gh0strat | 2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae

Modify Registry

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240599703.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exeRemote Data.exe

pid	process
920	R.exe
768	N.exe
3916	TXPlatfor.exe
1816	TXPlatfor.exe
1672	HD_2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe
5088	Remote Data.exe

Loads dropped DLL 3 IoCs

Processes:

R.exesvchost.exeRemote Data.exe

pid process

920 R.exe
5104 svchost.exe
5088 Remote Data.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/768-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/768-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/768-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/768-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3916-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1816-38-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3916-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1816-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1816-44-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3916-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

HD_2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kwallpaper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kwallpaper.exe\" -autorun"	HD_2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

Processes:

svchost.exeN.exeR.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\240599703.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

Processes:

2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4784 PING.EXE

pid	process
4784	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe

pid	process
860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe
860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

1816 TXPlatfor.exe

pid	process
1816	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	768	N.exe
Token: SeLoadDriverPrivilege	1816	TXPlatfor.exe
Token: 33	1816	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	1816	TXPlatfor.exe
Token: 33	1816	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	1816	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe

pid	process
860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe
860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exeN.exeTXPlatfor.execmd.exesvchost.exe

description	pid	process	target process
PID 860 wrote to memory of 920	860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe	R.exe
PID 860 wrote to memory of 920	860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe	R.exe
PID 860 wrote to memory of 920	860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe	R.exe
PID 860 wrote to memory of 768	860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe	N.exe
PID 860 wrote to memory of 768	860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe	N.exe
PID 860 wrote to memory of 768	860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe	N.exe
PID 768 wrote to memory of 1172	768	N.exe	cmd.exe
PID 768 wrote to memory of 1172	768	N.exe	cmd.exe
PID 768 wrote to memory of 1172	768	N.exe	cmd.exe
PID 3916 wrote to memory of 1816	3916	TXPlatfor.exe	TXPlatfor.exe
PID 3916 wrote to memory of 1816	3916	TXPlatfor.exe	TXPlatfor.exe
PID 3916 wrote to memory of 1816	3916	TXPlatfor.exe	TXPlatfor.exe
PID 860 wrote to memory of 1672	860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe	HD_2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe
PID 860 wrote to memory of 1672	860	2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe	HD_2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe
PID 1172 wrote to memory of 4784	1172	cmd.exe	PING.EXE
PID 1172 wrote to memory of 4784	1172	cmd.exe	PING.EXE
PID 1172 wrote to memory of 4784	1172	cmd.exe	PING.EXE
PID 5104 wrote to memory of 5088	5104	svchost.exe	Remote Data.exe
PID 5104 wrote to memory of 5088	5104	svchost.exe	Remote Data.exe
PID 5104 wrote to memory of 5088	5104	svchost.exe	Remote Data.exe

C:\Users\Admin\AppData\Local\Temp\2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe
"C:\Users\Admin\AppData\Local\Temp\2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:920

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:4784

C:\Users\Admin\AppData\Local\Temp\HD_2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe
C:\Users\Admin\AppData\Local\Temp\HD_2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1672

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:2204

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240599703.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5088

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry