xworm | 349b3468ba55fa9b2d4e800323a28b7b388663cf54ab35e688ae67a9819e02b6

General

Target

XWorm.exe
Size

201KB
MD5

acf8853358a7aa1b667fea958b893a5d
SHA1

bb13587ce9f55a75765fe12994debb6e07a5810a
SHA256

349b3468ba55fa9b2d4e800323a28b7b388663cf54ab35e688ae67a9819e02b6
SHA512

cb8a46077594042ba43d85acef88d6e0a6c9e9f2c7e9c6c185ecd5d1c36a5f71c75759dbbbda4f3b47f80131f48b3cba808d487b11a2eaceecbdf9c19afe2c84
SSDEEP

3072:fNE2oXkEPibC1/EaOTPTVdwtA2ewhLapuvpAsZOyMqmyBeYVYv:fjEPib4cYP/GWGwqqm1

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:37915

5.39.43.50:37915

de-engines.gl.at.ply.gg:37915

these-accommodation.gl.at.ply.gg:37915

Attributes

Install_directory
%AppData%
install_file
dllhost.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2312-188-0x0000000002180000-0x000000000218E000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2312-1-0x0000000000260000-0x0000000000298000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2548 powershell.exe
1156 powershell.exe
812 powershell.exe
2508 powershell.exe

pid	process
2548	powershell.exe
1156	powershell.exe
812	powershell.exe
2508	powershell.exe

Drops startup file 2 IoCs

Processes:

XWorm.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.lnk	XWorm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.lnk	XWorm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XWorm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe"	XWorm.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
4	ip-api.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exechrome.exepowershell.exeXWorm.exe

pid process

2508 powershell.exe
2548 powershell.exe
1156 powershell.exe
2356 chrome.exe
2356 chrome.exe
812 powershell.exe
2312 XWorm.exe

pid	process
2508	powershell.exe
2548	powershell.exe
1156	powershell.exe
2356	chrome.exe
2356	chrome.exe
812	powershell.exe
2312	XWorm.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

XWorm.exepowershell.exepowershell.exepowershell.exechrome.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2312	XWorm.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeDebugPrivilege	812	powershell.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeDebugPrivilege	2312	XWorm.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XWorm.exe

pid process

2312 XWorm.exe

pid	process
2312	XWorm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

XWorm.exechrome.exe

description	pid	process	target process
PID 2312 wrote to memory of 2508	2312	XWorm.exe	powershell.exe
PID 2312 wrote to memory of 2508	2312	XWorm.exe	powershell.exe
PID 2312 wrote to memory of 2508	2312	XWorm.exe	powershell.exe
PID 2312 wrote to memory of 2548	2312	XWorm.exe	powershell.exe
PID 2312 wrote to memory of 2548	2312	XWorm.exe	powershell.exe
PID 2312 wrote to memory of 2548	2312	XWorm.exe	powershell.exe
PID 2356 wrote to memory of 2368	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2368	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2368	2356	chrome.exe	chrome.exe
PID 2312 wrote to memory of 1156	2312	XWorm.exe	powershell.exe
PID 2312 wrote to memory of 1156	2312	XWorm.exe	powershell.exe
PID 2312 wrote to memory of 1156	2312	XWorm.exe	powershell.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2568	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2556	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2556	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2556	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe
PID 2356 wrote to memory of 2688	2356	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\XWorm.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWorm.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\dllhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feeff49758,0x7feeff49768,0x7feeff49778
2⤵
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:2
2⤵
PID:2568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:8
2⤵
PID:2556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:8
2⤵
PID:2688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:1
2⤵
PID:636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:1
2⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1584 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:2
2⤵
PID:1560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2188 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:1
2⤵
PID:1548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:8
2⤵
PID:2604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3552 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:8
2⤵
PID:2892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3808 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:8
2⤵
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2116 --field-trial-handle=1384,i,8242108405280523933,16934324372994531749,131072 /prefetch:1
2⤵
PID:1640

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
363B

MD5
771a0285f7fd09fafd64d9dc4a75c185

SHA1
1217df2c092f4fab67ff38d17c62c6e68e71be39

SHA256
152c57046b15f12b305a6a3f6352c3e1597d36cbe97f125e4f295521e7cdcfb0

SHA512
cca80669839127eb874d3753f7966b764ff9220bf2646a52023799675ba3b18121344bbed3e5516ad98756a9bc546678fb116d6b7176f30f3a28dbf34efca91e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
a8f3d383c1889642f585f42784802b1d

SHA1
1076fd3931587ac3b2f43214e1cd9bb07bbac79d

SHA256
c8d26d371e5ec86fd33c58c59ef4731e66f41d8e6b3dbbdd2ba5a9972116098f

SHA512
566474a51f846fcf44b019e03c170cf8a0a54237ba7d8c948c1aad34cc29bc0e8c7c4f2db8498adf4ce45a17a20bfda121715f1f84179a0ef60dc1b076b8d984

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
980fe709e3a50286b005c530bb33172b

SHA1
7492516a74fc7b4eda08dea04a5879ec8bfc2d56

SHA256
3d97450f85eafc54dc44a4af02f02f5ad5208cc5f1a845287114813601b876b3

SHA512
111982405a66b52d8572ea1c9967648f6d45a53c0e1265afcb2c4f5cb21304cba9b89ac9008b510359d9c4b3f071db020cf58873d0c7624b74e0784c66fab448

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
80ae00830aef704dcbf67b3f73efd067

SHA1
d58645e3a2e36ac2cad36ed363e00ca97d045f60

SHA256
c6501f7fcd615f64109bf0ca68dc3e1db4f1b9e002a59f18c1becd6a3502d61f

SHA512
f74699e1b064e7e7975ae55b0b251c27121e64d3d6d6cf5043976704fb2521f1e5030b8ce0ee69fcc493bc82c468837f179a5b16494da426a3b0ef036a5e1fa5

Download Submit
\??\pipe\crashpad_2356_PQXSGWTQQHBQLEQL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2312-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/2312-110-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2312-2-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2312-172-0x00000000020F0000-0x00000000020FA000-memory.dmp

Filesize
40KB

Download
memory/2312-1-0x0000000000260000-0x0000000000298000-memory.dmp

Filesize
224KB

Download
memory/2312-188-0x0000000002180000-0x000000000218E000-memory.dmp

Filesize
56KB

Download
memory/2508-8-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Filesize
32KB

Download
memory/2508-7-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/2548-15-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/2548-14-0x000000001B180000-0x000000001B462000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads