gh0strat | 5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0

Modify Registry

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259400646.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exeRemote Data.exe

pid	process
1608	R.exe
3012	N.exe
2740	TXPlatfor.exe
2708	TXPlatfor.exe
2496	HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
1948	Remote Data.exe

Loads dropped DLL 11 IoCs

Processes:

5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exeR.exesvchost.exeTXPlatfor.exeHD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exeRemote Data.exe

pid	process
2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
1608	R.exe
2648	svchost.exe
2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
2740	TXPlatfor.exe
2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
2496	HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
1192
2648	svchost.exe
1948	Remote Data.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3012-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/3012-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/3012-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2708-45-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2708-49-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2708-50-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\kwallpaper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kwallpaper.exe\" -autorun"	HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

Processes:

svchost.exeN.exeR.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\259400646.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

evasion

Processes:

HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\UserPreferencesMask = 9e3e078012000000	HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2088 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe

pid process

2056 5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

2708 TXPlatfor.exe

pid	process
2088	PING.EXE

pid	process
2708	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	3012	N.exe
Token: SeLoadDriverPrivilege	2708	TXPlatfor.exe
Token: 33	2708	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2708	TXPlatfor.exe
Token: 33	2708	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2708	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe

pid	process
2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exeN.exeTXPlatfor.execmd.exesvchost.exe

description	pid	process	target process
PID 2056 wrote to memory of 1608	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	R.exe
PID 2056 wrote to memory of 1608	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	R.exe
PID 2056 wrote to memory of 1608	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	R.exe
PID 2056 wrote to memory of 1608	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	R.exe
PID 2056 wrote to memory of 3012	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	N.exe
PID 2056 wrote to memory of 3012	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	N.exe
PID 2056 wrote to memory of 3012	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	N.exe
PID 2056 wrote to memory of 3012	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	N.exe
PID 2056 wrote to memory of 3012	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	N.exe
PID 2056 wrote to memory of 3012	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	N.exe
PID 2056 wrote to memory of 3012	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	N.exe
PID 3012 wrote to memory of 2828	3012	N.exe	cmd.exe
PID 3012 wrote to memory of 2828	3012	N.exe	cmd.exe
PID 3012 wrote to memory of 2828	3012	N.exe	cmd.exe
PID 3012 wrote to memory of 2828	3012	N.exe	cmd.exe
PID 2740 wrote to memory of 2708	2740	TXPlatfor.exe	TXPlatfor.exe
PID 2740 wrote to memory of 2708	2740	TXPlatfor.exe	TXPlatfor.exe
PID 2740 wrote to memory of 2708	2740	TXPlatfor.exe	TXPlatfor.exe
PID 2740 wrote to memory of 2708	2740	TXPlatfor.exe	TXPlatfor.exe
PID 2740 wrote to memory of 2708	2740	TXPlatfor.exe	TXPlatfor.exe
PID 2740 wrote to memory of 2708	2740	TXPlatfor.exe	TXPlatfor.exe
PID 2740 wrote to memory of 2708	2740	TXPlatfor.exe	TXPlatfor.exe
PID 2056 wrote to memory of 2496	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
PID 2056 wrote to memory of 2496	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
PID 2056 wrote to memory of 2496	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
PID 2056 wrote to memory of 2496	2056	5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe	HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
PID 2828 wrote to memory of 2088	2828	cmd.exe	PING.EXE
PID 2828 wrote to memory of 2088	2828	cmd.exe	PING.EXE
PID 2828 wrote to memory of 2088	2828	cmd.exe	PING.EXE
PID 2828 wrote to memory of 2088	2828	cmd.exe	PING.EXE
PID 2648 wrote to memory of 1948	2648	svchost.exe	Remote Data.exe
PID 2648 wrote to memory of 1948	2648	svchost.exe	Remote Data.exe
PID 2648 wrote to memory of 1948	2648	svchost.exe	Remote Data.exe
PID 2648 wrote to memory of 1948	2648	svchost.exe	Remote Data.exe

C:\Users\Admin\AppData\Local\Temp\5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
"C:\Users\Admin\AppData\Local\Temp\5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1608

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2088

C:\Users\Admin\AppData\Local\Temp\HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
C:\Users\Admin\AppData\Local\Temp\HD_5ecf941486b7a2f918496e8aabfc48d4aca99204afc0b7a8ccfc0ce96dd9a5f0.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
PID:2496

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:1356

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259400646.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry