Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    28/04/2024, 03:15

General

  • Target

    6a1843e8589f7a7d11e91865331f12026eec91f24712954c94d27cbade22c11f.exe

  • Size

    9.1MB

  • MD5

    19beac0f25da3868810921f25e10bd47

  • SHA1

    57a8a3df66829a38c171acce3f3d3fa6b601cf12

  • SHA256

    6a1843e8589f7a7d11e91865331f12026eec91f24712954c94d27cbade22c11f

  • SHA512

    824d5eaff1fa09d1038fd33645a9ecd4541e84ba59aebbbd5d7d25e0c503bbd489ac5ed899e9b0f02e1914072ccc322e0097e63ebe895baba86512f7b32d5e83

  • SSDEEP

    196608:hyEbJ8kKU1qXmuNXCf9CeBlXXuWEA1HaugJKvgabfT8z//QTDQsN99x:hbK8qWf9CeXXeWVYKoabfT6QT0sT9x

Malware Config

Signatures

  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 62 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a1843e8589f7a7d11e91865331f12026eec91f24712954c94d27cbade22c11f.exe
    "C:\Users\Admin\AppData\Local\Temp\6a1843e8589f7a7d11e91865331f12026eec91f24712954c94d27cbade22c11f.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2416
  • C:\Program Files (x86)\12\winos.exe
    "C:\Program Files (x86)\12\winos.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Program Files (x86)\12\kpzs.exe
      "C:\Program Files (x86)\12\kpzs.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2964
    • C:\Program Files (x86)\12\kpzs.exe
      "C:\Program Files (x86)\12\kpzs.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1248
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:844
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2076
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:988
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2180
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:756
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2332
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2248
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      PID:1936
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:880
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      PID:2296
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2204
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      PID:2580
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2648
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      PID:2708
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2720
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      PID:2588
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2800
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1984
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1940
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2748
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1924
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2212
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2396
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2888
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:584
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1056
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1972
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1752
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1876
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2052
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1048
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:912
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1628
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1700
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1584
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        PID:2164
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1756
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2056
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2608
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2576
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2480
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2684
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2624
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2768
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1740
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1956
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:768
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3000
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2992
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2000
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2436
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2316
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:640
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1132
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:676
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:356
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1000
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:756
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2032
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2320
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2532
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2296
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3044
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2672
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2652
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2584
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:240
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2824
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2844
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2932
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:3004
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3020
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1368
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1920
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2072
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:672
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1500
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:772
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2128
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:640
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:960
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:784
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2336
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1432
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1320
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1744
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2108
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:764
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1664
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1856
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2328
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2260
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:320
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2676
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2452
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2704
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1948
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2136
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1264
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1572
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2276
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2140
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:588
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2880
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:812
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2512
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1592
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1096
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2084
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1112
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1048
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1648
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:2228
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:908
    • C:\Program Files (x86)\12\EPEvenue_SB.exe
      "C:\Program Files (x86)\12\EPEvenue_SB.exe"
      2⤵
      • Suspicious use of SetThreadContext
      PID:1436
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        3⤵
          PID:1604
      • C:\Program Files (x86)\12\EPEvenue_SB.exe
        "C:\Program Files (x86)\12\EPEvenue_SB.exe"
        2⤵
          PID:3060
          • C:\Program Files (x86)\12\EPEvenue_SB.exe
            "C:\Program Files (x86)\12\EPEvenue_SB.exe"
            3⤵
              PID:1168
        • C:\Program Files (x86)\12\kpzs.exe
          "C:\Program Files (x86)\12\kpzs.exe" "C:\Users\Admin\AppData\Local\Temp\\CB89295E841A410291D7EC.lnk"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2932
        • C:\Program Files (x86)\12\kpzs.exe
          "C:\Program Files (x86)\12\kpzs.exe" "C:\Users\Admin\AppData\Local\Temp\\E2FA73F6F70C48248280D3.lnk"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1988

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\12\12345678.exe

                Filesize

                302KB

                MD5

                e027843c3e66ddd0b8cebbaf027497b1

                SHA1

                51671beb478ffcbb99fee5d34cb030efb44fe1b7

                SHA256

                09fea0e5f7b57b9ce700d52bc1ed58d3336eb7a9e04ceefd1b5246e4a3bc4c24

                SHA512

                fff8b36c2b5a1d4dadc0995d91b70317ce83de9c7f36613d64d9dbee1fe1293b8e8469b2f4239584e005675049f6eb67b4a04edc03247731b9b0f3fe45097e85

              • C:\Program Files (x86)\12\CefControl.dll

                Filesize

                590KB

                MD5

                037d4ae83b30c3ba8f7f23e54a168bb2

                SHA1

                05a291f0397928c30d5b8fd4980c9ffb0472a4e7

                SHA256

                2422e71145ae364a4992cf37eba2938e541253bec467419ea6d1f037822c77f4

                SHA512

                fe2119eb042044049e0916086a815b19af8873133ea85edb8657533abeea95d2608aae3a6a0519132a7d064726121ae792ba9a22d6393f43ec1f28e1f857dac4

              • C:\Program Files (x86)\12\DuiLib.dll

                Filesize

                2.2MB

                MD5

                cbfc4a8bc75a556dd97981531fadd751

                SHA1

                25e8eccb28e804db23d1d5123f3766d29b99294f

                SHA256

                4640ad02300c1311697c5592acdcfa59dba923eae1f2f2cb215a4a09d5055676

                SHA512

                3b02ea196b431e44a242ddafb0392420f1221b95e4a987a453bf3b1f72cc9ff707df7d5ff27f421edac0b6138cfa0205a98abf1dd92c7c5defcfdae2db34988c

              • C:\Program Files (x86)\12\EPEvenue_SB.exe

                Filesize

                1.1MB

                MD5

                4ddce14e5c6c09bbe5154167a74d271e

                SHA1

                3985cd3c8b49fcaa9c9dd244ef53d9e86889a3ad

                SHA256

                37865f209c91b291282c51515a868e6993070d3d7594cf931b42f5a6a8f09a3a

                SHA512

                f49cf8709fbc1a507416cc61c0678cf153d8fab38527d8e9eece7619196e4c194be437e57de635bea511cdcde7bc62469380f97005b7202c625ae6ceb70b610b

              • C:\Program Files (x86)\12\kpzs.exe

                Filesize

                72KB

                MD5

                3ffb2d1b619bd7841df50aaf619922fd

                SHA1

                6973d1b9f33ceb741569db9d0d1fa06712a2565e

                SHA256

                8ce68528e25b86977f18d42c8c5dddbd6e6f24f34a340d447f4b4db0cb96bfbe

                SHA512

                7855b96335088bb718215eeea63d6d36c871f3f946de3de48fcc0bb7666cc61c7922f7c84d886d19c5454d283971a5e704c2cc97795c629fc20183c29040d4da

              • C:\Program Files (x86)\12\libcef.dll

                Filesize

                3.1MB

                MD5

                e7a550ef58c53720969017f4b739c967

                SHA1

                82cbe82ca632c2fcb3cd2f280593462ddb9fc708

                SHA256

                5fb627f9bd0621f097fc51be7d22373ead7afafbeacbed584fea07d0cf38a000

                SHA512

                d583ad302fc6f9db08ec08dfeca8c4d48619903e41e8024178a2195dfc508d9a057cdd25dcc6cf2d0fd688916ec7fc1c276ae1978e0b81293907801633508704

              • C:\Users\Admin\AppData\Local\Temp\nsd1852.tmp\StdUtils.dll

                Filesize

                100KB

                MD5

                c6a6e03f77c313b267498515488c5740

                SHA1

                3d49fc2784b9450962ed6b82b46e9c3c957d7c15

                SHA256

                b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

                SHA512

                9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

              • C:\Users\Admin\AppData\Local\Temp\nsd1852.tmp\System.dll

                Filesize

                12KB

                MD5

                e38d8ff9f749ee1b141a122fec7280e0

                SHA1

                fbc8e410ef716fdb36977e5c16d3373a6100189a

                SHA256

                00f7604d4f36a728c7759f4d9cf3e30c9728c503557aac49bbcd55cfc3e4fcb4

                SHA512

                2b1dccf42d435445331291db94f869c4e8f6dcdfe4371969e76ee275d4e845e1d2e947c216f80484a7dd4b8e85158298e6ec7ed9add6d4259c07fdf87c316a8f

              • C:\Users\Admin\AppData\Local\Temp\nsd1852.tmp\nsNiuniuSkin.dll

                Filesize

                288KB

                MD5

                1e88afb7fe5b58d09d8a1b631e442538

                SHA1

                9ddb655cb32d002f68bdee962ce917002faa3614

                SHA256

                21a9a74fd631030981cdca42ab580f5aa030068ab80c183b73e99bea2d4f7708

                SHA512

                a7723bd73f55a716ea450f075d7a4fc7cd2080992c56ad67b6d46fdf4e30cef386068e1f4c2c788764cb092b529589cc1119ea2d62d07e32ea6d201e3afaf876

              • C:\Users\Admin\AppData\Local\Temp\nsd1852.tmp\skin.zip

                Filesize

                344KB

                MD5

                bf53c6eaf4dfb9ecc11afba92e0a3c9a

                SHA1

                cacbaa3c4dc7a0d0cc365f746e468a3013473063

                SHA256

                727877e75ee79f940288f0c086e78ff3beae1c6c04894eb7350bdd02d7983139

                SHA512

                affb46fefbcea4278e82e34206aaa7afbf1b394d9e7c2708ce8cd67a68c122a9978496c24dd1d1b5db175096ddb6aecf151df7c04be41a6847708ba70fbc611e

              • \Program Files (x86)\12\XPFarmer.bpl

                Filesize

                1.5MB

                MD5

                b6b5969b658b647fa0c6ec11de139c96

                SHA1

                87b0e1176b5d5cae31bee708c8daa383da4adf02

                SHA256

                a2b6b2c4e1a49809936780149416e8cbb793a0631f81f746350c3c06fcd2bc8e

                SHA512

                28b4ef210ac75e5d93ed7f99ed39e7bc1d918852a5f34ff0a95d0f4c742f190a969e5be30dd1845457d0880e1ce1975fb9d5e614de5b5b5e66e362ec3bde3842

              • \Program Files (x86)\12\msvcp100.dll

                Filesize

                411KB

                MD5

                e3c817f7fe44cc870ecdbcbc3ea36132

                SHA1

                2ada702a0c143a7ae39b7de16a4b5cc994d2548b

                SHA256

                d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf

                SHA512

                4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe

              • \Program Files (x86)\12\msvcr100.dll

                Filesize

                755KB

                MD5

                bf38660a9125935658cfa3e53fdc7d65

                SHA1

                0b51fb415ec89848f339f8989d323bea722bfd70

                SHA256

                60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

                SHA512

                25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

              • \Program Files (x86)\12\rtl70.bpl

                Filesize

                1.4MB

                MD5

                99b6a3a2b79d83857bd5129124592f8c

                SHA1

                e627d960ab29f7003ac0ea15e098bf5ada37ed3d

                SHA256

                d4876325de6084019f844d69b34079716746a5e52585b74bbb366d0152f0313d

                SHA512

                7e02a0eacf25cbfa3b685821b8cf697a6b2b125b6067337a7def18b58e7da6c216d396aefee1928c667900915ee0ee3a616e80985b77632c47f964899d835e1c

              • \Program Files (x86)\12\vcl70.bpl

                Filesize

                1.3MB

                MD5

                16a1c27ed415d1816f8888ea2cefb3f6

                SHA1

                80db800b805d548f6df4eb2cb37ba2064dc37c05

                SHA256

                a7a26cbf6968063c51d4d70f4599f295e4a88e352f19bdd475f3416e6411c390

                SHA512

                68a3e563dd9745210eb7295cde692af68cd5fc430a95856f4823dc10e42d067f332ae1d2445e8810e0c15c3c779e195735bd311c45e9690cb05dbedcd7354306

              • \Program Files (x86)\12\winos.exe

                Filesize

                5.2MB

                MD5

                dfff7fdeb342305504b35b2261eab611

                SHA1

                000f37471c5cf6d245848368d3eec4c1a21b624e

                SHA256

                2df0837884c042ec6c889702bed52df643722e9f949b4f2d7b9834ae42c6f246

                SHA512

                588b6f3fdf64c695c0b4465f78ae6eaf36a9b350b9ccd2fd5e891ae1b4e36329403184a2e0f60dc45d7ca33f43a0546ae24c909f3b82e5f402b03bf46fdb01d8

              • \Users\Admin\AppData\Local\Temp\nsd1852.tmp\BgWorker.dll

                Filesize

                2KB

                MD5

                33ec04738007e665059cf40bc0f0c22b

                SHA1

                4196759a922e333d9b17bda5369f14c33cd5e3bc

                SHA256

                50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be

                SHA512

                2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef

              • \Users\Admin\AppData\Local\Temp\nsd1852.tmp\nsProcess.dll

                Filesize

                4KB

                MD5

                88d3e48d1c1a051c702d47046ade7b4c

                SHA1

                8fc805a8b7900b6ba895d1b809a9f3ad4c730d23

                SHA256

                51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257

                SHA512

                83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7

              • memory/844-121-0x0000000000400000-0x000000000044D000-memory.dmp

                Filesize

                308KB

              • memory/844-131-0x0000000010000000-0x000000001018F000-memory.dmp

                Filesize

                1.6MB

              • memory/844-128-0x0000000000400000-0x000000000044D000-memory.dmp

                Filesize

                308KB

              • memory/844-132-0x0000000010000000-0x000000001018F000-memory.dmp

                Filesize

                1.6MB

              • memory/844-129-0x0000000010000000-0x000000001018F000-memory.dmp

                Filesize

                1.6MB

              • memory/844-123-0x0000000000400000-0x000000000044D000-memory.dmp

                Filesize

                308KB

              • memory/844-133-0x0000000010000000-0x000000001018F000-memory.dmp

                Filesize

                1.6MB

              • memory/844-120-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

              • memory/844-134-0x0000000010000000-0x000000001018F000-memory.dmp

                Filesize

                1.6MB

              • memory/988-184-0x0000000010000000-0x000000001018F000-memory.dmp

                Filesize

                1.6MB

              • memory/988-186-0x0000000010000000-0x000000001018F000-memory.dmp

                Filesize

                1.6MB

              • memory/1028-118-0x0000000000730000-0x00000000008AA000-memory.dmp

                Filesize

                1.5MB

              • memory/1028-127-0x0000000000730000-0x00000000008AA000-memory.dmp

                Filesize

                1.5MB

              • memory/1028-125-0x0000000000400000-0x0000000000528000-memory.dmp

                Filesize

                1.2MB

              • memory/1028-126-0x00000000400C0000-0x0000000040218000-memory.dmp

                Filesize

                1.3MB

              • memory/1656-170-0x00000000005A0000-0x000000000071A000-memory.dmp

                Filesize

                1.5MB

              • memory/1656-176-0x0000000000400000-0x0000000000528000-memory.dmp

                Filesize

                1.2MB

              • memory/1656-178-0x00000000005A0000-0x000000000071A000-memory.dmp

                Filesize

                1.5MB

              • memory/1656-177-0x00000000400C0000-0x0000000040218000-memory.dmp

                Filesize

                1.3MB

              • memory/2076-164-0x0000000000400000-0x000000000044D000-memory.dmp

                Filesize

                308KB

              • memory/2076-163-0x0000000010000000-0x000000001018F000-memory.dmp

                Filesize

                1.6MB

              • memory/2076-161-0x0000000010000000-0x000000001018F000-memory.dmp

                Filesize

                1.6MB

              • memory/2076-162-0x0000000000450000-0x00000000004B7000-memory.dmp

                Filesize

                412KB

              • memory/2120-199-0x0000000000400000-0x0000000000528000-memory.dmp

                Filesize

                1.2MB

              • memory/2120-193-0x0000000000710000-0x000000000088A000-memory.dmp

                Filesize

                1.5MB

              • memory/2120-201-0x00000000400C0000-0x0000000040218000-memory.dmp

                Filesize

                1.3MB

              • memory/2416-80-0x0000000002A10000-0x0000000002A12000-memory.dmp

                Filesize

                8KB

              • memory/2416-14-0x0000000074DC0000-0x0000000074E7C000-memory.dmp

                Filesize

                752KB

              • memory/2884-155-0x00000000400C0000-0x0000000040218000-memory.dmp

                Filesize

                1.3MB

              • memory/2884-147-0x00000000006C0000-0x000000000083A000-memory.dmp

                Filesize

                1.5MB

              • memory/2884-156-0x00000000006C0000-0x000000000083A000-memory.dmp

                Filesize

                1.5MB

              • memory/2884-153-0x0000000000400000-0x0000000000528000-memory.dmp

                Filesize

                1.2MB