xtremerat | 9d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661

General

Target

fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Size

167KB
MD5

fd203670a1093f4efd07d570cf4ffee7
SHA1

04e4ff6219d57cab37db772130b7ec1ad8087e51
SHA256

9d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661
SHA512

3bf5583beba5e7d2c2bbedbef7679803b3b1963fb16da2d4891ee5ea8c1235a16756264608c4a18a24712e870e36fd142261bef00d4f619320cd305d5ebd5051
SSDEEP

3072:4xlgiukdSZJEpJnohdEJ1MtAe7gn17/C7fyWNCHeODrIN1xuAlWH:Klgil8egEJzqb/4Qxu2WH

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4112-4-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/4112-5-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/2416-9-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/4112-17-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/3852-24-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/3852-25-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/3852-30-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/2404-36-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/2404-37-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/2404-42-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/1104-49-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat
behavioral2/memory/1104-54-0x0000000000C80000-0x0000000000C9C000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Server.exeServer.exeServer.exefd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exeServer.exeServer.exeServer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Server.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

2416 explorer.exe
Executes dropped EXE 7 IoCs

Processes:

Server.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

pid process

1128 Server.exe
3852 Server.exe
2940 Server.exe
2404 Server.exe
1496 Server.exe
1104 Server.exe
1676 Server.exe

pid	process
2416	explorer.exe

pid	process
1128	Server.exe
3852	Server.exe
2940	Server.exe
2404	Server.exe
1496	Server.exe
1104	Server.exe
1676	Server.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4112-0-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/4112-2-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/4112-4-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/4112-5-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2416-9-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/4112-17-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/3852-23-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/3852-24-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/3852-25-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/3852-30-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2404-35-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2404-36-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2404-37-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/2404-42-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/1104-49-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx
behavioral2/memory/1104-54-0x0000000000C80000-0x0000000000C9C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Server.exeServer.exefd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exeServer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exeServer.exeServer.exeServer.exe

description	pid	process	target process
PID 3216 set thread context of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
PID 1128 set thread context of 3852	1128	Server.exe	Server.exe
PID 2940 set thread context of 2404	2940	Server.exe	Server.exe
PID 1496 set thread context of 1104	1496	Server.exe	Server.exe

Drops file in Windows directory 2 IoCs

Processes:

fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\InstallDir\Server.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
File created	C:\Windows\InstallDir\Server.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exeServer.exeServer.exeServer.exeServer.exe

pid	process
3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
1128	Server.exe
1128	Server.exe
1128	Server.exe
1128	Server.exe
2940	Server.exe
2940	Server.exe
2940	Server.exe
2940	Server.exe
1496	Server.exe
1496	Server.exe
1496	Server.exe
1496	Server.exe
1676	Server.exe
1676	Server.exe
1676	Server.exe
1676	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exefd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exeServer.exeServer.exe

description	pid	process	target process
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
PID 3216 wrote to memory of 4112	3216	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
PID 4112 wrote to memory of 2128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 2128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 2416	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	explorer.exe
PID 4112 wrote to memory of 2416	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	explorer.exe
PID 4112 wrote to memory of 2416	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	explorer.exe
PID 4112 wrote to memory of 2416	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	explorer.exe
PID 4112 wrote to memory of 2128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 2152	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 2152	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 2152	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 4356	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 4356	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 4356	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 4984	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 4984	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 4984	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 3628	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 3628	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 3628	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 3432	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 3432	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 3432	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 3340	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 3340	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 3340	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 216	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 216	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	msedge.exe
PID 4112 wrote to memory of 1128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	Server.exe
PID 4112 wrote to memory of 1128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	Server.exe
PID 4112 wrote to memory of 1128	4112	fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe	Server.exe
PID 1128 wrote to memory of 3852	1128	Server.exe	Server.exe
PID 1128 wrote to memory of 3852	1128	Server.exe	Server.exe
PID 1128 wrote to memory of 3852	1128	Server.exe	Server.exe
PID 1128 wrote to memory of 3852	1128	Server.exe	Server.exe
PID 1128 wrote to memory of 3852	1128	Server.exe	Server.exe
PID 3852 wrote to memory of 4556	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 4556	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 4556	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2920	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2920	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2920	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 1164	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 1164	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 1164	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2884	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2884	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2884	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 3680	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 3680	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 3680	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2044	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2044	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2044	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2672	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2672	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2672	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 4548	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 4548	3852	Server.exe	msedge.exe
PID 3852 wrote to memory of 2940	3852	Server.exe	Server.exe

C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3216

C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe"
2⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2128

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Deletes itself
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:216

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
4⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:4548

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2940

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
6⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:3008

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1496

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
8⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
9⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
9⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
9⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
9⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
9⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
9⤵
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
9⤵
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
9⤵
PID:1588

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\5460C4DF-B.cfg
Filesize
1KB

MD5
9e963629c38a37f524929ba97bec3744

SHA1
2fec85627b9f2aaab45a9118a8b4c0bd88908ab6

SHA256
b1a2180a8ec2ce8093cc4f5770acfe6d20b01875fdf3d73d2faedba11e8c08fa

SHA512
34e1d05ebb4160d1d069e2f33a5e221decdd6f2db9bb75eab332637ccbd21d77532f14614865265e5b63013e724c88d314510a56f6679504d6a6070c381b0298

Download Submit
C:\Windows\InstallDir\Server.exe
Filesize
167KB

MD5
fd203670a1093f4efd07d570cf4ffee7

SHA1
04e4ff6219d57cab37db772130b7ec1ad8087e51

SHA256
9d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661

SHA512
3bf5583beba5e7d2c2bbedbef7679803b3b1963fb16da2d4891ee5ea8c1235a16756264608c4a18a24712e870e36fd142261bef00d4f619320cd305d5ebd5051

Download Submit
memory/1104-54-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/1104-49-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/1128-21-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1496-46-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1676-55-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2404-42-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/2404-37-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/2404-36-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/2404-35-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/2416-9-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/2940-33-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/3216-3-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/3852-25-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/3852-30-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/3852-24-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/3852-23-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/4112-17-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/4112-0-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/4112-5-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/4112-4-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/4112-2-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads