Resubmissions
17-04-2024 14:50
240417-r7sxbsch57 1017-04-2024 14:50
240417-r7pjxach48 1017-04-2024 14:50
240417-r7nmlsec7w 1017-04-2024 14:50
240417-r7m13sch46 1017-04-2024 14:50
240417-r7mqbaec61 1015-04-2024 13:17
240415-qjtnaahe9v 1010-04-2024 12:00
240410-n6ndnsaa4w 1010-04-2024 12:00
240410-n6m3xaaa4t 1010-04-2024 12:00
240410-n6m3xaaa4s 1010-04-2024 12:00
240410-n6lvvaeh23 10Analysis
-
max time kernel
1197s -
max time network
1200s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-04-2024 14:50
Behavioral task
behavioral1
Sample
a7613e5c267e7f270918ef87fcb1e45c.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
a7613e5c267e7f270918ef87fcb1e45c.exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
a7613e5c267e7f270918ef87fcb1e45c.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
a7613e5c267e7f270918ef87fcb1e45c.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
a7613e5c267e7f270918ef87fcb1e45c.exe
Resource
win11-20240412-en
General
-
Target
a7613e5c267e7f270918ef87fcb1e45c.exe
-
Size
7.8MB
-
MD5
a7613e5c267e7f270918ef87fcb1e45c
-
SHA1
5ce965496ce1d9eea2d78548854bd486c11329d1
-
SHA256
1b9c4646b8840ef2d2a24603ffa2efa695ee29002c0057d4ba558080f2c485b6
-
SHA512
19888cf9937c44770dff47027ada8ef8eaa46cc849717ec0fb46bb32d07434b3b851efa708decd2fa18c07333cc247d35e03d71fbd386caea839bf44cdd7c0d2
-
SSDEEP
196608:LIRcbH4jSteTGvCxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:LdHsfuCxwZ6v1CPwDv3uFteg2EeJUO9E
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000100000002a9d4-17.dat acprotect behavioral1/files/0x000100000002a9d5-18.dat acprotect behavioral1/files/0x000100000002a9db-27.dat acprotect behavioral1/files/0x000100000002a9d8-24.dat acprotect behavioral1/files/0x000100000002a9d6-25.dat acprotect behavioral1/files/0x000100000002a9d9-28.dat acprotect behavioral1/files/0x000100000002a9d7-22.dat acprotect -
Executes dropped EXE 42 IoCs
pid Process 4048 windows32.exe 572 windows32.exe 5080 windows32.exe 1180 windows32.exe 1220 windows32.exe 1088 windows32.exe 644 windows32.exe 2852 windows32.exe 1724 windows32.exe 2128 windows32.exe 4200 windows32.exe 4176 windows32.exe 1660 windows32.exe 2736 windows32.exe 128 windows32.exe 4564 windows32.exe 2928 windows32.exe 4752 windows32.exe 3348 windows32.exe 4208 windows32.exe 3268 windows32.exe 4656 windows32.exe 4836 windows32.exe 1912 windows32.exe 2688 windows32.exe 1692 windows32.exe 1336 windows32.exe 936 windows32.exe 1396 windows32.exe 3628 windows32.exe 3032 windows32.exe 4272 windows32.exe 1928 windows32.exe 1984 windows32.exe 1780 windows32.exe 2124 windows32.exe 480 windows32.exe 4584 windows32.exe 4800 windows32.exe 5084 windows32.exe 3944 windows32.exe 1072 windows32.exe -
Loads dropped DLL 64 IoCs
pid Process 4048 windows32.exe 4048 windows32.exe 4048 windows32.exe 4048 windows32.exe 4048 windows32.exe 4048 windows32.exe 4048 windows32.exe 4048 windows32.exe 572 windows32.exe 572 windows32.exe 572 windows32.exe 572 windows32.exe 572 windows32.exe 572 windows32.exe 572 windows32.exe 5080 windows32.exe 5080 windows32.exe 5080 windows32.exe 5080 windows32.exe 5080 windows32.exe 5080 windows32.exe 5080 windows32.exe 1180 windows32.exe 1180 windows32.exe 1180 windows32.exe 1180 windows32.exe 1180 windows32.exe 1180 windows32.exe 1180 windows32.exe 1220 windows32.exe 1220 windows32.exe 1220 windows32.exe 1220 windows32.exe 1220 windows32.exe 1220 windows32.exe 1220 windows32.exe 1088 windows32.exe 1088 windows32.exe 1088 windows32.exe 1088 windows32.exe 1088 windows32.exe 1088 windows32.exe 1088 windows32.exe 644 windows32.exe 644 windows32.exe 644 windows32.exe 644 windows32.exe 644 windows32.exe 644 windows32.exe 644 windows32.exe 2852 windows32.exe 2852 windows32.exe 2852 windows32.exe 2852 windows32.exe 2852 windows32.exe 2852 windows32.exe 2852 windows32.exe 1724 windows32.exe 1724 windows32.exe 1724 windows32.exe 1724 windows32.exe 1724 windows32.exe 1724 windows32.exe 1724 windows32.exe -
resource yara_rule behavioral1/files/0x000100000002a9da-13.dat upx behavioral1/files/0x000100000002a9d4-17.dat upx behavioral1/files/0x000100000002a9d5-18.dat upx behavioral1/files/0x000100000002a9db-27.dat upx behavioral1/memory/4048-26-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/files/0x000100000002a9d8-24.dat upx behavioral1/files/0x000100000002a9d6-25.dat upx behavioral1/files/0x000100000002a9d9-28.dat upx behavioral1/memory/4048-34-0x0000000074020000-0x0000000074069000-memory.dmp upx behavioral1/memory/4048-35-0x0000000073FF0000-0x0000000074014000-memory.dmp upx behavioral1/memory/4048-29-0x0000000074070000-0x000000007413E000-memory.dmp upx behavioral1/files/0x000100000002a9d7-22.dat upx behavioral1/memory/4048-43-0x0000000073F60000-0x0000000073FE8000-memory.dmp upx behavioral1/memory/4048-42-0x0000000074140000-0x0000000074208000-memory.dmp upx behavioral1/memory/4048-41-0x0000000073B80000-0x0000000073E4F000-memory.dmp upx behavioral1/memory/4048-39-0x0000000073E50000-0x0000000073F5A000-memory.dmp upx behavioral1/memory/4048-53-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/4048-57-0x0000000073FF0000-0x0000000074014000-memory.dmp upx behavioral1/memory/4048-55-0x0000000074070000-0x000000007413E000-memory.dmp upx behavioral1/memory/4048-68-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/4048-69-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/4048-87-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/4048-95-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/4048-110-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/4048-118-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/4048-126-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/4048-134-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/572-159-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/4048-161-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/572-160-0x0000000073B80000-0x0000000073E4F000-memory.dmp upx behavioral1/memory/572-163-0x0000000073E50000-0x0000000073F5A000-memory.dmp upx behavioral1/memory/572-168-0x0000000073F60000-0x0000000073FE8000-memory.dmp upx behavioral1/memory/572-169-0x0000000074140000-0x0000000074208000-memory.dmp upx behavioral1/memory/572-170-0x0000000074020000-0x0000000074069000-memory.dmp upx behavioral1/memory/572-171-0x0000000073FF0000-0x0000000074014000-memory.dmp upx behavioral1/memory/572-162-0x0000000074070000-0x000000007413E000-memory.dmp upx behavioral1/memory/572-186-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/572-195-0x0000000073B80000-0x0000000073E4F000-memory.dmp upx behavioral1/memory/572-196-0x0000000074070000-0x000000007413E000-memory.dmp upx behavioral1/memory/572-236-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/5080-240-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/5080-244-0x0000000073B80000-0x0000000073E4F000-memory.dmp upx behavioral1/memory/5080-248-0x0000000074070000-0x000000007413E000-memory.dmp upx behavioral1/memory/5080-245-0x0000000074140000-0x0000000074208000-memory.dmp upx behavioral1/memory/5080-253-0x0000000073E50000-0x0000000073F5A000-memory.dmp upx behavioral1/memory/5080-251-0x0000000073FF0000-0x0000000074014000-memory.dmp upx behavioral1/memory/5080-249-0x0000000074020000-0x0000000074069000-memory.dmp upx behavioral1/memory/5080-254-0x0000000073F60000-0x0000000073FE8000-memory.dmp upx behavioral1/memory/1180-266-0x0000000073E70000-0x0000000073F38000-memory.dmp upx behavioral1/memory/1180-268-0x0000000073D50000-0x0000000073D99000-memory.dmp upx behavioral1/memory/1180-269-0x0000000073D20000-0x0000000073D44000-memory.dmp upx behavioral1/memory/1180-267-0x0000000073DA0000-0x0000000073E6E000-memory.dmp upx behavioral1/memory/1180-273-0x0000000073B80000-0x0000000073C08000-memory.dmp upx behavioral1/memory/1180-272-0x0000000073C10000-0x0000000073D1A000-memory.dmp upx behavioral1/memory/1180-274-0x0000000073F40000-0x000000007420F000-memory.dmp upx behavioral1/memory/1180-287-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/1180-296-0x0000000073E70000-0x0000000073F38000-memory.dmp upx behavioral1/memory/1180-297-0x0000000073DA0000-0x0000000073E6E000-memory.dmp upx behavioral1/memory/1180-347-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/1220-351-0x0000000000620000-0x0000000000A24000-memory.dmp upx behavioral1/memory/1220-354-0x0000000073F40000-0x000000007420F000-memory.dmp upx behavioral1/memory/1220-356-0x0000000073E70000-0x0000000073F38000-memory.dmp upx behavioral1/memory/1220-358-0x0000000073DA0000-0x0000000073E6E000-memory.dmp upx behavioral1/memory/1220-359-0x0000000073D50000-0x0000000073D99000-memory.dmp upx -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Users\\Admin\\AppData\\Local\\windir\\win32.exe" a7613e5c267e7f270918ef87fcb1e45c.exe Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Users\\Admin\\AppData\\Local\\windir\\win32.exe瘀" a7613e5c267e7f270918ef87fcb1e45c.exe Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Users\\Admin\\AppData\\Local\\windir\\win32.exe\ue800" a7613e5c267e7f270918ef87fcb1e45c.exe -
Looks up external IP address via web service 25 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 40 myexternalip.com 116 myexternalip.com 154 myexternalip.com 7 myexternalip.com 16 myexternalip.com 148 myexternalip.com 161 myexternalip.com 33 myexternalip.com 86 myexternalip.com 188 myexternalip.com 27 myexternalip.com 61 myexternalip.com 134 myexternalip.com 67 myexternalip.com 103 myexternalip.com 141 myexternalip.com 122 myexternalip.com 128 myexternalip.com 173 myexternalip.com 47 myexternalip.com 74 myexternalip.com 96 myexternalip.com 167 myexternalip.com 82 myexternalip.com 109 myexternalip.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 28 IoCs
pid Process 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1648 a7613e5c267e7f270918ef87fcb1e45c.exe -
Suspicious behavior: RenamesItself 64 IoCs
pid Process 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1648 a7613e5c267e7f270918ef87fcb1e45c.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 1648 a7613e5c267e7f270918ef87fcb1e45c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1648 wrote to memory of 4048 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 81 PID 1648 wrote to memory of 4048 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 81 PID 1648 wrote to memory of 4048 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 81 PID 1648 wrote to memory of 572 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 82 PID 1648 wrote to memory of 572 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 82 PID 1648 wrote to memory of 572 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 82 PID 1648 wrote to memory of 5080 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 83 PID 1648 wrote to memory of 5080 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 83 PID 1648 wrote to memory of 5080 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 83 PID 1648 wrote to memory of 1180 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 84 PID 1648 wrote to memory of 1180 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 84 PID 1648 wrote to memory of 1180 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 84 PID 1648 wrote to memory of 1220 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 85 PID 1648 wrote to memory of 1220 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 85 PID 1648 wrote to memory of 1220 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 85 PID 1648 wrote to memory of 1088 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 86 PID 1648 wrote to memory of 1088 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 86 PID 1648 wrote to memory of 1088 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 86 PID 1648 wrote to memory of 644 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 87 PID 1648 wrote to memory of 644 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 87 PID 1648 wrote to memory of 644 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 87 PID 1648 wrote to memory of 2852 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 88 PID 1648 wrote to memory of 2852 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 88 PID 1648 wrote to memory of 2852 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 88 PID 1648 wrote to memory of 1724 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 89 PID 1648 wrote to memory of 1724 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 89 PID 1648 wrote to memory of 1724 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 89 PID 1648 wrote to memory of 2128 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 90 PID 1648 wrote to memory of 2128 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 90 PID 1648 wrote to memory of 2128 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 90 PID 1648 wrote to memory of 4200 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 91 PID 1648 wrote to memory of 4200 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 91 PID 1648 wrote to memory of 4200 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 91 PID 1648 wrote to memory of 4176 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 92 PID 1648 wrote to memory of 4176 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 92 PID 1648 wrote to memory of 4176 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 92 PID 1648 wrote to memory of 1660 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 93 PID 1648 wrote to memory of 1660 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 93 PID 1648 wrote to memory of 1660 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 93 PID 1648 wrote to memory of 2736 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 94 PID 1648 wrote to memory of 2736 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 94 PID 1648 wrote to memory of 2736 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 94 PID 1648 wrote to memory of 128 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 95 PID 1648 wrote to memory of 128 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 95 PID 1648 wrote to memory of 128 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 95 PID 1648 wrote to memory of 4564 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 96 PID 1648 wrote to memory of 4564 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 96 PID 1648 wrote to memory of 4564 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 96 PID 1648 wrote to memory of 2928 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 97 PID 1648 wrote to memory of 2928 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 97 PID 1648 wrote to memory of 2928 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 97 PID 1648 wrote to memory of 4752 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 98 PID 1648 wrote to memory of 4752 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 98 PID 1648 wrote to memory of 4752 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 98 PID 1648 wrote to memory of 3348 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 99 PID 1648 wrote to memory of 3348 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 99 PID 1648 wrote to memory of 3348 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 99 PID 1648 wrote to memory of 4208 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 100 PID 1648 wrote to memory of 4208 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 100 PID 1648 wrote to memory of 4208 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 100 PID 1648 wrote to memory of 3268 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 101 PID 1648 wrote to memory of 3268 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 101 PID 1648 wrote to memory of 3268 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 101 PID 1648 wrote to memory of 4656 1648 a7613e5c267e7f270918ef87fcb1e45c.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7613e5c267e7f270918ef87fcb1e45c.exe"C:\Users\Admin\AppData\Local\Temp\a7613e5c267e7f270918ef87fcb1e45c.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4048
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5080
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:644
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:2128
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4200
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4176
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:1660
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:2736
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:128
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4564
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:2928
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4752
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:3348
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4208
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:3268
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4656
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4836
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:1912
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:2688
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:1692
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:1336
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:936
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:1396
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:3628
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:3032
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4272
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:1928
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:1984
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:1780
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:2124
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:480
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4584
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:4800
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:5084
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:3944
-
-
C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe"C:\Users\Admin\AppData\Local\f7cf36c6\tor\windows32.exe" -f torrc2⤵
- Executes dropped EXE
PID:1072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD58c091246de71cc03a029651f58cf150b
SHA1ef3af9a6079b2a4ed25b275ada03c3d098f16f29
SHA2560dea2dea22798347a44abb4c0d8949aa866272c01c789a2b2e0e3965ba5a719e
SHA51256abf23f1fd7033e37311b490e2e5848ffb203ee2b1e4dc7bf0752339d451423767761266b0f53a14af17e55c83b1e16abcad7f251163236b9c270cf8501adf3
-
Filesize
2.6MB
MD55d069829295a5f737eb7054d3ed24252
SHA1df6376d7de71928a3acfafdfe5f2fd8a4b452c50
SHA256e9d317432af7b2370c7df9de97a046f637237eccf1b727fca01c1b1d83b4f57e
SHA5123161e65dfe3069e272358881e0fa8f4cf182c2b3b87820638b1f7b3b67c501419a90c0fd5c124e59219f977922d87fa8176d04456a2721935d6822b627898e07
-
Filesize
20.2MB
MD5c5bd97f43cbc132456571f82bbd90fc2
SHA192bb15682134f64f4556b303ba1600c214279b19
SHA25679220e1b5f3cb5b338429cbe8fc2c78219256f783548d7f095abc85715e0f8c2
SHA512d353eb377e071ef625f995366f8c741c5f17d091bdab4291381546dfcff2ed4a83fd876661fb23df78aa44b7405e89af6b5c816ad8add2de60f907f365584582
-
Filesize
20.2MB
MD5cd7bd75b94580b38e8a6db5ab50f267c
SHA14ec9a35bc71f80aa5e4eb12d060d046aed6a7ebb
SHA256865d5b124e87424b7e47f1b865a5cf84aec60ed923b4559489087bdb0703850c
SHA512f00cf82357ff611069ede41545061219b7d50e6dc5718f3b65bf2bd5323900bd3f570eacc78631447b1912e335d3d5903cac5ee2966d6c1df2651746aa5501f4
-
Filesize
7.9MB
MD5919fab341bde5edb0754723daaf72390
SHA15e211995ce12d8260b2c8fdd08e354f2a5c04d34
SHA2566325e39476939814911f3ce288033fb25f581bfa1138d5d0ea8616280b641549
SHA512c3b75b6abb503016545d3ac9ce59e5bb245f1722161c1a2cdaaba2f5c485819402bcf7bb0972612db3758737b1ec86dc6461f8273d5705a97dfb24c6e5d6257a
-
Filesize
232B
MD568d9e1e956f541975587281af10e90a3
SHA1012369d8c7e62020dfc22587511e8fd561df92f5
SHA256da983dedf2e56c43ec9afab95fd6ab03e467316b9c7b4098c309423277480ecf
SHA512d13bf8bf77ecae28d4ac6965cf80fa9816fbb34317ade6daa2a50641c0cb7de316eec6f7da9d105204265e55b9701e2910d3a749d49893f0429a71a52bfdf2a2
-
Filesize
3KB
MD5472550b97ab249a5dcd563b938d35e3a
SHA1ddd3ada92e0fdd4ac93fd891841b80fd2baabb6d
SHA256a3094810ac5e275d3a7e0ab02d977a3cd71a56703305f3a6c2e3e92c2062502c
SHA512e2822fd378d30a11a100fcc210c251e1ce510b158d157d670ec913ffd52c7e9b6b1e67134cbe8b12246be62916a730c30fa4cdf5a319922cc57ff6585fe2de27
-
Filesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
157B
MD5d55bed9415496532e5333ecaff1e308d
SHA1074dc0ad8d7b3f86679c321ec7377b3394659a52
SHA256aacbccc1d0337c77cb4408cd9556b8e31d3a0390ab2ab6b17ad3bf30f2c93850
SHA51269c492e32f75809ee12cf29a38d71435ec39e9327970dd7f108ce0599804008c0e3a462d244796a5592b587e1c8f1c1f78c2602d539f6d84bf33c18eb38276a5
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa