imminent | b44304c86c1ed108574eab57a316b72d2602e473be5fcbff69fd4c8b067eb452

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-03-2024 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8a977071676464fe8d540d72fc99acf.exe
Size

6.9MB
MD5

d8a977071676464fe8d540d72fc99acf
SHA1

0f6e3e5023469f58c190e1c8563b95de87ea65b4
SHA256

b44304c86c1ed108574eab57a316b72d2602e473be5fcbff69fd4c8b067eb452
SHA512

66ac4b77e393340efa0d6155a0da50c876c8af50d883cbc9261dd26a6894aa2db74993f62f8aa7ae49177332949025b4c6efe863d5035291c5d148ff002a8cee
SSDEEP

196608:SHEJHZ/eTq1Gftof7bIj9yHyCkZZV5v/n1rS+slCCmFK:VpPGfiUTTBc+ymY

Score

10^/10

imminent evasion spyware themida trojan upx

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d8a977071676464fe8d540d72fc99acf.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d8a977071676464fe8d540d72fc99acf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d8a977071676464fe8d540d72fc99acf.exe

Loads dropped DLL 2 IoCs

pid	Process
2080	d8a977071676464fe8d540d72fc99acf.exe
2080	d8a977071676464fe8d540d72fc99acf.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2080-0-0x0000000000400000-0x0000000000B06000-memory.dmp	themida
behavioral1/memory/2080-26-0x0000000000400000-0x0000000000B06000-memory.dmp	themida
behavioral1/memory/2080-29-0x0000000000400000-0x0000000000B06000-memory.dmp	themida
behavioral1/memory/2080-48-0x0000000000400000-0x0000000000B06000-memory.dmp	themida

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2080-14-0x0000000066000000-0x000000006618C000-memory.dmp	upx
behavioral1/memory/2080-21-0x0000000066000000-0x000000006618C000-memory.dmp	upx
behavioral1/memory/2080-25-0x0000000066000000-0x000000006618C000-memory.dmp	upx
behavioral1/memory/2080-50-0x0000000066000000-0x000000006618C000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d8a977071676464fe8d540d72fc99acf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2080	d8a977071676464fe8d540d72fc99acf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2452	schtasks.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ = "IVbeRuntimeHost"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ = "_DDataBoundAndDataSourceClass"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\ = "DataBindings"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ThreadingModel = "Apartment"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ = "_DPersistableDataSourceClass"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ = "SelectedControls"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\TypeLib\Version = "6.0"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ = "AsyncProperty"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	d8a977071676464fe8d540d72fc99acf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ = "DataMembers"	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	d8a977071676464fe8d540d72fc99acf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}	d8a977071676464fe8d540d72fc99acf.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2080	d8a977071676464fe8d540d72fc99acf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	MSBuild.exe
Token: 33	2424	MSBuild.exe
Token: SeIncBasePriorityPrivilege	2424	MSBuild.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2080	d8a977071676464fe8d540d72fc99acf.exe
2424	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2452	2080	d8a977071676464fe8d540d72fc99acf.exe	29
PID 2080 wrote to memory of 2452	2080	d8a977071676464fe8d540d72fc99acf.exe	29
PID 2080 wrote to memory of 2452	2080	d8a977071676464fe8d540d72fc99acf.exe	29
PID 2080 wrote to memory of 2452	2080	d8a977071676464fe8d540d72fc99acf.exe	29
PID 2080 wrote to memory of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31
PID 2080 wrote to memory of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31
PID 2080 wrote to memory of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31
PID 2080 wrote to memory of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31
PID 2080 wrote to memory of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31
PID 2080 wrote to memory of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31
PID 2080 wrote to memory of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31
PID 2080 wrote to memory of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31
PID 2080 wrote to memory of 2424	2080	d8a977071676464fe8d540d72fc99acf.exe	31
PID 2080 wrote to memory of 2912	2080	d8a977071676464fe8d540d72fc99acf.exe	32
PID 2080 wrote to memory of 2912	2080	d8a977071676464fe8d540d72fc99acf.exe	32
PID 2080 wrote to memory of 2912	2080	d8a977071676464fe8d540d72fc99acf.exe	32
PID 2080 wrote to memory of 2912	2080	d8a977071676464fe8d540d72fc99acf.exe	32

C:\Users\Admin\AppData\Local\Temp\d8a977071676464fe8d540d72fc99acf.exe
"C:\Users\Admin\AppData\Local\Temp\d8a977071676464fe8d540d72fc99acf.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /TN REV_3576 /TR "'wscript.exe' C:\Users\Admin\AppData\Roaming\{SWR2-FK23-IDQR-PRXQ-JDF9-6YT9}\\Silent.vbs C:\Users\Admin\AppData\Roaming\{SWR2-FK23-IDQR-PRXQ-JDF9-6YT9}\\REV_2807.cmd" /sc ONLOGON /RL HIGHEST /F
  2⤵
  - Creates scheduled task(s)
  PID:2452
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2424
- C:\Windows\SysWOW64\setx.exe
  "C:\Windows\System32\setx.exe" ProgramData "C:\ProgramData"
  2⤵
  PID:2912

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\patch\krn.dll

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\patch\ntd2.dll

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
memory/2080-23-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-51-0x0000000075F70000-0x0000000075FB7000-memory.dmp

Filesize
284KB

Download
memory/2080-4-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-5-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-6-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-8-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-0-0x0000000000400000-0x0000000000B06000-memory.dmp

Filesize
7.0MB

Download
memory/2080-7-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-10-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-11-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-13-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-14-0x0000000066000000-0x000000006618C000-memory.dmp

Filesize
1.5MB

Download
memory/2080-15-0x0000000075F70000-0x0000000075FB7000-memory.dmp

Filesize
284KB

Download
memory/2080-17-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-19-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-20-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-21-0x0000000066000000-0x000000006618C000-memory.dmp

Filesize
1.5MB

Download
memory/2080-25-0x0000000066000000-0x000000006618C000-memory.dmp

Filesize
1.5MB

Download
memory/2080-9-0x0000000075F70000-0x0000000075FB7000-memory.dmp

Filesize
284KB

Download
memory/2080-3-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-22-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-26-0x0000000000400000-0x0000000000B06000-memory.dmp

Filesize
7.0MB

Download
memory/2080-29-0x0000000000400000-0x0000000000B06000-memory.dmp

Filesize
7.0MB

Download
memory/2080-2-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-1-0x0000000075F70000-0x0000000075FB7000-memory.dmp

Filesize
284KB

Download
memory/2080-24-0x0000000076EA0000-0x0000000076EA2000-memory.dmp

Filesize
8KB

Download
memory/2080-50-0x0000000066000000-0x000000006618C000-memory.dmp

Filesize
1.5MB

Download
memory/2080-49-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-48-0x0000000000400000-0x0000000000B06000-memory.dmp

Filesize
7.0MB

Download
memory/2424-46-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/2424-47-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/2424-45-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/2424-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2424-42-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2424-40-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2424-52-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/2424-58-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/2424-59-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/2424-60-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/2424-61-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download