gh0strat | f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80

Modify Registry

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240604562.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exeSynaptics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 9 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exeSynaptics.exe._cache_Synaptics.exeRemote Data.exe

pid	process
2444	R.exe
2232	N.exe
3424	TXPlatfor.exe
3728	TXPlatfor.exe
940	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
3112	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
1300	Synaptics.exe
3544	._cache_Synaptics.exe
4808	Remote Data.exe

Loads dropped DLL 3 IoCs

Processes:

R.exesvchost.exeRemote Data.exe

pid process

2444 R.exe
2252 svchost.exe
4808 Remote Data.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2232-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2232-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2232-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2232-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3728-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3728-43-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3728-45-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3424-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3424-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3424-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	upx
behavioral2/memory/3112-122-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral2/memory/3112-251-0x0000000000400000-0x0000000000650000-memory.dmp	upx
behavioral2/memory/3544-253-0x0000000000400000-0x0000000000650000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

Drops file in System32 directory 6 IoCs

Processes:

svchost.exeN.exeR.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\240604562.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

Processes:

f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

Synaptics.exeHD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1648 PING.EXE

pid	process
1648	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

pid	process
2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

3728 TXPlatfor.exe

pid	process
3728	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2232	N.exe
Token: SeLoadDriverPrivilege	3728	TXPlatfor.exe
Token: 33	3728	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	3728	TXPlatfor.exe
Token: 33	3728	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	3728	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe._cache_Synaptics.exe

pid	process
2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
3112	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
3112	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
3544	._cache_Synaptics.exe
3544	._cache_Synaptics.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exeTXPlatfor.exeN.execmd.exeHD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exeSynaptics.exesvchost.exe

description	pid	process	target process
PID 2804 wrote to memory of 2444	2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	WaaSMedicAgent.exe
PID 2804 wrote to memory of 2444	2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	WaaSMedicAgent.exe
PID 2804 wrote to memory of 2444	2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	WaaSMedicAgent.exe
PID 2804 wrote to memory of 2232	2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 2804 wrote to memory of 2232	2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 2804 wrote to memory of 2232	2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	N.exe
PID 3424 wrote to memory of 3728	3424	TXPlatfor.exe	TXPlatfor.exe
PID 3424 wrote to memory of 3728	3424	TXPlatfor.exe	TXPlatfor.exe
PID 3424 wrote to memory of 3728	3424	TXPlatfor.exe	TXPlatfor.exe
PID 2232 wrote to memory of 1660	2232	N.exe	cmd.exe
PID 2232 wrote to memory of 1660	2232	N.exe	cmd.exe
PID 2232 wrote to memory of 1660	2232	N.exe	cmd.exe
PID 2804 wrote to memory of 940	2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2804 wrote to memory of 940	2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 2804 wrote to memory of 940	2804	f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 1660 wrote to memory of 1648	1660	cmd.exe	PING.EXE
PID 1660 wrote to memory of 1648	1660	cmd.exe	PING.EXE
PID 1660 wrote to memory of 1648	1660	cmd.exe	PING.EXE
PID 940 wrote to memory of 3112	940	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 940 wrote to memory of 3112	940	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 940 wrote to memory of 3112	940	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
PID 940 wrote to memory of 1300	940	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	Synaptics.exe
PID 940 wrote to memory of 1300	940	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	Synaptics.exe
PID 940 wrote to memory of 1300	940	HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe	Synaptics.exe
PID 1300 wrote to memory of 3544	1300	Synaptics.exe	._cache_Synaptics.exe
PID 1300 wrote to memory of 3544	1300	Synaptics.exe	._cache_Synaptics.exe
PID 1300 wrote to memory of 3544	1300	Synaptics.exe	._cache_Synaptics.exe
PID 2252 wrote to memory of 4808	2252	svchost.exe	Remote Data.exe
PID 2252 wrote to memory of 4808	2252	svchost.exe	Remote Data.exe
PID 2252 wrote to memory of 4808	2252	svchost.exe	Remote Data.exe

C:\Users\Admin\AppData\Local\Temp\f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
"C:\Users\Admin\AppData\Local\Temp\f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2444

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:1648

C:\Users\Admin\AppData\Local\Temp\HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
C:\Users\Admin\AppData\Local\Temp\HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_HD_f93ede0db4b21476ebe2a35eb20fcbe06c53c28898e3053a1198d07e3eaf0f80.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3112

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1300

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:1244

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240604562.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4808

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 61053e9a2fe25aae47b9306fdfcb62d8 kwFPriAkU02W2eUGQQSW6A.0.1.0.0.0
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry