ardamax | 5c75ee21c19716d90fe00a16f5b879281c07fc3c6bcab6e3ab8baba306d12a5c

General

Target

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
Size

678KB
MD5

9025c7ce34c69fffec9365167918383e
SHA1

438d4ed9dcc92a02ecdfdbbd50cc28bad371c534
SHA256

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368
SHA512

7a024cb3070abd12051f1fa30aeb683021a87a5bfad4fc77561b060dd39e0f83fdea80dea1c93fdd8827722d82a56fbf9f89f98d0bdf85695e3b440e38cf3d42
SSDEEP

12288:V3TdtLW5WIj1YSSdFxd4E4roEgFRRBSXyMzBUWb9lx/9AgHLo8OW+rBj:9Dsj1dENV43gFRRBcJ9nPx/igrp+1

Score

10^/10

ardamax aspackv2 discovery evasion keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\28463\svchost.exe	family_ardamax

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe regsvr.exe"	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

Disables Task Manager via registry modification
evasion

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\SysWOW64\svchost .exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

4376 svchost.exe

pid	process
4376	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msn Messsenger = "C:\\Windows\\system32\\regsvr.exe"	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost Agent = "C:\\Windows\\SysWOW64\\28463\\svchost.exe"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

description	ioc	process
File opened (read-only)	\??\b:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\g:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\o:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\q:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\r:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\a:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\j:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\k:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\l:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\p:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\z:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\m:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\u:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\w:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\x:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\y:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\t:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\v:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\e:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\h:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\i:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\n:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened (read-only)	\??\s:	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

AutoIT Executable 11 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/4440-27-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-35-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-58-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-59-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-60-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-61-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-62-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-63-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-64-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-65-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe
behavioral2/memory/4440-66-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe

Drops file in System32 directory 13 IoCs

Processes:

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\28463\svchost.001	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened for modification	C:\Windows\SysWOW64\regsvr.exe	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened for modification	C:\Windows\SysWOW64\svchost .exe	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File created	C:\Windows\SysWOW64\28463\svchost.001	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened for modification	C:\Windows\SysWOW64\28463	svchost.exe
File opened for modification	C:\Windows\SysWOW64\setting.ini	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened for modification	C:\Windows\SysWOW64\28463\svchost.exe	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened for modification	C:\Windows\SysWOW64\28463	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File created	C:\Windows\SysWOW64\28463\svchost.exe	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File created	C:\Windows\SysWOW64\regsvr.exe	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File created	C:\Windows\SysWOW64\svchost .exe	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File opened for modification	C:\Windows\SysWOW64\setup.ini	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File created	C:\Windows\SysWOW64\setting.ini	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

Drops file in Windows directory 2 IoCs

Processes:

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

description	ioc	process
File opened for modification	C:\Windows\regsvr.exe	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
File created	C:\Windows\regsvr.exe	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

pid	process
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: 33 4376 svchost.exe
Token: SeIncBasePriorityPrivilege 4376 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

4376 svchost.exe

description	pid	process
Token: 33	4376	svchost.exe
Token: SeIncBasePriorityPrivilege	4376	svchost.exe

pid	process
4376	svchost.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.execmd.execmd.exe

description	pid	process	target process
PID 4440 wrote to memory of 4376	4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe	svchost.exe
PID 4440 wrote to memory of 4376	4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe	svchost.exe
PID 4440 wrote to memory of 4376	4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe	svchost.exe
PID 4440 wrote to memory of 3496	4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe	cmd.exe
PID 4440 wrote to memory of 3496	4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe	cmd.exe
PID 4440 wrote to memory of 3496	4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe	cmd.exe
PID 3496 wrote to memory of 4560	3496	cmd.exe	at.exe
PID 3496 wrote to memory of 4560	3496	cmd.exe	at.exe
PID 3496 wrote to memory of 4560	3496	cmd.exe	at.exe
PID 4440 wrote to memory of 1604	4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe	cmd.exe
PID 4440 wrote to memory of 1604	4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe	cmd.exe
PID 4440 wrote to memory of 1604	4440	3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe	cmd.exe
PID 1604 wrote to memory of 4468	1604	cmd.exe	at.exe
PID 1604 wrote to memory of 4468	1604	cmd.exe	at.exe
PID 1604 wrote to memory of 4468	1604	cmd.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe
"C:\Users\Admin\AppData\Local\Temp\3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\SysWOW64\28463\svchost.exe
C:\Windows\system32\28463\svchost.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
2⤵
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\SysWOW64\at.exe
AT /delete /yes
3⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
3⤵
PID:4468

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\svchost.001
Filesize
2KB

MD5
c427f41a9eb12166c278da8fed8a0c4a

SHA1
e0e1d1c8f6b58675a544f1461997cfc37a2e6c63

SHA256
ee74d1ba7e74e916f57ac4134aa5aa6eb7f920e7dae3b4cdb75af9225da616c6

SHA512
ea2e49983e04afaa0eec5b28eeed1e9c804326b49933e69962805c10a405cb7dd87061e50355f395e74107cb6ca674d4c8c0000ef13505ec58b1d7dec873aa85

Download Submit
C:\Windows\SysWOW64\28463\svchost.exe
Filesize
513KB

MD5
0c7a714b8e1d2ead2afc90dcc43bbe18

SHA1
66736613f22771f5da5606ed8c80b572b3f5c103

SHA256
800bdf00e09f302a17e22d26dffbea037e3c077ef9f6d1d585c114f079397a9e

SHA512
35db0de86c168eb6302dcbaa1e1f9ec96b5a8814e7067e1a7bb682e9f35fc06c51148a08e6f7df1e8caeb2effde555c53966a8922e8fef6b7ce194dc81c984b4

Download Submit
C:\Windows\SysWOW64\setting.ini
Filesize
2B

MD5
e0aa021e21dddbd6d8cecec71e9cf564

SHA1
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7

SHA256
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

SHA512
900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874

Download Submit
C:\Windows\SysWOW64\svchost .exe
Filesize
678KB

MD5
9025c7ce34c69fffec9365167918383e

SHA1
438d4ed9dcc92a02ecdfdbbd50cc28bad371c534

SHA256
3d4c151e2d8b7ce62eb3363f19fcee86cc339e8c23a011cc000a0c476535c368

SHA512
7a024cb3070abd12051f1fa30aeb683021a87a5bfad4fc77561b060dd39e0f83fdea80dea1c93fdd8827722d82a56fbf9f89f98d0bdf85695e3b440e38cf3d42

Download Submit
memory/4376-57-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4376-21-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4440-60-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-35-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-58-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-59-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-27-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-61-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-62-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-63-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-64-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-65-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4440-66-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads