sality | 1e64123f2c7f8cf18b45ab19f159bde33c239405d1d99e06e261ed0cd11dbbdf

General

Target

1516df5fcbe41b1cf6e2755fcd37b380_NeikiAnalytics.dll
Size

120KB
MD5

1516df5fcbe41b1cf6e2755fcd37b380
SHA1

f0087befdbcbb0e07784404e221ad02ebbc0525e
SHA256

1e64123f2c7f8cf18b45ab19f159bde33c239405d1d99e06e261ed0cd11dbbdf
SHA512

91658ad0332244c5999739a35c70b8de0b34d3b604c4cc7763b685d7159ca26b7d1d358c5c5191cf5c8a30d161d2734ad3df3127ff1ec79b73011b82b1653821
SSDEEP

3072:jM2rym3Y3yVLnxkYI5E0ypXSqOC5u5thOU44p33p:jPY3AxT5S7XPHd33

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

e58213f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e58213f.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

e58213f.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e58213f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e58213f.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e58213f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e58213f.exe

Executes dropped EXE 3 IoCs

Processes:

e58213f.exee58293e.exee585261.exe

pid process

5012 e58213f.exe
4924 e58293e.exe
4736 e585261.exe

pid	process
5012	e58213f.exe
4924	e58293e.exe
4736	e585261.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5012-6-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-8-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-12-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-15-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-14-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-13-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-10-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-11-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-9-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-16-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-35-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-36-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-49-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-50-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-51-0x00000000007D0000-0x000000000188A000-memory.dmp	upx
behavioral2/memory/5012-54-0x00000000007D0000-0x000000000188A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e58213f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e58213f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e58213f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e58213f.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

e58213f.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e58213f.exe
Drops file in Windows directory 2 IoCs

Processes:

e58213f.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI e58213f.exe
File created C:\Windows\e5825a4 e58213f.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e58213f.exe

pid process

5012 e58213f.exe
5012 e58213f.exe
5012 e58213f.exe
5012 e58213f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e58213f.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	e58213f.exe
File created	C:\Windows\e5825a4	e58213f.exe

pid	process
5012	e58213f.exe
5012	e58213f.exe
5012	e58213f.exe
5012	e58213f.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e58213f.exe

description	pid	process
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe
Token: SeDebugPrivilege	5012	e58213f.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee58213f.exe

description	pid	process	target process
PID 3484 wrote to memory of 1284	3484	rundll32.exe	rundll32.exe
PID 3484 wrote to memory of 1284	3484	rundll32.exe	rundll32.exe
PID 3484 wrote to memory of 1284	3484	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 5012	1284	rundll32.exe	e58213f.exe
PID 1284 wrote to memory of 5012	1284	rundll32.exe	e58213f.exe
PID 1284 wrote to memory of 5012	1284	rundll32.exe	e58213f.exe
PID 5012 wrote to memory of 788	5012	e58213f.exe	fontdrvhost.exe
PID 5012 wrote to memory of 784	5012	e58213f.exe	fontdrvhost.exe
PID 5012 wrote to memory of 1020	5012	e58213f.exe	dwm.exe
PID 5012 wrote to memory of 2572	5012	e58213f.exe	sihost.exe
PID 5012 wrote to memory of 2580	5012	e58213f.exe	svchost.exe
PID 5012 wrote to memory of 2824	5012	e58213f.exe	taskhostw.exe
PID 5012 wrote to memory of 3332	5012	e58213f.exe	Explorer.EXE
PID 5012 wrote to memory of 3512	5012	e58213f.exe	svchost.exe
PID 5012 wrote to memory of 3712	5012	e58213f.exe	DllHost.exe
PID 5012 wrote to memory of 3856	5012	e58213f.exe	StartMenuExperienceHost.exe
PID 5012 wrote to memory of 3932	5012	e58213f.exe	RuntimeBroker.exe
PID 5012 wrote to memory of 4016	5012	e58213f.exe	SearchApp.exe
PID 5012 wrote to memory of 3444	5012	e58213f.exe	RuntimeBroker.exe
PID 5012 wrote to memory of 4704	5012	e58213f.exe	RuntimeBroker.exe
PID 5012 wrote to memory of 4332	5012	e58213f.exe	TextInputHost.exe
PID 5012 wrote to memory of 2368	5012	e58213f.exe	RuntimeBroker.exe
PID 5012 wrote to memory of 3008	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 4916	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3580	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 2724	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3452	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3032	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3920	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3484	5012	e58213f.exe	rundll32.exe
PID 5012 wrote to memory of 1284	5012	e58213f.exe	rundll32.exe
PID 5012 wrote to memory of 1284	5012	e58213f.exe	rundll32.exe
PID 1284 wrote to memory of 4924	1284	rundll32.exe	e58293e.exe
PID 1284 wrote to memory of 4924	1284	rundll32.exe	e58293e.exe
PID 1284 wrote to memory of 4924	1284	rundll32.exe	e58293e.exe
PID 5012 wrote to memory of 788	5012	e58213f.exe	fontdrvhost.exe
PID 5012 wrote to memory of 784	5012	e58213f.exe	fontdrvhost.exe
PID 5012 wrote to memory of 1020	5012	e58213f.exe	dwm.exe
PID 5012 wrote to memory of 2572	5012	e58213f.exe	sihost.exe
PID 5012 wrote to memory of 2580	5012	e58213f.exe	svchost.exe
PID 5012 wrote to memory of 2824	5012	e58213f.exe	taskhostw.exe
PID 5012 wrote to memory of 3332	5012	e58213f.exe	Explorer.EXE
PID 5012 wrote to memory of 3512	5012	e58213f.exe	svchost.exe
PID 5012 wrote to memory of 3712	5012	e58213f.exe	DllHost.exe
PID 5012 wrote to memory of 3856	5012	e58213f.exe	StartMenuExperienceHost.exe
PID 5012 wrote to memory of 3932	5012	e58213f.exe	RuntimeBroker.exe
PID 5012 wrote to memory of 4016	5012	e58213f.exe	SearchApp.exe
PID 5012 wrote to memory of 3444	5012	e58213f.exe	RuntimeBroker.exe
PID 5012 wrote to memory of 4704	5012	e58213f.exe	RuntimeBroker.exe
PID 1284 wrote to memory of 4736	1284	rundll32.exe	e585261.exe
PID 1284 wrote to memory of 4736	1284	rundll32.exe	e585261.exe
PID 1284 wrote to memory of 4736	1284	rundll32.exe	e585261.exe
PID 5012 wrote to memory of 4332	5012	e58213f.exe	TextInputHost.exe
PID 5012 wrote to memory of 2368	5012	e58213f.exe	RuntimeBroker.exe
PID 5012 wrote to memory of 3008	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 4916	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3580	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 2724	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3452	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3032	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3920	5012	e58213f.exe	msedge.exe
PID 5012 wrote to memory of 3484	5012	e58213f.exe	rundll32.exe
PID 5012 wrote to memory of 4924	5012	e58213f.exe	e58293e.exe
PID 5012 wrote to memory of 4924	5012	e58213f.exe	e58293e.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

e58213f.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e58213f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e58213f.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2580

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2824

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1516df5fcbe41b1cf6e2755fcd37b380_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1516df5fcbe41b1cf6e2755fcd37b380_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\e58213f.exe
C:\Users\Admin\AppData\Local\Temp\e58213f.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5012

C:\Users\Admin\AppData\Local\Temp\e58293e.exe
C:\Users\Admin\AppData\Local\Temp\e58293e.exe
4⤵
- Executes dropped EXE
PID:4924

C:\Users\Admin\AppData\Local\Temp\e585261.exe
C:\Users\Admin\AppData\Local\Temp\e585261.exe
4⤵
- Executes dropped EXE
PID:4736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3512

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3712

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3856

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3932

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4016

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4704

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4332

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffc9b282e98,0x7ffc9b282ea4,0x7ffc9b282eb0
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2652 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:2
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2756 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:3
2⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2860 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
2⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5424 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
2⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5580 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
2⤵
PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
2⤵
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e58213f.exe
Filesize
97KB

MD5
27d52ea2246b8de93ca560f61c9fcc17

SHA1
eb100aed9941e18880b62eb5f1dadf75fab1d708

SHA256
780dbf07439fcfd9a469adc03c4500de8ffadcf60f7acdd9c26a8fa76db2ad8c

SHA512
4d2d6f6f555cd32fc7381b7ade5aa2f300e5889f2019ceea144a13c65f6675d0f890803b7a6327e352e8f5983c04ec752d0d29577f465ac1fb437c80b5a25bbb

Download Submit
memory/1284-22-0x0000000003CD0000-0x0000000003CD2000-memory.dmp

Filesize
8KB

Download
memory/1284-40-0x0000000003CD0000-0x0000000003CD2000-memory.dmp

Filesize
8KB

Download
memory/1284-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1284-23-0x0000000003D60000-0x0000000003D61000-memory.dmp

Filesize
4KB

Download
memory/1284-33-0x0000000003CD0000-0x0000000003CD2000-memory.dmp

Filesize
8KB

Download
memory/1284-27-0x0000000003CD0000-0x0000000003CD2000-memory.dmp

Filesize
8KB

Download
memory/4736-47-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4924-46-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4924-34-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4924-73-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4924-48-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4924-44-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/5012-35-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-8-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-14-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-15-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-32-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/5012-25-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/5012-12-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-16-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-10-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-36-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-9-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-26-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/5012-6-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-13-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5012-49-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-50-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-51-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-57-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/5012-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5012-54-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download
memory/5012-11-0x00000000007D0000-0x000000000188A000-memory.dmp

Filesize
16.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads