gh0strat | 260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897

General

Target

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
Size

2.7MB
MD5

b8a4c7f25256c11bcf931b1c31662912
SHA1

a02f2de4f195839b50728f1a116a8751c3895e8e
SHA256

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897
SHA512

b6136527b8b30e61951f9e4d3ccd192872938ba707a282d740e0065fb99372a0838fadb7531f8efcd969ec4cae50a9ab3185f0112d903d3fd7e22a7b540ea399
SSDEEP

49152:iYREXSVMKi32qff+XGwv2tP1zTPADnWPMklKu8bi4O8b8ITDnl13S:H2SVMK82qff+Wwv2tP1PPknK

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\240656640.bat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240656640.bat"	look2.exe

Executes dropped EXE 4 IoCs

Processes:

look2.exeHD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exeHD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exesvchcst.exe

pid	process
3160	look2.exe
2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
3428	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
1296	svchcst.exe

Loads dropped DLL 3 IoCs

Processes:

look2.exesvchost.exesvchcst.exe

pid process

3160 look2.exe
4888 svchost.exe
1296 svchcst.exe

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\240656640.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

Processes:

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies data under HKEY_USERS 1 IoCs

Processes:

HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

description ioc process

Key created \REGISTRY\USER\ HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

description	ioc	process
Key created	\REGISTRY\USER\	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Modifies registry class 1 IoCs

Processes:

HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

pid	process
3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

pid	process
3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exeHD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

C:\Users\Admin\AppData\Local\Temp\260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
"C:\Users\Admin\AppData\Local\Temp\260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844

C:\Users\Admin\AppData\Local\Temp\look2.exe
C:\Users\Admin\AppData\Local\Temp\\look2.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3160

C:\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
C:\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2528

C:\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
"C:\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe" --channel=2528.0.2086958551 --type=renderer
3⤵
- Executes dropped EXE
PID:3428

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:2172

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:4888

C:\Windows\SysWOW64\svchcst.exe
C:\Windows\system32\svchcst.exe "c:\windows\system32\240656640.bat",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Filesize
1.5MB

MD5
7a97aa40d8a3da4a9095873c72d524c5

SHA1
d219db66995e0548ea1226cb1806388b1ac718f7

SHA256
00d2ce2c35e8f2d31c2a8778c6e8846be3d1467cd1e66aa494571a14dea0e4d1

SHA512
16de6e0fdda9ebd7de996e97f73d9fad661c947320b604e5aafdcde50ee4582b1b07da98233b12dc76c464abe2104323c056b1ab477532ee10f5117cb03aa90c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.3MB

MD5
61d496c811032dce06ad7e9600d63291

SHA1
098268ad24cc010fbab04bc9890a3e42485e67d8

SHA256
1f4197132d2a288789567c5daa040b3971f40fa443e6c8009c1af9f1435a61e3

SHA512
03090cbb96e0a2919c176ab2159dd63a3946a17a7414db9293dc1215537b8dee9933d842ae6eefdec6989616d5be08bc8996370b5afbeb3c0e57e200c98d784b

Download Submit
C:\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
337KB

MD5
fb66e1e31fa1e6dfb21a50ccd11e0409

SHA1
6c45a0a115ec896eb14a531a44809b2a22cf8934

SHA256
5ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa

SHA512
58ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b

Download Submit
C:\Windows\SysWOW64\240656640.bat

Filesize
51KB

MD5
e036ed6062288b892b94ae0f44107903

SHA1
524cca6ae02a4509159650f7aabf0a929e0c8ac6

SHA256
808d25b0ed968f09658b772c5795a861a97a6c9911ca7103671f0a8404342741

SHA512
311d02900d7b996c96cf1fbfcbfc5a0c1081aa8e17e8e8b387f606b816c98dc9b0908934fa467c6fc4065341a05f5893faad966b24153fcf90109b96203256d8

Download Submit
C:\Windows\SysWOW64\svchcst.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit

description	pid	process	target process
PID 3844 wrote to memory of 3160	3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	look2.exe
PID 3844 wrote to memory of 3160	3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	look2.exe
PID 3844 wrote to memory of 3160	3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	look2.exe
PID 3844 wrote to memory of 2528	3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 3844 wrote to memory of 2528	3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 3844 wrote to memory of 2528	3844	260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe
PID 2528 wrote to memory of 3428	2528	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe	HD_260209cefc32912207ec3f23fdd66b3b3442c8d25db0fc0c7cd2957da3e2d897.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads