Resubmissions
07-05-2024 12:28
240507-pnhadaac95 1007-05-2024 12:28
240507-pnd8qaff8s 1007-05-2024 12:28
240507-pnc1naff7z 1007-05-2024 12:28
240507-pnbgtsac85 1007-05-2024 12:28
240507-pnawasff7w 1025-04-2024 13:10
240425-qegsxsba4s 10Analysis
-
max time kernel
600s -
max time network
601s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 12:28
Behavioral task
behavioral1
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral2
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win11-20240419-en
General
-
Target
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
-
Size
7.8MB
-
MD5
feb61ffde2dd829e738ea35dc8ee6208
-
SHA1
659e17fe8390c0494e1363c2ebd11333638fd56e
-
SHA256
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449
-
SHA512
609d2a7950643bea16e353d73157429f304cd1807808becb6fd2c5bbeeb07c6583a98f0e76b7e051390771502cabc7bbda4360f53388867ab863c6f564fbd959
-
SSDEEP
196608:oIRcbH4jSteTGv1xwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfu1xwZ6v1CPwDv3uFteg2EeJUO9E
Malware Config
Extracted
bitrat
1.38
n7dua2r7ev3r6fsisszycs7fvy4a36epnfje5s7lz5eiduoxetqg55ad.onion:1235
-
communication_password
99754106633f94d350db34d548d6091a
-
install_dir
temp
-
install_file
test1
-
tor_process
test2
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000f000000023a6f-18.dat acprotect behavioral1/files/0x000a000000023bb1-21.dat acprotect behavioral1/files/0x000a000000023bb0-28.dat acprotect behavioral1/files/0x000a000000023bb2-36.dat acprotect behavioral1/files/0x000c000000023b9e-34.dat acprotect behavioral1/files/0x000a000000023bb4-26.dat acprotect behavioral1/files/0x0014000000023a74-24.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Executes dropped EXE 14 IoCs
pid Process 4992 test2.exe 2304 test2.exe 4304 test2.exe 3580 test2.exe 2668 test2.exe 4044 test2.exe 4604 test2.exe 2624 test2.exe 4476 test2.exe 2108 test2.exe 2232 test2.exe 2324 test2.exe 3000 test2.exe 2560 test2.exe -
Loads dropped DLL 64 IoCs
pid Process 4992 test2.exe 4992 test2.exe 4992 test2.exe 4992 test2.exe 4992 test2.exe 4992 test2.exe 4992 test2.exe 4992 test2.exe 4992 test2.exe 2304 test2.exe 2304 test2.exe 2304 test2.exe 2304 test2.exe 2304 test2.exe 2304 test2.exe 2304 test2.exe 4304 test2.exe 4304 test2.exe 4304 test2.exe 4304 test2.exe 4304 test2.exe 4304 test2.exe 4304 test2.exe 3580 test2.exe 3580 test2.exe 3580 test2.exe 3580 test2.exe 3580 test2.exe 3580 test2.exe 3580 test2.exe 2668 test2.exe 2668 test2.exe 2668 test2.exe 2668 test2.exe 2668 test2.exe 2668 test2.exe 2668 test2.exe 4044 test2.exe 4044 test2.exe 4044 test2.exe 4044 test2.exe 4044 test2.exe 4044 test2.exe 4044 test2.exe 4604 test2.exe 4604 test2.exe 4604 test2.exe 4604 test2.exe 4604 test2.exe 4604 test2.exe 4604 test2.exe 2624 test2.exe 2624 test2.exe 2624 test2.exe 2624 test2.exe 2624 test2.exe 2624 test2.exe 2624 test2.exe 4476 test2.exe 4476 test2.exe 4476 test2.exe 4476 test2.exe 4476 test2.exe 4476 test2.exe -
resource yara_rule behavioral1/files/0x000a000000023bb3-14.dat upx behavioral1/files/0x000f000000023a6f-18.dat upx behavioral1/files/0x000a000000023bb1-21.dat upx behavioral1/files/0x000a000000023bb0-28.dat upx behavioral1/files/0x000a000000023bb2-36.dat upx behavioral1/files/0x000c000000023b9e-34.dat upx behavioral1/memory/4992-33-0x00000000741A0000-0x00000000741E9000-memory.dmp upx behavioral1/memory/4992-43-0x0000000073B60000-0x0000000073E2F000-memory.dmp upx behavioral1/memory/4992-38-0x0000000073E30000-0x0000000073EB8000-memory.dmp upx behavioral1/memory/4992-37-0x0000000073EC0000-0x0000000073FCA000-memory.dmp upx behavioral1/memory/4992-32-0x0000000073FD0000-0x000000007409E000-memory.dmp upx behavioral1/memory/4992-31-0x00000000740A0000-0x00000000740C4000-memory.dmp upx behavioral1/memory/4992-30-0x00000000740D0000-0x0000000074198000-memory.dmp upx behavioral1/memory/4992-29-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/files/0x000a000000023bb4-26.dat upx behavioral1/files/0x0014000000023a74-24.dat upx behavioral1/memory/4992-70-0x0000000073E30000-0x0000000073EB8000-memory.dmp upx behavioral1/memory/4992-71-0x0000000073B60000-0x0000000073E2F000-memory.dmp upx behavioral1/memory/4992-69-0x0000000073EC0000-0x0000000073FCA000-memory.dmp upx behavioral1/memory/4992-68-0x0000000073FD0000-0x000000007409E000-memory.dmp upx behavioral1/memory/4992-67-0x00000000740A0000-0x00000000740C4000-memory.dmp upx behavioral1/memory/4992-66-0x00000000740D0000-0x0000000074198000-memory.dmp upx behavioral1/memory/4992-64-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4992-65-0x00000000741A0000-0x00000000741E9000-memory.dmp upx behavioral1/memory/4992-73-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4992-83-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4992-93-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4992-103-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4992-112-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4992-127-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4992-155-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/2304-165-0x0000000073DD0000-0x0000000073E19000-memory.dmp upx behavioral1/memory/2304-167-0x0000000073C00000-0x0000000073C88000-memory.dmp upx behavioral1/memory/2304-170-0x0000000073DA0000-0x0000000073DC4000-memory.dmp upx behavioral1/memory/2304-169-0x0000000073E20000-0x0000000073EEE000-memory.dmp upx behavioral1/memory/2304-168-0x0000000073FC0000-0x000000007428F000-memory.dmp upx behavioral1/memory/2304-166-0x0000000073C90000-0x0000000073D9A000-memory.dmp upx behavioral1/memory/2304-161-0x0000000073EF0000-0x0000000073FB8000-memory.dmp upx behavioral1/memory/2304-200-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/2304-202-0x0000000073DD0000-0x0000000073E19000-memory.dmp upx behavioral1/memory/2304-201-0x0000000073EF0000-0x0000000073FB8000-memory.dmp upx behavioral1/memory/2304-213-0x0000000073C00000-0x0000000073C88000-memory.dmp upx behavioral1/memory/2304-212-0x0000000073C90000-0x0000000073D9A000-memory.dmp upx behavioral1/memory/2304-216-0x0000000073FC0000-0x000000007428F000-memory.dmp upx behavioral1/memory/2304-217-0x0000000073E20000-0x0000000073EEE000-memory.dmp upx behavioral1/memory/2304-218-0x0000000073DA0000-0x0000000073DC4000-memory.dmp upx behavioral1/memory/2304-261-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4304-269-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4304-274-0x0000000073C20000-0x0000000073C69000-memory.dmp upx behavioral1/memory/4304-277-0x0000000072A80000-0x0000000072B8A000-memory.dmp upx behavioral1/memory/4304-276-0x00000000729F0000-0x0000000072A78000-memory.dmp upx behavioral1/memory/4304-275-0x0000000073B30000-0x0000000073B54000-memory.dmp upx behavioral1/memory/4304-273-0x0000000073C70000-0x0000000073D3E000-memory.dmp upx behavioral1/memory/4304-272-0x0000000073D40000-0x0000000073E08000-memory.dmp upx behavioral1/memory/4304-271-0x0000000072B90000-0x0000000072E5F000-memory.dmp upx behavioral1/memory/4304-297-0x0000000072B90000-0x0000000072E5F000-memory.dmp upx behavioral1/memory/4304-309-0x0000000073B30000-0x0000000073B54000-memory.dmp upx behavioral1/memory/4304-308-0x0000000073C70000-0x0000000073D3E000-memory.dmp upx behavioral1/memory/4304-307-0x0000000073D40000-0x0000000073E08000-memory.dmp upx behavioral1/memory/4304-306-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/4304-341-0x0000000000380000-0x0000000000784000-memory.dmp upx behavioral1/memory/3580-355-0x00000000729F0000-0x0000000072A78000-memory.dmp upx behavioral1/memory/3580-356-0x0000000072B90000-0x0000000072E5F000-memory.dmp upx behavioral1/memory/3580-354-0x0000000072A80000-0x0000000072B8A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\test1 = "C:\\Users\\Admin\\AppData\\Local\\temp\\test1" a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 145 myexternalip.com 155 myexternalip.com 85 myexternalip.com 122 myexternalip.com 137 myexternalip.com 170 myexternalip.com 180 myexternalip.com 86 myexternalip.com 104 myexternalip.com 113 myexternalip.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
pid Process 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: RenamesItself 64 IoCs
pid Process 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 116 wrote to memory of 4992 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 86 PID 116 wrote to memory of 4992 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 86 PID 116 wrote to memory of 4992 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 86 PID 116 wrote to memory of 2304 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 101 PID 116 wrote to memory of 2304 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 101 PID 116 wrote to memory of 2304 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 101 PID 116 wrote to memory of 4304 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 113 PID 116 wrote to memory of 4304 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 113 PID 116 wrote to memory of 4304 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 113 PID 116 wrote to memory of 3580 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 114 PID 116 wrote to memory of 3580 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 114 PID 116 wrote to memory of 3580 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 114 PID 116 wrote to memory of 2668 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 115 PID 116 wrote to memory of 2668 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 115 PID 116 wrote to memory of 2668 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 115 PID 116 wrote to memory of 4044 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 PID 116 wrote to memory of 4044 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 PID 116 wrote to memory of 4044 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 PID 116 wrote to memory of 4604 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 117 PID 116 wrote to memory of 4604 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 117 PID 116 wrote to memory of 4604 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 117 PID 116 wrote to memory of 2624 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 118 PID 116 wrote to memory of 2624 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 118 PID 116 wrote to memory of 2624 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 118 PID 116 wrote to memory of 4476 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 119 PID 116 wrote to memory of 4476 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 119 PID 116 wrote to memory of 4476 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 119 PID 116 wrote to memory of 2108 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 120 PID 116 wrote to memory of 2108 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 120 PID 116 wrote to memory of 2108 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 120 PID 116 wrote to memory of 2232 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 121 PID 116 wrote to memory of 2232 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 121 PID 116 wrote to memory of 2232 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 121 PID 116 wrote to memory of 2324 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 122 PID 116 wrote to memory of 2324 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 122 PID 116 wrote to memory of 2324 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 122 PID 116 wrote to memory of 3000 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 123 PID 116 wrote to memory of 3000 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 123 PID 116 wrote to memory of 3000 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 123 PID 116 wrote to memory of 2560 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 124 PID 116 wrote to memory of 2560 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 124 PID 116 wrote to memory of 2560 116 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe"C:\Users\Admin\AppData\Local\Temp\a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4992
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4304
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3580
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4044
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4604
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4476
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:2108
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:2232
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:2324
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:3000
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5af023f6bada4b432cb4b0006e7644a8b
SHA166a56d1ca6d0c68f438ed62963a1c3451d41d667
SHA256df448c2b54ecb7be90a0e8ede35c094c3dab7a189795664fc939571e91c119af
SHA51278f4a6ceea5be53c26afa785bd098f62abfc0b9a51aa3d69f9f8bda70534b937db7a6138267cfb2a0d0e47c839fbaa60657fba97f203e5480d46486087b9f943
-
Filesize
2.4MB
MD50ce4530144899e61e7151afe7810919f
SHA1f300561ff8bbd2b426926aced1e576bd2b91d001
SHA25659f1410ba288f348e46546682bc8ae589accfdb2abc49b0b59fed35ed9de32e5
SHA512595a94b645837f8627b703920cec6eda3e6103ae964c91c383679f00b712343b7f8d4656db6efdaceabe8c641cf45d6461ff77cc9fafa263880bc1a0763a83e6
-
Filesize
2.4MB
MD5dde78eff34a6e66b6ea6d178bc426549
SHA1b253863b59f1502d06dfbcd3dd14313fe44c9e78
SHA256a869e89870d10561112f15016a20789dae97004d52c3258ddc11e0ebbc91137e
SHA512343452cd55b21a98f663e3cede0d29f77545f03c93cb0a3caa06160419991023226e03e957cda1cc3ef9bcfcf0dc7a103f875048971f9b6eb94133448e410141
-
Filesize
17.9MB
MD525062967fbc2c59d5e2744e5ee429a58
SHA1b2d97c6e86cf81447772e253d00263eecfa74c4d
SHA2564bfaecc9b00025c3c3fa3939826bbc3f8838bb7f4bfcf32d314c8a21bd80cb4a
SHA512b242950c478aacefd2e4d00649dc3432a45af132d0833a60dd20bbb7175d8da220370ad93f0c3968d3d07643906c7b340bda986f85c7b2d75852f6e76fb54802
-
Filesize
5.7MB
MD5e8cecdbe02c73244c24b1cde3d440e10
SHA15b63d9a3f55dc11fdcb27e2baa653a3a9c060cbd
SHA2568c80e7f7758f14f4c3a0b2cbd281551740ad9bbb7cd6e4be8442dabe8cf14a84
SHA51261b1461cf1fc700c2848d249f21bdd19207eabb88c06e84937552b4ed8df4ee3ff98df74e5ce6527bba2ddeee3e7973ae6670e7a63c2336f58c15b51a6137fb6
-
Filesize
5.7MB
MD5fdf9ed5e194fb446e9a1a62b77399c7c
SHA176238f31db13321edd0189f33c95849f812ed936
SHA256c49bbe4b32457df32b0a12f0d82756c35fafc6a68b39f2fba0868da4162bdc52
SHA51209348d5a45b35d0bd2ebc6ce02bccda0e21e42fdba0263d7c39e5be19d6e582024df8f8f8c6e198605a185456451a6c2bff988addb7044307a762f9d75e4e214
-
Filesize
5.2MB
MD53e8cc605f59eaae7094e0d28684f7adc
SHA1e3df12b93a941088f6a6fa57226a4537545603f2
SHA256b3954d0c474cb280d17bf109562403312ade070f0a17b3ac0534960e71445f88
SHA5129cf6c40b9a52f4624f92ea58cea2222cd49e09d3a100f693c4aa5da312afc64c8d5039bdbeabe66c40f410d871755c7a49870fbc975b0e3e0531d50a79672688
-
Filesize
5.9MB
MD5308a07cb8a8a746dd8e4a37770eefa6b
SHA1406ed322d3058d2345f37751f038ffc330f81d61
SHA2562f2e81fa8999c834c2d826b03643b3336e638c6f402aec13c5f1e3c4265c885c
SHA512cf571bb3e3345fe90e76b1824f26ad39c1cb80c4a4643f1ee3e621a2652399f6fcf5a5095c9b83013ce2e1eebdbac8b202426ef26608120e654bcf435ff3189d
-
Filesize
12.2MB
MD5844f6a82e57e22d2f3b186d055853853
SHA1d4ec829e46c90fb20206f9c21a371c2194160db8
SHA256ee9134354862e280da0a6e6e71dba0144682e76768387f5ac0aa3f60dcfc6295
SHA512c0c2e0e69545b2d3f2996749fa334f7b4df0b41e12ed099cd1d523e8436c90bc3a90d314e64a3e687567ca1dc2741954f5b40f93efa1bf350f1e42ec3a4ace24
-
Filesize
3KB
MD58b858e4b316cba7226ea7f88cb3e4808
SHA15cb309b83a652a298ec7340f0fecb2187f5c26ec
SHA256eeb8b66a82b5d136f62041a64f1e655d0e126c9445c3ba871a0ea3d24e3bd603
SHA512709840706cbe72fe2b84ff95725fd5684d23204cb0811f9659d656bed483a8d69d250a0f1e4d997ac4221138394399ea6723476c2ab73cbef60ba4de261e9c7e
-
Filesize
5KB
MD52b86e95e6a484f99bfb1a7e4feca0c65
SHA1051ef60461cebadb78f7297a605922f3b3848171
SHA256619973d6ae96384057aa2068c4f6a3f256fb02669020de2aa1064d3d28418c6d
SHA512a98cb427a6a2f527ae873085f83f21cdea7df37429a9e7e4f5f10b3403541ead67b0be43d6432088e1967abe75b3b1e537c8b6336a10b12bd50ef411ccbf23b0
-
Filesize
232B
MD5c4436df2f37ad19408e0e4cd6f86af40
SHA13b9b7ca4378c72c69f37d4b72d6dc45d97617b56
SHA256f11cc05280c6b8c0b95e7aba74db6d9cb0df75278dca289241a4ce1bd611905c
SHA512567cc1c085f30a08aa2c3f89b08d013fb7cceeff8c210d7aab6e785ddb0f83ef9e7c690cc49b29cb0615c26dab180999921a64876bb8ae7084a00fbb6042f05c
-
Filesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
157B
MD5439cd73927f46fde28540391feee8477
SHA1ee7fb2aeb7708378abda293b03f5c9ffb6dbc742
SHA256d1604e8bdb1a544638a97aa210b3e1eb12f1f159323d6b5942e03e11eafe9f75
SHA512c11ad07964e190696f500468d52c61d8af5f075e7828ef00d525f06937f4205ca58eb3eabe5fd9cc8fa88c1d191de919429b6bbf3cdbb2dda6eed7d1b9ca7319
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa