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /K"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /b"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /I"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /e"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /E"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /C"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /R"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /x"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /M"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /j"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /k"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /F"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /a"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /Z"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /i"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /X"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /q"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /Q"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /c"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /u"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /d"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /l"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /w"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /Y"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /N"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /A"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /O"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /W"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /m"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /U"	xuXKCQEP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuXKCQEP = "C:\\Users\\Admin\\xuXKCQEP.exe /s"	xuXKCQEP.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3620 set thread context of 1808	3620	ca7e819ec3588ec3855873a92eb10528.exe	103
PID 4604 set thread context of 1044	4604	toast.exe	106
PID 4464 set thread context of 208	4464	voast.exe	116
PID 208 set thread context of 624	208	voast.exe	117

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
1044	toast.exe
1044	toast.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
1044	toast.exe
1044	toast.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
1044	toast.exe
1044	toast.exe
1044	toast.exe
1044	toast.exe
1044	toast.exe
1044	toast.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
1044	toast.exe
1044	toast.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
1044	toast.exe
1044	toast.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
1044	toast.exe
1044	toast.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe
2360	xuXKCQEP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1808	ca7e819ec3588ec3855873a92eb10528.exe
2360	xuXKCQEP.exe
4996	woast.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 1808	3620	ca7e819ec3588ec3855873a92eb10528.exe	103
PID 3620 wrote to memory of 1808	3620	ca7e819ec3588ec3855873a92eb10528.exe	103
PID 3620 wrote to memory of 1808	3620	ca7e819ec3588ec3855873a92eb10528.exe	103
PID 3620 wrote to memory of 1808	3620	ca7e819ec3588ec3855873a92eb10528.exe	103
PID 3620 wrote to memory of 1808	3620	ca7e819ec3588ec3855873a92eb10528.exe	103
PID 3620 wrote to memory of 1808	3620	ca7e819ec3588ec3855873a92eb10528.exe	103
PID 3620 wrote to memory of 1808	3620	ca7e819ec3588ec3855873a92eb10528.exe	103
PID 3620 wrote to memory of 1808	3620	ca7e819ec3588ec3855873a92eb10528.exe	103
PID 1808 wrote to memory of 2360	1808	ca7e819ec3588ec3855873a92eb10528.exe	104
PID 1808 wrote to memory of 2360	1808	ca7e819ec3588ec3855873a92eb10528.exe	104
PID 1808 wrote to memory of 2360	1808	ca7e819ec3588ec3855873a92eb10528.exe	104
PID 1808 wrote to memory of 4604	1808	ca7e819ec3588ec3855873a92eb10528.exe	105
PID 1808 wrote to memory of 4604	1808	ca7e819ec3588ec3855873a92eb10528.exe	105
PID 1808 wrote to memory of 4604	1808	ca7e819ec3588ec3855873a92eb10528.exe	105
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 4604 wrote to memory of 1044	4604	toast.exe	106
PID 1808 wrote to memory of 4464	1808	ca7e819ec3588ec3855873a92eb10528.exe	107
PID 1808 wrote to memory of 4464	1808	ca7e819ec3588ec3855873a92eb10528.exe	107
PID 1808 wrote to memory of 4464	1808	ca7e819ec3588ec3855873a92eb10528.exe	107
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 4464 wrote to memory of 208	4464	voast.exe	116
PID 208 wrote to memory of 624	208	voast.exe	117
PID 208 wrote to memory of 624	208	voast.exe	117
PID 208 wrote to memory of 624	208	voast.exe	117
PID 1808 wrote to memory of 4996	1808	ca7e819ec3588ec3855873a92eb10528.exe	121
PID 1808 wrote to memory of 4996	1808	ca7e819ec3588ec3855873a92eb10528.exe	121
PID 1808 wrote to memory of 4996	1808	ca7e819ec3588ec3855873a92eb10528.exe	121

C:\Users\Admin\AppData\Local\Temp\ca7e819ec3588ec3855873a92eb10528.exe
"C:\Users\Admin\AppData\Local\Temp\ca7e819ec3588ec3855873a92eb10528.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\ca7e819ec3588ec3855873a92eb10528.exe
  ca7e819ec3588ec3855873a92eb10528.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\xuXKCQEP.exe
    C:\Users\Admin\xuXKCQEP.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2360
- - C:\Users\Admin\toast.exe
    C:\Users\Admin\toast.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Users\Admin\toast.exe
      toast.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1044
- - C:\Users\Admin\voast.exe
    C:\Users\Admin\voast.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Users\Admin\voast.exe
      voast.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Windows\explorer.exe
        
        000000CC*
        5⤵
        
        PID:624
- - C:\Users\Admin\woast.exe
    C:\Users\Admin\woast.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\toast.exe

Filesize
152KB

MD5
b6d3a09df822fcf55b889b57c5ad799e

SHA1
dc44a91e89534819dcb18d18a42e2c0d3d3b649f

SHA256
83f8d74aa948dc8569f2f44174eb4da6e3bf0d6ef9293c8a92d882c2fda0e07c

SHA512
a7330d31a38361f41ae8385ff0541455fd098e874a29b0e8de3c92800fbe4ad2aa8a7a0374482d0e8a8db3363ca2e86c60216b9406eb306fe061bfde8086ebf1

Download Submit
C:\Users\Admin\voast.exe

Filesize
242KB

MD5
dc6332b873df679e69e099579c8bc22d

SHA1
0341ad78eff722fae4142aa1da9e4be0116569f9

SHA256
8c95e0048da1c72815701a5bb8000023b96433ad05e63e568ee28246c153ab04

SHA512
a6d9966765ede960b5f3929a61337d5582e40fae12cf5176dad9ec1ab608f4d73481ab1cc0ba168e162039fd3aabd75ceb16966b38999d9f71af2a5354fb7376

Download Submit
C:\Users\Admin\woast.exe

Filesize
24KB

MD5
f29656c436f7a25b63fe325b01a86a95

SHA1
148fe98b4901aaf454118c89ec71f4d36bed05bc

SHA256
1cc6a49d67f8f63801d0ffa3722f96405995e9f30958e5a368589591583932de

SHA512
d4eae9c9e02a1887ca30cd1750e73ade9d071594017e6d0d1cead2eff9c418b327752525fac130356d2454325e58ae54e24dd246784f15481ba2c01db7d097e7

Download Submit
C:\Users\Admin\xuXKCQEP.exe

Filesize
156KB

MD5
35362b609d4c80aa54977dd3c34f71a1

SHA1
0f561d1d9aa9543d1e9f759b90f6ff6f8b18dd89

SHA256
5c3e9c19f2015acdfda9921a68d6822348d4f82b6b1d12d248264d1361d72ca9

SHA512
e96bc0bb4cea72ad7fa55af13a48e4d16c43b66238e663247db93a977d7f926241cae8a3672334cbe10ada0934401472e483d4067ace1358409068984949e9cb

Download Submit
memory/208-67-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/208-66-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/208-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/208-60-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/208-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/208-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/208-57-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/624-69-0x0000000000BD0000-0x0000000000BE5000-memory.dmp

Filesize
84KB

Download
memory/1044-26-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1044-29-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1044-36-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1044-27-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1044-35-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1044-28-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1044-30-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1808-41-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1808-13-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1808-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1808-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3620-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3620-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4464-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4464-65-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4604-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download