xtremerat | bf585c924bd41f48b5d370d73fc3c52fa5f3004c2722a918b65446d994e7d1ec

Analysis

max time kernel
30s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e124bb71f66ce8823770b0d2ad07c9a9.exe
Size

779KB
MD5

e124bb71f66ce8823770b0d2ad07c9a9
SHA1

86c93a1007da894d937d9136851dac45f3036604
SHA256

bf585c924bd41f48b5d370d73fc3c52fa5f3004c2722a918b65446d994e7d1ec
SHA512

2eb78fac81ae3de7a61b611e7c8240e85b034326a5d4665a60ce49b49d2a72cbcd6428ee0292edb52016d9d2cc31cc9027dced405cee5e8a72930a05dc072fbb
SSDEEP

12288:chkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aaiKOA0a2wi+8pJ:URmJkcoQricOIQxiZY1iaaiA0hwv8L

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 16 IoCs

resource	yara_rule
behavioral2/memory/2144-19-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2144-20-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4568-24-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2144-27-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2664-49-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2664-50-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2664-56-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2816-85-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2816-126-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1344-125-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3040-161-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/5056-180-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2252-193-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3040-178-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1736-220-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2532-227-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	e124bb71f66ce8823770b0d2ad07c9a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	e124bb71f66ce8823770b0d2ad07c9a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	e124bb71f66ce8823770b0d2ad07c9a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	Server.exe

Executes dropped EXE 32 IoCs

pid	Process
4852	Server.exe
1252	Server.exe
2664	Server.exe
3604	Server.exe
4912	Server.exe
4068	Server.exe
1620	Server.exe
1344	Server.exe
2816	Server.exe
1616	Server.exe
3512	Server.exe
2252	Server.exe
3500	Server.exe
1728	Server.exe
1340	Server.exe
4680	Server.exe
5056	Server.exe
3040	Server.exe
2380	Server.exe
1616	Server.exe
968	Server.exe
1612	Server.exe
4516	Server.exe
2816	Server.exe
4252	Server.exe
4416	Server.exe
1736	Server.exe
2532	Server.exe
2076	Server.exe
4544	Server.exe
3560	Server.exe
1344	Server.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2144-14-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2144-18-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2144-19-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2144-20-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4568-24-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2144-27-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2664-48-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2664-49-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2664-50-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2664-56-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2816-85-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2816-83-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2816-126-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1344-125-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3040-161-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/5056-180-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2252-193-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3040-178-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1736-220-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2532-227-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	e124bb71f66ce8823770b0d2ad07c9a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	e124bb71f66ce8823770b0d2ad07c9a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023218-25.dat	autoit_exe
behavioral2/files/0x0007000000023218-26.dat	autoit_exe
behavioral2/files/0x0007000000023218-114.dat	autoit_exe
behavioral2/files/0x0007000000023218-264.dat	autoit_exe

Suspicious use of SetThreadContext 23 IoCs

description	pid	Process	procid_target
PID 2560 set thread context of 3236	2560	e124bb71f66ce8823770b0d2ad07c9a9.exe	89
PID 3236 set thread context of 2144	3236	e124bb71f66ce8823770b0d2ad07c9a9.exe	90
PID 4852 set thread context of 1252	4852	Server.exe	103
PID 1252 set thread context of 2664	1252	Server.exe	104
PID 4912 set thread context of 4068	4912	Server.exe	119
PID 3604 set thread context of 1620	3604	Server.exe	118
PID 1620 set thread context of 1344	1620	Server.exe	121
PID 4068 set thread context of 2816	4068	Server.exe	122
PID 1616 set thread context of 3512	1616	Server.exe	139
PID 3512 set thread context of 2252	3512	Server.exe	140
PID 3500 set thread context of 1340	3500	Server.exe	146
PID 1728 set thread context of 4680	1728	Server.exe	147
PID 1340 set thread context of 5056	1340	Server.exe	148
PID 4680 set thread context of 3040	4680	Server.exe	149
PID 2380 set thread context of 1612	2380	Server.exe	177
PID 1616 set thread context of 2816	1616	Server.exe	179
PID 4516 set thread context of 4252	4516	Server.exe	181
PID 968 set thread context of 4416	968	Server.exe	182
PID 1612 set thread context of 1736	1612	Server.exe	183
PID 2816 set thread context of 2532	2816	Server.exe	184
PID 4416 set thread context of 2076	4416	Server.exe	185
PID 4252 set thread context of 4544	4252	Server.exe	186
PID 3560 set thread context of 1344	3560	Server.exe	213

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	e124bb71f66ce8823770b0d2ad07c9a9.exe
File created	C:\Windows\InstallDir\Server.exe	e124bb71f66ce8823770b0d2ad07c9a9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2560	e124bb71f66ce8823770b0d2ad07c9a9.exe
2560	e124bb71f66ce8823770b0d2ad07c9a9.exe
2560	e124bb71f66ce8823770b0d2ad07c9a9.exe
4852	Server.exe
4852	Server.exe
4852	Server.exe
3604	Server.exe
3604	Server.exe
4912	Server.exe
4912	Server.exe
4912	Server.exe
3604	Server.exe
1616	Server.exe
1616	Server.exe
1616	Server.exe
3500	Server.exe
3500	Server.exe
1728	Server.exe
1728	Server.exe
3500	Server.exe
1728	Server.exe
2380	Server.exe
2380	Server.exe
2380	Server.exe
1616	Server.exe
1616	Server.exe
4516	Server.exe
4516	Server.exe
968	Server.exe
968	Server.exe
1616	Server.exe
4516	Server.exe
968	Server.exe
3560	Server.exe
3560	Server.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
2560	e124bb71f66ce8823770b0d2ad07c9a9.exe
2560	e124bb71f66ce8823770b0d2ad07c9a9.exe
2560	e124bb71f66ce8823770b0d2ad07c9a9.exe
4852	Server.exe
4852	Server.exe
4852	Server.exe
3604	Server.exe
3604	Server.exe
4912	Server.exe
4912	Server.exe
4912	Server.exe
3604	Server.exe
1616	Server.exe
1616	Server.exe
1616	Server.exe
3500	Server.exe
3500	Server.exe
1728	Server.exe
1728	Server.exe
3500	Server.exe
1728	Server.exe
2380	Server.exe
2380	Server.exe
2380	Server.exe
1616	Server.exe
1616	Server.exe
4516	Server.exe
4516	Server.exe
968	Server.exe
968	Server.exe
1616	Server.exe
4516	Server.exe
968	Server.exe
3560	Server.exe
3560	Server.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3236	e124bb71f66ce8823770b0d2ad07c9a9.exe
1252	Server.exe
4068	Server.exe
1620	Server.exe
3512	Server.exe
1340	Server.exe
4680	Server.exe
1612	Server.exe
2816	Server.exe
4416	Server.exe
4252	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 3236	2560	e124bb71f66ce8823770b0d2ad07c9a9.exe	89
PID 2560 wrote to memory of 3236	2560	e124bb71f66ce8823770b0d2ad07c9a9.exe	89
PID 2560 wrote to memory of 3236	2560	e124bb71f66ce8823770b0d2ad07c9a9.exe	89
PID 2560 wrote to memory of 3236	2560	e124bb71f66ce8823770b0d2ad07c9a9.exe	89
PID 2560 wrote to memory of 3236	2560	e124bb71f66ce8823770b0d2ad07c9a9.exe	89
PID 3236 wrote to memory of 2144	3236	e124bb71f66ce8823770b0d2ad07c9a9.exe	90
PID 3236 wrote to memory of 2144	3236	e124bb71f66ce8823770b0d2ad07c9a9.exe	90
PID 3236 wrote to memory of 2144	3236	e124bb71f66ce8823770b0d2ad07c9a9.exe	90
PID 3236 wrote to memory of 2144	3236	e124bb71f66ce8823770b0d2ad07c9a9.exe	90
PID 3236 wrote to memory of 2144	3236	e124bb71f66ce8823770b0d2ad07c9a9.exe	90
PID 3236 wrote to memory of 2144	3236	e124bb71f66ce8823770b0d2ad07c9a9.exe	90
PID 3236 wrote to memory of 2144	3236	e124bb71f66ce8823770b0d2ad07c9a9.exe	90
PID 3236 wrote to memory of 2144	3236	e124bb71f66ce8823770b0d2ad07c9a9.exe	90
PID 2144 wrote to memory of 4568	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	93
PID 2144 wrote to memory of 4568	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	93
PID 2144 wrote to memory of 4568	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	93
PID 2144 wrote to memory of 4568	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	93
PID 2144 wrote to memory of 4860	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	94
PID 2144 wrote to memory of 4860	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	94
PID 2144 wrote to memory of 4860	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	94
PID 2144 wrote to memory of 2680	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	95
PID 2144 wrote to memory of 2680	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	95
PID 2144 wrote to memory of 2680	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	95
PID 2144 wrote to memory of 3080	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	96
PID 2144 wrote to memory of 3080	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	96
PID 2144 wrote to memory of 3080	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	96
PID 2144 wrote to memory of 4812	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	97
PID 2144 wrote to memory of 4812	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	97
PID 2144 wrote to memory of 4812	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	97
PID 2144 wrote to memory of 2980	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	98
PID 2144 wrote to memory of 2980	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	98
PID 2144 wrote to memory of 2980	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	98
PID 2144 wrote to memory of 1092	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	99
PID 2144 wrote to memory of 1092	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	99
PID 2144 wrote to memory of 1092	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	99
PID 2144 wrote to memory of 4448	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	100
PID 2144 wrote to memory of 4448	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	100
PID 2144 wrote to memory of 4448	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	100
PID 2144 wrote to memory of 3008	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	101
PID 2144 wrote to memory of 3008	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	101
PID 2144 wrote to memory of 4852	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	102
PID 2144 wrote to memory of 4852	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	102
PID 2144 wrote to memory of 4852	2144	e124bb71f66ce8823770b0d2ad07c9a9.exe	102
PID 4852 wrote to memory of 1252	4852	Server.exe	103
PID 4852 wrote to memory of 1252	4852	Server.exe	103
PID 4852 wrote to memory of 1252	4852	Server.exe	103
PID 4852 wrote to memory of 1252	4852	Server.exe	103
PID 4852 wrote to memory of 1252	4852	Server.exe	103
PID 1252 wrote to memory of 2664	1252	Server.exe	104
PID 1252 wrote to memory of 2664	1252	Server.exe	104
PID 1252 wrote to memory of 2664	1252	Server.exe	104
PID 1252 wrote to memory of 2664	1252	Server.exe	104
PID 1252 wrote to memory of 2664	1252	Server.exe	104
PID 1252 wrote to memory of 2664	1252	Server.exe	104
PID 1252 wrote to memory of 2664	1252	Server.exe	104
PID 1252 wrote to memory of 2664	1252	Server.exe	104
PID 2664 wrote to memory of 4652	2664	Server.exe	105
PID 2664 wrote to memory of 4652	2664	Server.exe	105
PID 2664 wrote to memory of 4652	2664	Server.exe	105
PID 2664 wrote to memory of 3892	2664	Server.exe	106
PID 2664 wrote to memory of 3892	2664	Server.exe	106
PID 2664 wrote to memory of 3892	2664	Server.exe	106
PID 2664 wrote to memory of 4464	2664	Server.exe	107
PID 2664 wrote to memory of 4464	2664	Server.exe	107

C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe
"C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe
  "C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe
    "C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      Modifies Installed Components in the registry
      Adds Run key to start application
      PID:4568
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3604
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4664
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1728
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4680
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4900
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1616
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:2380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:1616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3732
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1616
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3512
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3028
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4516
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4252
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3308
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2380
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1612
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1732
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3560
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        
        PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3008
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1252
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3960
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4912
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4068
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4644
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3500
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1340
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4036
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:968
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4416
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        15⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:3200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut5D91.tmp

Filesize
134KB

MD5
440dfc3d54ba50cb33551a8634602bd4

SHA1
541ee562011594bbb9e701ef42efabf3703a74dd

SHA256
4a2ea3e7d16f176b2fa28b9987346b27357a39fcd31f0398c35c5465daf22691

SHA512
cba333af21a6029d9a009d6eb5de608b012b9a57bff78e0404ae188c0cd61d4f6d8c4ae8424554caaac81883693e3d1101a15f745f0d8d5f7f50270f7fd7a3ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
e231aa3a824bc2656dd5c40ff89cf0fa

SHA1
de77ca52ef1f4b3a1a58d86d10c28c6450337671

SHA256
c346b0ae9b3b77df71b917d17c5578764becae7b9070420d70fa21daf5f1f2de

SHA512
9c7ef344681df07ebe2fb8f3674d3e02db50256147773cedc844fe0a13deac70d6c85385256571b461c039a6ca913bceb48d50517e520e32726953b2455484e4

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
128KB

MD5
c2888648d79cfbc8ea44e9f20bbd604f

SHA1
9694449f996a4e30f2eb43b557ed027343b5f25a

SHA256
27c4833ec00bbc023ea8913fff23fca4f32b507713dbc97e1bbc833b8b0c7631

SHA512
d987dec835a53845536d118ecf6e8e288167f0ecf88a6002ad3f03b6bb9e898d16f6622109a40d3e0e033bb1b223311979bcd68da95e2a3a7a478d9194328abc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
615KB

MD5
2061cd8e9a166b6503fc2edc9e39f453

SHA1
75adef444266d9378e1f6da324aa455d467999b1

SHA256
b3fd18b2a4eb2536e510740ab1b7f829a859ca8a64bb9cc0c642a846d45d54dd

SHA512
8cc5fd024bb1e5dc941f2cade7b331449464ceba8828608996f40e521ad0c5ee1073c5b93554021f9695aa3867437c0a0a2d0f47126c3e060a1ca5b87e064786

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
779KB

MD5
e124bb71f66ce8823770b0d2ad07c9a9

SHA1
86c93a1007da894d937d9136851dac45f3036604

SHA256
bf585c924bd41f48b5d370d73fc3c52fa5f3004c2722a918b65446d994e7d1ec

SHA512
2eb78fac81ae3de7a61b611e7c8240e85b034326a5d4665a60ce49b49d2a72cbcd6428ee0292edb52016d9d2cc31cc9027dced405cee5e8a72930a05dc072fbb

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
768KB

MD5
6d0ca1137c55557e9caffeae2bb96404

SHA1
2b45411801f18a413e96bd41ad7caa70d9f6bfc5

SHA256
7ed34f24be66eac64c10816f845af3ac7dccd1fdeacb49dde168571cd1716618

SHA512
4ae504960c31c31232313c497d940478b8bd96c9743649b534c7e71235ba79462645098a882293a1f1db393a6d6272d4932e3530d2f8bda3f1294e9b9e62154e

Download Submit
memory/1252-47-0x0000000000400000-0x0000000000422978-memory.dmp

Filesize
138KB

Download
memory/1252-46-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1252-40-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1340-157-0x0000000000400000-0x0000000000422978-memory.dmp

Filesize
138KB

Download
memory/1340-155-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1340-141-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1344-125-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/1612-226-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1620-71-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1620-89-0x0000000000400000-0x0000000000422978-memory.dmp

Filesize
138KB

Download
memory/1620-87-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1736-220-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2144-14-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2144-20-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2144-27-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2144-19-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2144-18-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2252-193-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2532-227-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2664-49-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2664-50-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2664-48-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2664-56-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2816-241-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2816-83-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2816-126-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2816-85-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/3040-178-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/3040-161-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/3236-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3236-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3236-17-0x0000000000400000-0x0000000000422978-memory.dmp

Filesize
138KB

Download
memory/3236-16-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3512-116-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3512-118-0x0000000000400000-0x0000000000422978-memory.dmp

Filesize
138KB

Download
memory/3512-110-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4068-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4068-90-0x0000000000400000-0x0000000000422978-memory.dmp

Filesize
138KB

Download
memory/4252-249-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4416-247-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4568-24-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/4680-159-0x0000000000400000-0x0000000000422978-memory.dmp

Filesize
138KB

Download
memory/4680-158-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5056-180-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads