xtremerat | 9d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Size 167KB
Sample240420-te5frscc23
SHA256 9d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661
MD5 fd203670a1093f4efd07d570cf4ffee7
SHA1 04e4ff6219d57cab37db772130b7ec1ad8087e51
SHA512 3bf5583beba5e7d2c2bbedbef7679803b3b1963fb16da2d4891ee5ea8c1235a16756264608c4a18a24712e870e36fd142261bef00d4f619320cd305d5ebd5051
SSDEEP 3072:4xlgiukdSZJEpJnohdEJ1MtAe7gn17/C7fyWNCHeODrIN1xuAlWH:Klgil8egEJzqb/4Qxu2WH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 12 IoCs

resource	yara_rule
behavioral2/memory/4112-4-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/4112-5-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/2416-9-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/4112-17-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/3852-24-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/3852-25-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/3852-30-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/2404-36-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/2404-37-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/2404-42-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/1104-49-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/1104-54-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Server.exe

Deletes itself 1 IoCs

pid	Process
2416	explorer.exe

Executes dropped EXE 7 IoCs

pid	Process
1128	Server.exe
3852	Server.exe
2940	Server.exe
2404	Server.exe
1496	Server.exe
1104	Server.exe
1676	Server.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4112-0-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/4112-2-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/4112-4-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/4112-5-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2416-9-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/4112-17-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/3852-23-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/3852-24-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/3852-25-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/3852-30-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2404-35-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2404-36-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2404-37-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2404-42-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/1104-49-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/1104-54-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3216 set thread context of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	92
PID 1128 set thread context of 3852	1128	Server.exe	103
PID 2940 set thread context of 2404	2940	Server.exe	113
PID 1496 set thread context of 1104	1496	Server.exe	129

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
File created	C:\Windows\InstallDir\Server.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
1128	Server.exe
1128	Server.exe
1128	Server.exe
1128	Server.exe
2940	Server.exe
2940	Server.exe
2940	Server.exe
2940	Server.exe
1496	Server.exe
1496	Server.exe
1496	Server.exe
1496	Server.exe
1676	Server.exe
1676	Server.exe
1676	Server.exe
1676	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	92
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	92
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	92
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	92
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	92
PID 4112 wrote to memory of 2128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	93
PID 4112 wrote to memory of 2128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	93
PID 4112 wrote to memory of 2416	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	94
PID 4112 wrote to memory of 2416	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	94
PID 4112 wrote to memory of 2416	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	94
PID 4112 wrote to memory of 2416	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	94
PID 4112 wrote to memory of 2128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	93
PID 4112 wrote to memory of 2152	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	95
PID 4112 wrote to memory of 2152	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	95
PID 4112 wrote to memory of 2152	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	95
PID 4112 wrote to memory of 4356	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	96
PID 4112 wrote to memory of 4356	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	96
PID 4112 wrote to memory of 4356	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	96
PID 4112 wrote to memory of 4984	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	97
PID 4112 wrote to memory of 4984	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	97
PID 4112 wrote to memory of 4984	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	97
PID 4112 wrote to memory of 3628	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	98
PID 4112 wrote to memory of 3628	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	98
PID 4112 wrote to memory of 3628	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	98
PID 4112 wrote to memory of 3432	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	99
PID 4112 wrote to memory of 3432	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	99
PID 4112 wrote to memory of 3432	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	99
PID 4112 wrote to memory of 3340	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	100
PID 4112 wrote to memory of 3340	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	100
PID 4112 wrote to memory of 3340	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	100
PID 4112 wrote to memory of 216	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	101
PID 4112 wrote to memory of 216	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	101
PID 4112 wrote to memory of 1128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	102
PID 4112 wrote to memory of 1128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	102
PID 4112 wrote to memory of 1128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	102
PID 1128 wrote to memory of 3852	1128	Server.exe	103
PID 1128 wrote to memory of 3852	1128	Server.exe	103
PID 1128 wrote to memory of 3852	1128	Server.exe	103
PID 1128 wrote to memory of 3852	1128	Server.exe	103
PID 1128 wrote to memory of 3852	1128	Server.exe	103
PID 3852 wrote to memory of 4556	3852	Server.exe	104
PID 3852 wrote to memory of 4556	3852	Server.exe	104
PID 3852 wrote to memory of 4556	3852	Server.exe	104
PID 3852 wrote to memory of 2920	3852	Server.exe	105
PID 3852 wrote to memory of 2920	3852	Server.exe	105
PID 3852 wrote to memory of 2920	3852	Server.exe	105
PID 3852 wrote to memory of 1164	3852	Server.exe	106
PID 3852 wrote to memory of 1164	3852	Server.exe	106
PID 3852 wrote to memory of 1164	3852	Server.exe	106
PID 3852 wrote to memory of 2884	3852	Server.exe	107
PID 3852 wrote to memory of 2884	3852	Server.exe	107
PID 3852 wrote to memory of 2884	3852	Server.exe	107
PID 3852 wrote to memory of 3680	3852	Server.exe	108
PID 3852 wrote to memory of 3680	3852	Server.exe	108
PID 3852 wrote to memory of 3680	3852	Server.exe	108
PID 3852 wrote to memory of 2044	3852	Server.exe	109
PID 3852 wrote to memory of 2044	3852	Server.exe	109
PID 3852 wrote to memory of 2044	3852	Server.exe	109
PID 3852 wrote to memory of 2672	3852	Server.exe	110
PID 3852 wrote to memory of 2672	3852	Server.exe	110
PID 3852 wrote to memory of 2672	3852	Server.exe	110
PID 3852 wrote to memory of 4548	3852	Server.exe	111
PID 3852 wrote to memory of 4548	3852	Server.exe	111
PID 3852 wrote to memory of 2940	3852	Server.exe	112

C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Deletes itself
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:216
- - C:\Windows\InstallDir\Server.exe
    "C:\Windows\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4548
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:2940
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3008
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1496
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1588
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5460C4DF-B.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\5460C4DF-B.cfg
Size 1KB
SHA256 b1a2180a8ec2ce8093cc4f5770acfe6d20b01875fdf3d73d2faedba11e8c08fa
MD5 9e963629c38a37f524929ba97bec3744
SHA1 2fec85627b9f2aaab45a9118a8b4c0bd88908ab6
SHA512 34e1d05ebb4160d1d069e2f33a5e221decdd6f2db9bb75eab332637ccbd21d77532f14614865265e5b63013e724c88d314510a56f6679504d6a6070c381b0298
MD5 SHA1 SHA512

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 167KB
SHA256 9d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661
MD5 fd203670a1093f4efd07d570cf4ffee7
SHA1 04e4ff6219d57cab37db772130b7ec1ad8087e51
SHA512 3bf5583beba5e7d2c2bbedbef7679803b3b1963fb16da2d4891ee5ea8c1235a16756264608c4a18a24712e870e36fd142261bef00d4f619320cd305d5ebd5051
SSDEEP 3072:4xlgiukdSZJEpJnohdEJ1MtAe7gn17/C7fyWNCHeODrIN1xuAlWH:Klgil8egEJzqb/4Qxu2WH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1104-54-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/1104-49-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/1128-21-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/1496-46-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/1676-55-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/2404-42-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/2404-37-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/2404-36-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/2404-35-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/2416-9-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/2940-33-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/3216-3-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/3852-25-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/3852-30-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/3852-24-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/3852-23-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/4112-17-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/4112-0-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/4112-5-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/4112-4-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download

memory/4112-2-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Download