asyncrat | 2c29e92bc8fe517a2f687eb0ac03bf711b74414cfa41998fb6d0b1f65929bca8

Analysis

max time kernel
130s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe
Size 2.7MB
Sample240601-e3h54shh8s
SHA256 2c29e92bc8fe517a2f687eb0ac03bf711b74414cfa41998fb6d0b1f65929bca8
MD5 8d7e75a6cff8af7fceb924ec1efc4260
SHA1 5c664cd5587274b66a17d2de857d682235a37325
SHA512 1b15727afb60b85b17c11edefb08703499b340ec84271317c2d0b06d4429b853693af191d87fd5fa5b20e317e81e85a14acf17a02577b9bb83b5727fb1ecf48e
SSDEEP 49152:STMGWKyMlF3c+pUr+zEGH9a6Q0uBA6Mws+wHOE8HRWxZqb:SkKy4PUr+A8YBA6JwH78YxZqb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default evasion persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.0

Botnet

Default

149.28.150.93:62940
149.28.150.93:54956
149.28.150.93:3299
149.28.150.93:9203

Mutex

DefaultMutex

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2756	netsh.exe
2848	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ertdtayhlv = "C:\\Users\\Admin\\AppData\\Roaming\\Ertdtayhlv.exe"	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4020 set thread context of 1552	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	88

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3720	sc.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4324	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2828	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2816	ipconfig.exe
3120	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4440	systeminfo.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe
Token: SeDebugPrivilege	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe
Token: SeDebugPrivilege	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe
Token: SeIncreaseQuotaPrivilege	4324	WMIC.exe
Token: SeSecurityPrivilege	4324	WMIC.exe
Token: SeTakeOwnershipPrivilege	4324	WMIC.exe
Token: SeLoadDriverPrivilege	4324	WMIC.exe
Token: SeSystemProfilePrivilege	4324	WMIC.exe
Token: SeSystemtimePrivilege	4324	WMIC.exe
Token: SeProfSingleProcessPrivilege	4324	WMIC.exe
Token: SeIncBasePriorityPrivilege	4324	WMIC.exe
Token: SeCreatePagefilePrivilege	4324	WMIC.exe
Token: SeBackupPrivilege	4324	WMIC.exe
Token: SeRestorePrivilege	4324	WMIC.exe
Token: SeShutdownPrivilege	4324	WMIC.exe
Token: SeDebugPrivilege	4324	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4324	WMIC.exe
Token: SeRemoteShutdownPrivilege	4324	WMIC.exe
Token: SeUndockPrivilege	4324	WMIC.exe
Token: SeManageVolumePrivilege	4324	WMIC.exe
Token: 33	4324	WMIC.exe
Token: 34	4324	WMIC.exe
Token: 35	4324	WMIC.exe
Token: 36	4324	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4324	WMIC.exe
Token: SeSecurityPrivilege	4324	WMIC.exe
Token: SeTakeOwnershipPrivilege	4324	WMIC.exe
Token: SeLoadDriverPrivilege	4324	WMIC.exe
Token: SeSystemProfilePrivilege	4324	WMIC.exe
Token: SeSystemtimePrivilege	4324	WMIC.exe
Token: SeProfSingleProcessPrivilege	4324	WMIC.exe
Token: SeIncBasePriorityPrivilege	4324	WMIC.exe
Token: SeCreatePagefilePrivilege	4324	WMIC.exe
Token: SeBackupPrivilege	4324	WMIC.exe
Token: SeRestorePrivilege	4324	WMIC.exe
Token: SeShutdownPrivilege	4324	WMIC.exe
Token: SeDebugPrivilege	4324	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4324	WMIC.exe
Token: SeRemoteShutdownPrivilege	4324	WMIC.exe
Token: SeUndockPrivilege	4324	WMIC.exe
Token: SeManageVolumePrivilege	4324	WMIC.exe
Token: 33	4324	WMIC.exe
Token: 34	4324	WMIC.exe
Token: 35	4324	WMIC.exe
Token: 36	4324	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3184	WMIC.exe
Token: SeSecurityPrivilege	3184	WMIC.exe
Token: SeTakeOwnershipPrivilege	3184	WMIC.exe
Token: SeLoadDriverPrivilege	3184	WMIC.exe
Token: SeSystemProfilePrivilege	3184	WMIC.exe
Token: SeSystemtimePrivilege	3184	WMIC.exe
Token: SeProfSingleProcessPrivilege	3184	WMIC.exe
Token: SeIncBasePriorityPrivilege	3184	WMIC.exe
Token: SeCreatePagefilePrivilege	3184	WMIC.exe
Token: SeBackupPrivilege	3184	WMIC.exe
Token: SeRestorePrivilege	3184	WMIC.exe
Token: SeShutdownPrivilege	3184	WMIC.exe
Token: SeDebugPrivilege	3184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3184	WMIC.exe
Token: SeRemoteShutdownPrivilege	3184	WMIC.exe
Token: SeUndockPrivilege	3184	WMIC.exe
Token: SeManageVolumePrivilege	3184	WMIC.exe
Token: 33	3184	WMIC.exe
Token: 34	3184	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 1552	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	88
PID 4020 wrote to memory of 1552	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	88
PID 4020 wrote to memory of 1552	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	88
PID 4020 wrote to memory of 1552	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	88
PID 4020 wrote to memory of 1552	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	88
PID 4020 wrote to memory of 1552	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	88
PID 4020 wrote to memory of 1552	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	88
PID 4020 wrote to memory of 1552	4020	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	88
PID 1552 wrote to memory of 392	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	99
PID 1552 wrote to memory of 392	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	99
PID 1552 wrote to memory of 392	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	99
PID 392 wrote to memory of 4440	392	cmd.exe	101
PID 392 wrote to memory of 4440	392	cmd.exe	101
PID 392 wrote to memory of 4440	392	cmd.exe	101
PID 1552 wrote to memory of 872	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	104
PID 1552 wrote to memory of 872	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	104
PID 1552 wrote to memory of 872	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	104
PID 1552 wrote to memory of 3276	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	106
PID 1552 wrote to memory of 3276	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	106
PID 1552 wrote to memory of 3276	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	106
PID 3276 wrote to memory of 976	3276	cmd.exe	108
PID 3276 wrote to memory of 976	3276	cmd.exe	108
PID 3276 wrote to memory of 976	3276	cmd.exe	108
PID 1552 wrote to memory of 744	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	109
PID 1552 wrote to memory of 744	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	109
PID 1552 wrote to memory of 744	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	109
PID 1552 wrote to memory of 3548	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	111
PID 1552 wrote to memory of 3548	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	111
PID 1552 wrote to memory of 3548	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	111
PID 3548 wrote to memory of 4324	3548	cmd.exe	113
PID 3548 wrote to memory of 4324	3548	cmd.exe	113
PID 3548 wrote to memory of 4324	3548	cmd.exe	113
PID 1552 wrote to memory of 1460	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	114
PID 1552 wrote to memory of 1460	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	114
PID 1552 wrote to memory of 1460	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	114
PID 1460 wrote to memory of 960	1460	cmd.exe	116
PID 1460 wrote to memory of 960	1460	cmd.exe	116
PID 1460 wrote to memory of 960	1460	cmd.exe	116
PID 960 wrote to memory of 3896	960	net.exe	117
PID 960 wrote to memory of 3896	960	net.exe	117
PID 960 wrote to memory of 3896	960	net.exe	117
PID 1552 wrote to memory of 1232	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	118
PID 1552 wrote to memory of 1232	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	118
PID 1552 wrote to memory of 1232	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	118
PID 1552 wrote to memory of 2808	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	120
PID 1552 wrote to memory of 2808	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	120
PID 1552 wrote to memory of 2808	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	120
PID 3600 wrote to memory of 756	3600	net.exe	123
PID 3600 wrote to memory of 756	3600	net.exe	123
PID 3600 wrote to memory of 756	3600	net.exe	123
PID 1552 wrote to memory of 3008	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	124
PID 1552 wrote to memory of 3008	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	124
PID 1552 wrote to memory of 3008	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	124
PID 3008 wrote to memory of 3784	3008	cmd.exe	126
PID 3008 wrote to memory of 3784	3008	cmd.exe	126
PID 3008 wrote to memory of 3784	3008	cmd.exe	126
PID 3784 wrote to memory of 2212	3784	net.exe	127
PID 3784 wrote to memory of 2212	3784	net.exe	127
PID 3784 wrote to memory of 2212	3784	net.exe	127
PID 1552 wrote to memory of 3308	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	128
PID 1552 wrote to memory of 3308	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	128
PID 1552 wrote to memory of 3308	1552	8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe	128
PID 3308 wrote to memory of 4532	3308	cmd.exe	130
PID 3308 wrote to memory of 4532	3308	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\8d7e75a6cff8af7fceb924ec1efc4260_NeikiAnalytics.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:872
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      hostname
      4⤵
      PID:976
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:744
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:3896
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:2808
  - - C:\Windows\SysWOW64\net.exe
      net localgroup
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3600
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:756
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3784
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\SysWOW64\net.exe
      net user guest
      4⤵
      PID:4532
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:4108
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:2340
  - - C:\Windows\SysWOW64\net.exe
      net user administrator
      4⤵
      PID:4524
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:4512
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:372
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3184
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:4992
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:2236
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:4256
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:3448
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route print
      4⤵
      PID:3788
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:3544
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:4904
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      Gathers network information
      PID:3120
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:4020
  - - C:\Windows\SysWOW64\sc.exe
      sc query type=service state=all
      4⤵
      Launches sc.exe
      PID:3720
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:528
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:1208
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      PID:2848
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:4616
  - - C:\Windows\SysWOW64\net.exe
      net wlan show interfaces
      4⤵
      PID:2776
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 wlan show interfaces
        5⤵
        
        PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:652
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:4980
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:4584
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks
      4⤵
      PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:4344
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic product get name
      4⤵
      PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:3720
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:60
  - - C:\Windows\SysWOW64\tree.com
      tree "C:\Users\Admin\Documents\Tencent Files"
      4⤵
      PID:3548
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:3832
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3888
  - - C:\Windows\SysWOW64\tree.com
      tree "C:\Users\Admin\Documents\WeChat Files"
      4⤵
      PID:3864
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:4760
  - - C:\Windows\SysWOW64\tree.com
      tree "C:\Users\Admin\Desktop" /F
      4⤵
      PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:4492
  - - C:\Windows\SysWOW64\tree.com
      tree /F
      4⤵
      PID:4528

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-4909-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/1552-4897-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/1552-4898-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/1552-4901-0x00000000061D0000-0x000000000626C000-memory.dmp

Download

memory/1552-4895-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/1552-4894-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1552-4908-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/1552-4907-0x0000000007710000-0x000000000771E000-memory.dmp

Download

memory/1552-4906-0x00000000071D0000-0x00000000071EE000-memory.dmp

Download

memory/1552-4905-0x00000000062B0000-0x00000000062BE000-memory.dmp

Download

memory/1552-4904-0x0000000007150000-0x00000000071C6000-memory.dmp

Download

memory/1552-4903-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/1552-4902-0x00000000062E0000-0x0000000006346000-memory.dmp

Download

memory/4020-30-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-68-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-40-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-48-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-54-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-52-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-50-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-47-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-42-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-38-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-36-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-34-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-32-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-44-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-19-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-26-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-24-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-22-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-20-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-14-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-12-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-10-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-8-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-28-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-60-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-56-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-70-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-66-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-64-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-62-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-58-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-4887-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/4020-4889-0x0000000006120000-0x000000000616C000-memory.dmp

Download

memory/4020-7-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-16-0x0000000007930000-0x0000000007B4E000-memory.dmp

Download

memory/4020-6-0x0000000007BF0000-0x0000000007C82000-memory.dmp

Download

memory/4020-5-0x0000000008100000-0x00000000086A4000-memory.dmp

Download

memory/4020-4-0x0000000007930000-0x0000000007B54000-memory.dmp

Download

memory/4020-3-0x00000000063C0000-0x0000000006800000-memory.dmp

Download

memory/4020-2-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/4020-1-0x0000000000F40000-0x00000000011F2000-memory.dmp

Download

memory/4020-0-0x000000007492E000-0x000000007492F000-memory.dmp

Download

memory/4020-4888-0x00000000060C0000-0x000000000611E000-memory.dmp

Download

memory/4020-4890-0x0000000007D10000-0x0000000007D64000-memory.dmp

Download

memory/4020-4896-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads