Resubmissions
07-05-2024 12:28
240507-pnhadaac95 1007-05-2024 12:28
240507-pnd8qaff8s 1007-05-2024 12:28
240507-pnc1naff7z 1007-05-2024 12:28
240507-pnbgtsac85 1007-05-2024 12:28
240507-pnawasff7w 1025-04-2024 13:10
240425-qegsxsba4s 10Analysis
-
max time kernel
597s -
max time network
601s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 12:28
Behavioral task
behavioral1
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral2
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win11-20240419-en
General
-
Target
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
-
Size
7.8MB
-
MD5
feb61ffde2dd829e738ea35dc8ee6208
-
SHA1
659e17fe8390c0494e1363c2ebd11333638fd56e
-
SHA256
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449
-
SHA512
609d2a7950643bea16e353d73157429f304cd1807808becb6fd2c5bbeeb07c6583a98f0e76b7e051390771502cabc7bbda4360f53388867ab863c6f564fbd959
-
SSDEEP
196608:oIRcbH4jSteTGv1xwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfu1xwZ6v1CPwDv3uFteg2EeJUO9E
Malware Config
Extracted
bitrat
1.38
n7dua2r7ev3r6fsisszycs7fvy4a36epnfje5s7lz5eiduoxetqg55ad.onion:1235
-
communication_password
99754106633f94d350db34d548d6091a
-
install_dir
temp
-
install_file
test1
-
tor_process
test2
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral4/files/0x00140000000239c4-18.dat acprotect behavioral4/files/0x000a000000023b8a-21.dat acprotect behavioral4/files/0x000d000000023b83-20.dat acprotect behavioral4/files/0x00130000000239e7-33.dat acprotect behavioral4/files/0x000a000000023b8b-35.dat acprotect behavioral4/files/0x000a000000023b8d-31.dat acprotect behavioral4/files/0x001a0000000239c6-23.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Executes dropped EXE 14 IoCs
pid Process 4040 test2.exe 3844 test2.exe 4316 test2.exe 3044 test2.exe 2276 test2.exe 3020 test2.exe 1624 test2.exe 4776 test2.exe 3168 test2.exe 2212 test2.exe 2304 test2.exe 4900 test2.exe 4044 test2.exe 412 test2.exe -
Loads dropped DLL 64 IoCs
pid Process 4040 test2.exe 4040 test2.exe 4040 test2.exe 4040 test2.exe 4040 test2.exe 4040 test2.exe 4040 test2.exe 4040 test2.exe 4040 test2.exe 3844 test2.exe 3844 test2.exe 3844 test2.exe 3844 test2.exe 3844 test2.exe 3844 test2.exe 3844 test2.exe 4316 test2.exe 4316 test2.exe 4316 test2.exe 4316 test2.exe 4316 test2.exe 4316 test2.exe 4316 test2.exe 3044 test2.exe 3044 test2.exe 3044 test2.exe 3044 test2.exe 3044 test2.exe 3044 test2.exe 3044 test2.exe 2276 test2.exe 2276 test2.exe 2276 test2.exe 2276 test2.exe 2276 test2.exe 2276 test2.exe 2276 test2.exe 3020 test2.exe 3020 test2.exe 3020 test2.exe 3020 test2.exe 3020 test2.exe 3020 test2.exe 3020 test2.exe 1624 test2.exe 1624 test2.exe 1624 test2.exe 1624 test2.exe 1624 test2.exe 1624 test2.exe 1624 test2.exe 4776 test2.exe 4776 test2.exe 4776 test2.exe 4776 test2.exe 4776 test2.exe 4776 test2.exe 4776 test2.exe 3168 test2.exe 3168 test2.exe 3168 test2.exe 3168 test2.exe 3168 test2.exe 3168 test2.exe -
resource yara_rule behavioral4/files/0x000a000000023b8c-14.dat upx behavioral4/files/0x00140000000239c4-18.dat upx behavioral4/files/0x000a000000023b8a-21.dat upx behavioral4/files/0x000d000000023b83-20.dat upx behavioral4/files/0x00130000000239e7-33.dat upx behavioral4/files/0x000a000000023b8b-35.dat upx behavioral4/files/0x000a000000023b8d-31.dat upx behavioral4/memory/4040-30-0x0000000074410000-0x0000000074459000-memory.dmp upx behavioral4/memory/4040-29-0x0000000074460000-0x000000007452E000-memory.dmp upx behavioral4/memory/4040-28-0x0000000074530000-0x00000000745F8000-memory.dmp upx behavioral4/files/0x001a0000000239c6-23.dat upx behavioral4/memory/4040-22-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4040-41-0x00000000743E0000-0x0000000074404000-memory.dmp upx behavioral4/memory/4040-42-0x00000000742D0000-0x00000000743DA000-memory.dmp upx behavioral4/memory/4040-46-0x0000000073F70000-0x000000007423F000-memory.dmp upx behavioral4/memory/4040-43-0x0000000074240000-0x00000000742C8000-memory.dmp upx behavioral4/memory/4040-50-0x0000000074460000-0x000000007452E000-memory.dmp upx behavioral4/memory/4040-52-0x0000000074410000-0x0000000074459000-memory.dmp upx behavioral4/memory/4040-51-0x0000000074530000-0x00000000745F8000-memory.dmp upx behavioral4/memory/4040-49-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4040-58-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4040-59-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4040-78-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4040-87-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4040-101-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4040-111-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4040-130-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4040-157-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/3844-171-0x0000000074010000-0x0000000074098000-memory.dmp upx behavioral4/memory/3844-172-0x00000000743D0000-0x000000007469F000-memory.dmp upx behavioral4/memory/3844-170-0x00000000740A0000-0x00000000741AA000-memory.dmp upx behavioral4/memory/3844-169-0x00000000741B0000-0x00000000741D4000-memory.dmp upx behavioral4/memory/3844-168-0x00000000741E0000-0x0000000074229000-memory.dmp upx behavioral4/memory/3844-167-0x0000000074230000-0x00000000742FE000-memory.dmp upx behavioral4/memory/3844-166-0x0000000074300000-0x00000000743C8000-memory.dmp upx behavioral4/memory/3844-194-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/3844-203-0x0000000074300000-0x00000000743C8000-memory.dmp upx behavioral4/memory/3844-205-0x00000000741B0000-0x00000000741D4000-memory.dmp upx behavioral4/memory/3844-204-0x0000000074230000-0x00000000742FE000-memory.dmp upx behavioral4/memory/3844-207-0x00000000743D0000-0x000000007469F000-memory.dmp upx behavioral4/memory/3844-241-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4316-255-0x0000000072E40000-0x0000000072EC8000-memory.dmp upx behavioral4/memory/4316-256-0x0000000072FE0000-0x00000000732AF000-memory.dmp upx behavioral4/memory/4316-250-0x0000000074150000-0x0000000074218000-memory.dmp upx behavioral4/memory/4316-254-0x0000000072ED0000-0x0000000072FDA000-memory.dmp upx behavioral4/memory/4316-253-0x0000000073F40000-0x0000000073F64000-memory.dmp upx behavioral4/memory/4316-252-0x0000000074030000-0x0000000074079000-memory.dmp upx behavioral4/memory/4316-251-0x0000000074080000-0x000000007414E000-memory.dmp upx behavioral4/memory/4316-272-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/4316-281-0x0000000074150000-0x0000000074218000-memory.dmp upx behavioral4/memory/4316-283-0x0000000073F40000-0x0000000073F64000-memory.dmp upx behavioral4/memory/4316-282-0x0000000074080000-0x000000007414E000-memory.dmp upx behavioral4/memory/4316-285-0x0000000072FE0000-0x00000000732AF000-memory.dmp upx behavioral4/memory/4316-325-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/3044-340-0x0000000072E40000-0x0000000072EC8000-memory.dmp upx behavioral4/memory/3044-341-0x0000000072FE0000-0x00000000732AF000-memory.dmp upx behavioral4/memory/3044-339-0x0000000072ED0000-0x0000000072FDA000-memory.dmp upx behavioral4/memory/3044-338-0x0000000073F40000-0x0000000073F64000-memory.dmp upx behavioral4/memory/3044-337-0x0000000074030000-0x0000000074079000-memory.dmp upx behavioral4/memory/3044-336-0x0000000074080000-0x000000007414E000-memory.dmp upx behavioral4/memory/3044-335-0x0000000074150000-0x0000000074218000-memory.dmp upx behavioral4/memory/3044-334-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/3044-356-0x0000000000200000-0x0000000000604000-memory.dmp upx behavioral4/memory/3044-367-0x0000000073F40000-0x0000000073F64000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\test1 = "C:\\Users\\Admin\\AppData\\Local\\temp\\test1" a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 157 myexternalip.com 168 myexternalip.com 84 myexternalip.com 85 myexternalip.com 103 myexternalip.com 132 myexternalip.com 144 myexternalip.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
pid Process 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: RenamesItself 64 IoCs
pid Process 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2996 wrote to memory of 4040 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 92 PID 2996 wrote to memory of 4040 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 92 PID 2996 wrote to memory of 4040 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 92 PID 2996 wrote to memory of 3844 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 102 PID 2996 wrote to memory of 3844 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 102 PID 2996 wrote to memory of 3844 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 102 PID 2996 wrote to memory of 4316 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 109 PID 2996 wrote to memory of 4316 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 109 PID 2996 wrote to memory of 4316 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 109 PID 2996 wrote to memory of 3044 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 113 PID 2996 wrote to memory of 3044 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 113 PID 2996 wrote to memory of 3044 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 113 PID 2996 wrote to memory of 2276 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 114 PID 2996 wrote to memory of 2276 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 114 PID 2996 wrote to memory of 2276 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 114 PID 2996 wrote to memory of 3020 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 115 PID 2996 wrote to memory of 3020 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 115 PID 2996 wrote to memory of 3020 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 115 PID 2996 wrote to memory of 1624 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 PID 2996 wrote to memory of 1624 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 PID 2996 wrote to memory of 1624 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 PID 2996 wrote to memory of 4776 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 117 PID 2996 wrote to memory of 4776 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 117 PID 2996 wrote to memory of 4776 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 117 PID 2996 wrote to memory of 3168 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 118 PID 2996 wrote to memory of 3168 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 118 PID 2996 wrote to memory of 3168 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 118 PID 2996 wrote to memory of 2212 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 119 PID 2996 wrote to memory of 2212 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 119 PID 2996 wrote to memory of 2212 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 119 PID 2996 wrote to memory of 2304 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 122 PID 2996 wrote to memory of 2304 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 122 PID 2996 wrote to memory of 2304 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 122 PID 2996 wrote to memory of 4900 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 128 PID 2996 wrote to memory of 4900 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 128 PID 2996 wrote to memory of 4900 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 128 PID 2996 wrote to memory of 4044 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 129 PID 2996 wrote to memory of 4044 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 129 PID 2996 wrote to memory of 4044 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 129 PID 2996 wrote to memory of 412 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 132 PID 2996 wrote to memory of 412 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 132 PID 2996 wrote to memory of 412 2996 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 132
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe"C:\Users\Admin\AppData\Local\Temp\a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4040
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3844
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4316
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4776
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3168
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:2212
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:2304
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:4900
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:4044
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
PID:412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD55d919374dbddc43d8727da8e296542a3
SHA13f72e550f2c833a9d82e3b97cdf89dbaa64158cc
SHA2564d0edd91b5d93fcaf30883952c8ac9d0b840210e8be370e07ca07d009c3dd462
SHA512f4e3fb5e3e6ce605bbf5703d02414bfd4b7cdfbc6e1cf05db9ce809d4134bf034d8614951e84ea6e703d0d9018de59c81990751bb4ec42ad7c6a6b7cae7fcce8
-
Filesize
2.4MB
MD50ce4530144899e61e7151afe7810919f
SHA1f300561ff8bbd2b426926aced1e576bd2b91d001
SHA25659f1410ba288f348e46546682bc8ae589accfdb2abc49b0b59fed35ed9de32e5
SHA512595a94b645837f8627b703920cec6eda3e6103ae964c91c383679f00b712343b7f8d4656db6efdaceabe8c641cf45d6461ff77cc9fafa263880bc1a0763a83e6
-
Filesize
17.7MB
MD5b7630e025ed89104b699ff10805b5607
SHA1bd2d304aa3a24ad211875a9927dbde6b5b2c8f35
SHA25688168fa40f5acff043de1c87b8ac718747277f59cf35c0ae02ff243e58484b08
SHA512f1438e57e3eb6cee0a63a4140c4397a58dde39b04b7c1b54a5ff221329211a496947d04c1b0bf5b3df97a997b42d57281934c948660d9fcea1ebf08623b9d2fe
-
Filesize
5.1MB
MD5dfa8b5787509c317bbe7c4956ae4ee61
SHA1ae3d0d514a34206fdb6513ee37078433d87b9ce5
SHA256f2506aca75376ffe8cdf303113880a27a29ce70d9d22dba9f14c90adba9af6c5
SHA5121d8f58d122b458c75cf7dc499a2f93e2dcc2b0cab2fee7a267c60eff5d9e9a6a064e9f6b1398551809e895e14238d2bf7f58988ddaa05e3d1925d3f752102413
-
Filesize
17.7MB
MD53b24a2bb5c55392ac76f43e45d460b98
SHA10e7dd30f878d580311822dbb1aef3f9c82b1eaab
SHA2564c97a7c8488e830ffa74c0190a49f4c633113bb6fa304c6c072217699c651235
SHA5122b0f729a4a05d8c134883dedc4d61365f90c6fdff2f9285255dacaf636f99c07af66e86e4c751a83c82dc396bc2cc485f7b7763227f0519fcb86343885b42bf6
-
Filesize
3KB
MD510376ccffe2767c55b8bbbec648da33a
SHA1e9d5861e880e194e26939c36b398a57d10bea606
SHA2568420eff47de63af3e6736a586e1b4810b001729edd30f852fd3e8ed09ff44fbc
SHA5121f3a58483f8774c170b783fb83fd12feba5d3033978a80bab8430229192279682e55eb8a0eabb00945e8dfa10a169aa8bcb1a2528a87404b06759619b0d1367a
-
Filesize
8KB
MD581eaf0e446635325ab4aa184ad725b1c
SHA1ae78618be3b85547bb7c47cbe81334b0d6a124a2
SHA2569923f3e80e4c00291dd0c9057ac2af9c3dc63c63a7a3af3d0986296e09b9416b
SHA512d3fdc6879a749130a91812691e58a75536e1be44526f12f4e5f9f33361cfd5e9a9db42cc040b482697ac172253934fa1662ff416a66c74f043e27dc825bf6822
-
Filesize
232B
MD5c4436df2f37ad19408e0e4cd6f86af40
SHA13b9b7ca4378c72c69f37d4b72d6dc45d97617b56
SHA256f11cc05280c6b8c0b95e7aba74db6d9cb0df75278dca289241a4ce1bd611905c
SHA512567cc1c085f30a08aa2c3f89b08d013fb7cceeff8c210d7aab6e785ddb0f83ef9e7c690cc49b29cb0615c26dab180999921a64876bb8ae7084a00fbb6042f05c
-
Filesize
5KB
MD551e01a505ae87bb158b2bdb853fb3d92
SHA103d17b08649aa74eaa9377f99360c132272c1485
SHA256a6f3d941c92c604eb564bd679c2a930ec7785f3577948f6554c1b94b960b5039
SHA512e6ddbf321e2755fca0a6583c3341a3af4f6e6becd6694311c6eef4285cb34ddaa59a7adfe5abb7b2f80f4cc8064bc1a5b1520967a90a237ce3b9812e5ba60a8d
-
Filesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
157B
MD5439cd73927f46fde28540391feee8477
SHA1ee7fb2aeb7708378abda293b03f5c9ffb6dbc742
SHA256d1604e8bdb1a544638a97aa210b3e1eb12f1f159323d6b5942e03e11eafe9f75
SHA512c11ad07964e190696f500468d52c61d8af5f075e7828ef00d525f06937f4205ca58eb3eabe5fd9cc8fa88c1d191de919429b6bbf3cdbb2dda6eed7d1b9ca7319
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa