gh0strat | f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80

Modify Registry

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259398556.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 9 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exeSynaptics.exe._cache_Synaptics.exeRemote Data.exe

pid	process
880	R.exe
1648	N.exe
1976	TXPlatfor.exe
2720	TXPlatfor.exe
2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2936	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2900	Synaptics.exe
2796	._cache_Synaptics.exe
2980	Remote Data.exe

Loads dropped DLL 17 IoCs

Processes:

f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exeR.exesvchost.exeTXPlatfor.exeHD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exeSynaptics.exeRemote Data.exe

pid	process
2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
880	R.exe
1664	svchost.exe
2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
1976	TXPlatfor.exe
2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2900	Synaptics.exe
2900	Synaptics.exe
2900	Synaptics.exe
1664	svchost.exe
2980	Remote Data.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1648-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/1648-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/1648-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2720-46-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2720-48-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2720-54-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	upx
behavioral1/memory/2936-75-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-100-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2900-97-0x0000000005670000-0x00000000058C0000-memory.dmp	upx
behavioral1/memory/2936-107-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-109-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-113-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-117-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2936-119-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-121-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-124-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-129-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-132-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-164-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-167-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-171-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-174-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-178-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-181-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral1/memory/2796-185-0x0000000000400000-0x0000000000650000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

Drops file in System32 directory 6 IoCs

Processes:

R.exesvchost.exeN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\259398556.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2600 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

pid process

2300 f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

2720 TXPlatfor.exe

pid	process
2600	PING.EXE

pid	process
2720	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1648	N.exe
Token: SeLoadDriverPrivilege	2720	TXPlatfor.exe
Token: 33	2720	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2720	TXPlatfor.exe
Token: 33	2720	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2720	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe._cache_Synaptics.exe

pid	process
2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2936	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2936	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2796	._cache_Synaptics.exe
2796	._cache_Synaptics.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exeN.exeTXPlatfor.execmd.exeHD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exeSynaptics.exesvchost.exe

description	pid	process	target process
PID 2300 wrote to memory of 880	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	R.exe
PID 2300 wrote to memory of 880	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	R.exe
PID 2300 wrote to memory of 880	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	R.exe
PID 2300 wrote to memory of 880	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	R.exe
PID 2300 wrote to memory of 1648	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 2300 wrote to memory of 1648	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 2300 wrote to memory of 1648	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 2300 wrote to memory of 1648	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 2300 wrote to memory of 1648	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 2300 wrote to memory of 1648	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 2300 wrote to memory of 1648	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 1648 wrote to memory of 2656	1648	N.exe	cmd.exe
PID 1648 wrote to memory of 2656	1648	N.exe	cmd.exe
PID 1648 wrote to memory of 2656	1648	N.exe	cmd.exe
PID 1648 wrote to memory of 2656	1648	N.exe	cmd.exe
PID 1976 wrote to memory of 2720	1976	TXPlatfor.exe	TXPlatfor.exe
PID 1976 wrote to memory of 2720	1976	TXPlatfor.exe	TXPlatfor.exe
PID 1976 wrote to memory of 2720	1976	TXPlatfor.exe	TXPlatfor.exe
PID 1976 wrote to memory of 2720	1976	TXPlatfor.exe	TXPlatfor.exe
PID 1976 wrote to memory of 2720	1976	TXPlatfor.exe	TXPlatfor.exe
PID 1976 wrote to memory of 2720	1976	TXPlatfor.exe	TXPlatfor.exe
PID 1976 wrote to memory of 2720	1976	TXPlatfor.exe	TXPlatfor.exe
PID 2300 wrote to memory of 2616	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2300 wrote to memory of 2616	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2300 wrote to memory of 2616	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2300 wrote to memory of 2616	2300	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2656 wrote to memory of 2600	2656	cmd.exe	PING.EXE
PID 2656 wrote to memory of 2600	2656	cmd.exe	PING.EXE
PID 2656 wrote to memory of 2600	2656	cmd.exe	PING.EXE
PID 2656 wrote to memory of 2600	2656	cmd.exe	PING.EXE
PID 2616 wrote to memory of 2936	2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2616 wrote to memory of 2936	2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2616 wrote to memory of 2936	2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2616 wrote to memory of 2936	2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2616 wrote to memory of 2900	2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	Synaptics.exe
PID 2616 wrote to memory of 2900	2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	Synaptics.exe
PID 2616 wrote to memory of 2900	2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	Synaptics.exe
PID 2616 wrote to memory of 2900	2616	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	Synaptics.exe
PID 2900 wrote to memory of 2796	2900	Synaptics.exe	._cache_Synaptics.exe
PID 2900 wrote to memory of 2796	2900	Synaptics.exe	._cache_Synaptics.exe
PID 2900 wrote to memory of 2796	2900	Synaptics.exe	._cache_Synaptics.exe
PID 2900 wrote to memory of 2796	2900	Synaptics.exe	._cache_Synaptics.exe
PID 1664 wrote to memory of 2980	1664	svchost.exe	Remote Data.exe
PID 1664 wrote to memory of 2980	1664	svchost.exe	Remote Data.exe
PID 1664 wrote to memory of 2980	1664	svchost.exe	Remote Data.exe
PID 1664 wrote to memory of 2980	1664	svchost.exe	Remote Data.exe

C:\Users\Admin\AppData\Local\Temp\f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
"C:\Users\Admin\AppData\Local\Temp\f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:880

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2600

C:\Users\Admin\AppData\Local\Temp\HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
C:\Users\Admin\AppData\Local\Temp\HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2616

C:\Users\Admin\AppData\Local\Temp\._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2936

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:2180

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259398556.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry