gh0strat | 9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240611218.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

pid	Process
5104	R.exe
3344	N.exe
1304	TXPlatfor.exe
4928	HD_9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe
3748	TXPlatfor.exe
2424	Remote Data.exe

Loads dropped DLL 3 IoCs

pid	Process
5104	R.exe
4972	svchost.exe
2424	Remote Data.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3344-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3344-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3344-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3344-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1304-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1304-30-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1304-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3344-31-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/files/0x000100000002a802-35.dat	upx
behavioral2/memory/4928-40-0x00000000001B0000-0x0000000000736000-memory.dmp	upx
behavioral2/memory/1304-39-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3748-43-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3748-46-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3748-48-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3748-51-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4928-68-0x00000000001B0000-0x0000000000736000-memory.dmp	upx
behavioral2/memory/4928-71-0x00000000001B0000-0x0000000000736000-memory.dmp	upx
behavioral2/memory/4928-76-0x00000000001B0000-0x0000000000736000-memory.dmp	upx
behavioral2/memory/4928-80-0x00000000001B0000-0x0000000000736000-memory.dmp	upx
behavioral2/memory/4928-84-0x00000000001B0000-0x0000000000736000-memory.dmp	upx
behavioral2/memory/4928-88-0x00000000001B0000-0x0000000000736000-memory.dmp	upx
behavioral2/memory/4928-92-0x00000000001B0000-0x0000000000736000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Administrator = "C:\\ProgramData\\Microsoft\\csrss.exe"	HD_9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240611218.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3116	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe
4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3748	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3344	N.exe
Token: SeLoadDriverPrivilege	3748	TXPlatfor.exe
Token: 33	3748	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	3748	TXPlatfor.exe
Token: 33	3748	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	3748	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe
4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 5104	4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe	78
PID 4364 wrote to memory of 5104	4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe	78
PID 4364 wrote to memory of 5104	4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe	78
PID 4364 wrote to memory of 3344	4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe	81
PID 4364 wrote to memory of 3344	4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe	81
PID 4364 wrote to memory of 3344	4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe	81
PID 3344 wrote to memory of 4032	3344	N.exe	83
PID 3344 wrote to memory of 4032	3344	N.exe	83
PID 3344 wrote to memory of 4032	3344	N.exe	83
PID 4364 wrote to memory of 4928	4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe	84
PID 4364 wrote to memory of 4928	4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe	84
PID 4364 wrote to memory of 4928	4364	9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe	84
PID 1304 wrote to memory of 3748	1304	TXPlatfor.exe	85
PID 1304 wrote to memory of 3748	1304	TXPlatfor.exe	85
PID 1304 wrote to memory of 3748	1304	TXPlatfor.exe	85
PID 4032 wrote to memory of 3116	4032	cmd.exe	87
PID 4032 wrote to memory of 3116	4032	cmd.exe	87
PID 4032 wrote to memory of 3116	4032	cmd.exe	87
PID 4972 wrote to memory of 2424	4972	svchost.exe	88
PID 4972 wrote to memory of 2424	4972	svchost.exe	88
PID 4972 wrote to memory of 2424	4972	svchost.exe	88

C:\Users\Admin\AppData\Local\Temp\9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe
"C:\Users\Admin\AppData\Local\Temp\9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:5104
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3116
- C:\Users\Admin\AppData\Local\Temp\HD_9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe
  C:\Users\Admin\AppData\Local\Temp\HD_9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4928

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:2456

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\Remote Data.exe
  "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240611218.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2424

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry