gh0strat | 260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897

General

Target

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
Size

2.7MB
MD5

b8a4c7f25256c11bcf931b1c31662912
SHA1

a02f2de4f195839b50728f1a116a8751c3895e8e
SHA256

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897
SHA512

b6136527b8b30e61951f9e4d3ccd192872938ba707a282d740e0065fb99372a0838fadb7531f8efcd969ec4cae50a9ab3185f0112d903d3fd7e22a7b540ea399
SSDEEP

49152:iYREXSVMKi32qff+XGwv2tP1zTPADnWPMklKu8bi4O8b8ITDnl13S:H2SVMK82qff+Wwv2tP1PPknK

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\259427088.bat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259427088.bat"	look2.exe

Executes dropped EXE 4 IoCs

Processes:

look2.exeHD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exeHD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exesvchcst.exe

pid	process
1752	look2.exe
2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
2720	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
2784	svchcst.exe

Loads dropped DLL 7 IoCs

Processes:

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exelook2.exesvchost.exeHD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exesvchcst.exe

pid	process
1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
1752	look2.exe
3004	svchost.exe
1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
3004	svchost.exe
2784	svchcst.exe

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\259427088.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

Processes:

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies data under HKEY_USERS 1 IoCs

Processes:

HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

description ioc process

Key created \REGISTRY\USER\ HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

description	ioc	process
Key created	\REGISTRY\USER\	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Modifies registry class 1 IoCs

Processes:

HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

pid process

1704 260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

pid	process
1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exeHD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

C:\Users\Admin\AppData\Local\Temp\260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
"C:\Users\Admin\AppData\Local\Temp\260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\look2.exe
C:\Users\Admin\AppData\Local\Temp\\look2.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1752

C:\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
C:\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2688

C:\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
"C:\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe" --channel=2688.0.1435252663 --type=renderer
3⤵
- Executes dropped EXE
PID:2720

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:2980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:3004

C:\Windows\SysWOW64\svchcst.exe
C:\Windows\system32\svchcst.exe "c:\windows\system32\259427088.bat",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.3MB

MD5
61d496c811032dce06ad7e9600d63291

SHA1
098268ad24cc010fbab04bc9890a3e42485e67d8

SHA256
1f4197132d2a288789567c5daa040b3971f40fa443e6c8009c1af9f1435a61e3

SHA512
03090cbb96e0a2919c176ab2159dd63a3946a17a7414db9293dc1215537b8dee9933d842ae6eefdec6989616d5be08bc8996370b5afbeb3c0e57e200c98d784b

Download Submit
\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Filesize
1.5MB

MD5
7a97aa40d8a3da4a9095873c72d524c5

SHA1
d219db66995e0548ea1226cb1806388b1ac718f7

SHA256
00d2ce2c35e8f2d31c2a8778c6e8846be3d1467cd1e66aa494571a14dea0e4d1

SHA512
16de6e0fdda9ebd7de996e97f73d9fad661c947320b604e5aafdcde50ee4582b1b07da98233b12dc76c464abe2104323c056b1ab477532ee10f5117cb03aa90c

Download Submit
\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
337KB

MD5
fb66e1e31fa1e6dfb21a50ccd11e0409

SHA1
6c45a0a115ec896eb14a531a44809b2a22cf8934

SHA256
5ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa

SHA512
58ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b

Download Submit
\Windows\SysWOW64\259427088.bat

Filesize
51KB

MD5
e036ed6062288b892b94ae0f44107903

SHA1
524cca6ae02a4509159650f7aabf0a929e0c8ac6

SHA256
808d25b0ed968f09658b772c5795a861a97a6c9911ca7103671f0a8404342741

SHA512
311d02900d7b996c96cf1fbfcbfc5a0c1081aa8e17e8e8b387f606b816c98dc9b0908934fa467c6fc4065341a05f5893faad966b24153fcf90109b96203256d8

Download Submit
\Windows\SysWOW64\svchcst.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/2720-33-0x0000000000F70000-0x0000000000F72000-memory.dmp

Filesize
8KB

Download

description	pid	process	target process
PID 1704 wrote to memory of 1752	1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	look2.exe
PID 1704 wrote to memory of 1752	1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	look2.exe
PID 1704 wrote to memory of 1752	1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	look2.exe
PID 1704 wrote to memory of 1752	1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	look2.exe
PID 1704 wrote to memory of 2688	1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 1704 wrote to memory of 2688	1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 1704 wrote to memory of 2688	1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 1704 wrote to memory of 2688	1704	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2688 wrote to memory of 2720	2688	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads