Analysis
- max time kernel
598s - max time network
605s - platform
windows10-1703_x64 - resource
win10-20240319-en - resource tags
arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system - submitted
09/04/2024, 13:10
Behavioral task
behavioral1
Sample
23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
600 seconds
Behavioral task
behavioral2
Sample
23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe
Resource
win10-20240319-en
windows10-1703-x64
14 signatures
600 seconds
Behavioral task
behavioral3
Sample
23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
600 seconds
Behavioral task
behavioral4
Sample
23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe
Resource
win11-20240221-en
windows11-21h2-x64
14 signatures
600 seconds
General
- Target 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe
- Size 5.2MB
- Sample240409-qegg6aba8y
- SHA256 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa
- MD5 0bff2eb7cf8fbbf17ff6594b09101e3b
- SHA1 bfa77a5afa5d45aa178edc14361ca2a5825c96f5
- SHA512 0861b861e3579ea7867515cea737f811b28bdc689fe24a8e89d1cd9c47d621eb76488a444406d604e0ac860d5f4a8ec73d931828d4281372ad7827af61e73f13
- SSDEEP 98304:3mcwWGj36qlPEo+AiJGIvKL10DGXPXbgkIjqNFHBAMSEFkU9WFn5fG2iD8ND3+P:2BP7lPEo+Phu3LjIjqjHBqEFPEF579Nr
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- BitRAT payload 1 IoCs
resource yara_rule behavioral2/memory/4056-67-0x0000000000400000-0x0000000000D54000-memory.dmp family_bitrat - ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000700000001ac27-15.dat acprotect behavioral2/files/0x000700000001ac29-17.dat acprotect behavioral2/files/0x000700000001ac2a-24.dat acprotect behavioral2/files/0x000700000001ac2d-21.dat acprotect behavioral2/files/0x000700000001ac2b-25.dat acprotect behavioral2/files/0x000700000001ac28-28.dat acprotect behavioral2/files/0x000800000001ac24-20.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 4464 javaupdate.exe - Loads dropped DLL 8 IoCs
pid Process 4464 javaupdate.exe 4464 javaupdate.exe 4464 javaupdate.exe 4464 javaupdate.exe 4464 javaupdate.exe 4464 javaupdate.exe 4464 javaupdate.exe 4464 javaupdate.exe -
resource yara_rule behavioral2/memory/4056-0-0x0000000000400000-0x0000000000D54000-memory.dmp upx behavioral2/files/0x000700000001ac2c-13.dat upx behavioral2/files/0x000700000001ac27-15.dat upx behavioral2/memory/4464-19-0x00000000010F0000-0x00000000014F4000-memory.dmp upx behavioral2/files/0x000700000001ac29-17.dat upx behavioral2/files/0x000700000001ac2a-24.dat upx behavioral2/files/0x000700000001ac2d-21.dat upx behavioral2/files/0x000700000001ac2b-25.dat upx behavioral2/files/0x000700000001ac28-28.dat upx behavioral2/files/0x000800000001ac24-20.dat upx behavioral2/memory/4464-31-0x00000000736A0000-0x0000000073768000-memory.dmp upx behavioral2/memory/4464-32-0x00000000735D0000-0x000000007369E000-memory.dmp upx behavioral2/memory/4464-33-0x0000000073580000-0x00000000735C9000-memory.dmp upx behavioral2/memory/4464-34-0x0000000074170000-0x0000000074194000-memory.dmp upx behavioral2/memory/4464-35-0x00000000734F0000-0x0000000073578000-memory.dmp upx behavioral2/memory/4464-36-0x00000000733E0000-0x00000000734EA000-memory.dmp upx behavioral2/memory/4464-41-0x0000000073110000-0x00000000733DF000-memory.dmp upx behavioral2/memory/4464-51-0x00000000010F0000-0x00000000014F4000-memory.dmp upx behavioral2/memory/4464-52-0x00000000736A0000-0x0000000073768000-memory.dmp upx behavioral2/memory/4464-53-0x00000000735D0000-0x000000007369E000-memory.dmp upx behavioral2/memory/4464-58-0x0000000073110000-0x00000000733DF000-memory.dmp upx behavioral2/memory/4056-67-0x0000000000400000-0x0000000000D54000-memory.dmp upx behavioral2/memory/4464-68-0x00000000010F0000-0x00000000014F4000-memory.dmp upx behavioral2/memory/4464-76-0x00000000010F0000-0x00000000014F4000-memory.dmp upx behavioral2/memory/4464-86-0x00000000010F0000-0x00000000014F4000-memory.dmp upx behavioral2/memory/4464-100-0x00000000010F0000-0x00000000014F4000-memory.dmp upx behavioral2/memory/4464-108-0x00000000010F0000-0x00000000014F4000-memory.dmp upx behavioral2/memory/4464-117-0x00000000010F0000-0x00000000014F4000-memory.dmp upx behavioral2/memory/4464-126-0x00000000010F0000-0x00000000014F4000-memory.dmp upx behavioral2/memory/4464-148-0x00000000010F0000-0x00000000014F4000-memory.dmp upx - Adds Run key to start application 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe鰀" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exeༀ" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe가" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe\uff00" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe\u0600" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exeᴀ" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exeⴀ" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe娀" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe\uef00" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exeԀ" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe豈" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe퀀" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe케" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exeⰀ" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe㴀" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe\uf200" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe밀" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe尀" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe耀" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe䠀" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\avast = "C:\\Users\\Admin\\AppData\\Local\\avast\\avast.exe관" 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe - Looks up external IP address via web service 37 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 48 myexternalip.com 51 myexternalip.com 61 myexternalip.com 71 myexternalip.com 81 myexternalip.com 85 myexternalip.com 91 myexternalip.com 20 myexternalip.com 68 myexternalip.com 82 myexternalip.com 87 myexternalip.com 97 myexternalip.com 57 myexternalip.com 94 myexternalip.com 74 myexternalip.com 90 myexternalip.com 93 myexternalip.com 34 myexternalip.com 62 myexternalip.com 65 myexternalip.com 78 myexternalip.com 88 myexternalip.com 52 myexternalip.com 58 myexternalip.com 70 myexternalip.com 84 myexternalip.com 49 myexternalip.com 67 myexternalip.com 73 myexternalip.com 35 myexternalip.com 30 myexternalip.com 42 myexternalip.com 43 myexternalip.com 64 myexternalip.com 79 myexternalip.com 96 myexternalip.com 21 myexternalip.com - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: RenamesItself 64 IoCs
pid Process 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4056 wrote to memory of 4464 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 72 PID 4056 wrote to memory of 4464 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 72 PID 4056 wrote to memory of 4464 4056 23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe"C:\Users\Admin\AppData\Local\Temp\23ac6a9a61ddc568b82e23d19873e1756be1450cd9989f698be3d18f083f24aa.bin.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\e0c93a5e\tor\javaupdate.exe"C:\Users\Admin\AppData\Local\e0c93a5e\tor\javaupdate.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\e0c93a5e\tor\data\cached-microdesc-consensus.tmp
- Size 2.6MB
- SHA256 92194ab28bfdbdf322a7cb1b230a53a0cb8b47b26045f58d1e8f39e3f9014b1f
- MD5 349ba90d9fc990e83a8337f88981789d
- SHA1 dd9ef501b29e280f93b7ef4e24e59a2e9ffa5e54
- SHA512 13a47acda39c6a6dbf69a651467301f1f13de4c96a64a26f9d9b9d4222329e84a51af4f36cfaf85932ea6a6eba74f3833455a848064f1089124ce2efe48097ba
- SSDEEP 12288:jPREp2ngbhl5e2qpWujT07nK2qiL6suVSEgOz3gq6yTtBb6fzugc:j2FX5VCg7epBztnT3zgc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\e0c93a5e\tor\data\cached-microdescs.new
- Size 9.8MB
- SHA256 1a0d42cb452b4218daefcc9d7e2fc875d46345ab5aa7b158133be5a7de6234f7
- MD5 10b9710707559f1761ee5d2a238224f6
- SHA1 7ab123aa07122efd7836220e72b849ef3d48c36d
- SHA512 98b59861b478f4cca1af6771c488ef954681e6089433186553bf34ccf6ffee61f71875c7b9d5c5bbfb89851eb54cb39369f27f0ce435a88f56b191b11d2ded4a
- SSDEEP 24576:iRGk8GR06G8xQyiAGBwosc6a2QzHQp01mThB6qjObZTqAlNTHB7Gi0K5qGPgB5UI:Ups3ILi7XFSf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\e0c93a5e\tor\javaupdate.exe
- Size 973KB
- SHA256 f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
- MD5 5cfe61ff895c7daa889708665ef05d7b
- SHA1 5e58efe30406243fbd58d4968b0492ddeef145f2
- SHA512 43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
- SSDEEP 24576:V82yLnYQN5FlyjIJO1UPrb6uFeCyL145gYaw0ZfbFeRkCrqKEV5D:VvuYQNPlNJxOuF1730ZfbUkr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\e0c93a5e\tor\libcrypto-1_1.dll
- Size 1.7MB
- SHA256 c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
- MD5 2384a02c4a1f7ec481adde3a020607d3
- SHA1 7e848d35a10bf9296c8fa41956a3daa777f86365
- SHA512 1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
- SSDEEP 49152:uKyA6xLkn84KAFa0ROvosyG/iRO1CPwDv3uFZjhUg2EeJUO9WLQ0u:u86xwnhKAFhovosyo31CPwDv3uFZjhUh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\e0c93a5e\tor\libssl-1_1.dll
- Size 439KB
- SHA256 c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
- MD5 c88826ac4bb879622e43ead5bdb95aeb
- SHA1 87d29853649a86f0463bfd9ad887b85eedc21723
- SHA512 f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
- SSDEEP 12288:15D04uko/Sxg3MWFccpVpfVmy3ocIdNyxtw3iFFrS6XL:8fkeh33FccpVp9jxtw3iFFrS6XL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\e0c93a5e\tor\libwinpthread-1.dll
- Size 188KB
- SHA256 92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
- MD5 d407cc6d79a08039a6f4b50539e560b8
- SHA1 21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
- SHA512 378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
- SSDEEP 3072:Vb2IhqYh6ZwXqIXsJHAFXkwbtotutg+UISEyZ0ENrbhESggAEim3YnsVwTivFo:3iIqI+HAvbtjtplhyT41Kim3Y0wTivFo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\e0c93a5e\tor\torrc
- Size 139B
- SHA256 58b5958bc1a62b6a4e48d5ecf9773a87ff8c23d8736d7695b13ba158a57e9bae
- MD5 b5bb1313df0efb6309cbb9e97b992636
- SHA1 ade9cd0aaf21358b4018f1c7350910442c252bae
- SHA512 e8fea7789af8ed5173461c3e40cf4af0990c0aa042bfec51b87084b09e3d6ba0130c27b6c959dc505ff3fea72b4593d12c06fbb5c453581efcdc77693d40e292
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\e0c93a5e\tor\zlib1.dll
- Size 52KB
- SHA256 8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
- MD5 add33041af894b67fe34e1dc819b7eb6
- SHA1 6db46eb021855a587c95479422adcc774a272eeb
- SHA512 bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa
- SSDEEP 768:9dfKEwqfuHtTeSgJZ+d4BlJthH1zs4/rqjc8J7RvrAsUU05Yr7QHN1/poPU:9dCjqvZ+d4Vthx/2cA7RU1Vo2NBpwU
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\e0c93a5e\tor\libevent-2-1-6.dll
- Size 366KB
- SHA256 b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
- MD5 099983c13bade9554a3c17484e5481f1
- SHA1 a84e69ad9722f999252d59d0ed9a99901a60e564
- SHA512 89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
- SSDEEP 6144:7+wL9BBhoJgaEr2Y8SIe3V8JNkN7hOXsgZzKm:7z9vwhErYaVeNkN70cgwm
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\e0c93a5e\tor\libgcc_s_sjlj-1.dll
- Size 286KB
- SHA256 2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
- MD5 b0d98f7157d972190fe0759d4368d320
- SHA1 5715a533621a2b642aad9616e603c6907d80efc4
- SHA512 41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
- SSDEEP 6144:1Tlx3jVbWfC7HVtQKCuxvYPRqAxDIoTS2:1Tb3jVb4fuJCz3
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\e0c93a5e\tor\libssp-0.dll
- Size 88KB
- SHA256 cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
- MD5 2c916456f503075f746c6ea649cf9539
- SHA1 fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
- SHA512 1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
- SSDEEP 1536:5lZ0qS+fl4CFzLCNfcnleimT+RqMGAI1SWA8yCM0NX2wu:5lzbfpChcPEM8e8yCDX2N
- MD5 SHA1 SHA512 SSDEEP