xenorat | 0263e56acd74c0e93b43a5ee9f2321b9624113c22782c367949a6b8b68b9a606

General

Target

ESTADO_DE_CUENTA.xll
Size

805KB
MD5

46752fe1a6739bcb8f4b5d5feefaa244
SHA1

69f1a8c024ac4c95aa6ecb2c35274523c5ff6c4f
SHA256

0263e56acd74c0e93b43a5ee9f2321b9624113c22782c367949a6b8b68b9a606
SHA512

2e9a54aeda90fd578ef78169b85080a5b650ba5ea74339ecbd0efa3afe4e9f71dfc38cbdc82ddd76e5cf8af18ec8bf9ee2899504083342152e34436abc149081
SSDEEP

12288:oG1N4HkcgMsiOd58bzbBSre8Q0uqZzD1reWabd/5pLknSdAdSjVjzcFQBV:ooOOMX1M+QHT+dfmd4VoQ

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8889g

Attributes

delay
60000
install_path
appdata
port
1279
startup_name
qns

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

Executes dropped EXE 8 IoCs

Processes:

7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

pid	process
4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
4676	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
1528	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
4256	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
3672	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
2744	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
844	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

Loads dropped DLL 2 IoCs

Processes:

EXCEL.EXE

pid process

3048 EXCEL.EXE
3048 EXCEL.EXE

pid	process
3048	EXCEL.EXE
3048	EXCEL.EXE

Suspicious use of SetThreadContext 6 IoCs

Processes:

7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

description	pid	process	target process
PID 4924 set thread context of 4676	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 set thread context of 1528	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 set thread context of 4256	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 set thread context of 3672	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 set thread context of 2744	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 set thread context of 844	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1356 4676 WerFault.exe 7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

pid	pid_target	process	target process
1356	4676	WerFault.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2860 schtasks.exe

pid	process
2860	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3048 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

EXCEL.EXE

pid process

3048 EXCEL.EXE

pid	process
3048	EXCEL.EXE

pid	process
3048	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

EXCEL.EXE7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

description	pid	process
Token: SeDebugPrivilege	3048	EXCEL.EXE
Token: SeDebugPrivilege	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
Token: SeDebugPrivilege	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

3048 EXCEL.EXE
3048 EXCEL.EXE
Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

EXCEL.EXE

pid process

3048 EXCEL.EXE
3048 EXCEL.EXE
3048 EXCEL.EXE
3048 EXCEL.EXE
3048 EXCEL.EXE
3048 EXCEL.EXE
3048 EXCEL.EXE
3048 EXCEL.EXE
3048 EXCEL.EXE
3048 EXCEL.EXE

pid	process
3048	EXCEL.EXE
3048	EXCEL.EXE

pid	process
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

EXCEL.EXE7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ESTADO_DE_CUENTA.xll"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
"C:\Users\Admin\AppData\Local\Temp\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924

C:\Users\Admin\AppData\Local\Temp\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
C:\Users\Admin\AppData\Local\Temp\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
3⤵
- Executes dropped EXE
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 80
4⤵
- Program crash
PID:1356

C:\Users\Admin\AppData\Local\Temp\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
C:\Users\Admin\AppData\Local\Temp\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "qns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp409E.tmp" /F
4⤵
- Creates scheduled task(s)
PID:2860

C:\Users\Admin\AppData\Local\Temp\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
C:\Users\Admin\AppData\Local\Temp\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256

C:\Users\Admin\AppData\Roaming\XenoManager\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556

C:\Users\Admin\AppData\Roaming\XenoManager\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
C:\Users\Admin\AppData\Roaming\XenoManager\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
5⤵
- Executes dropped EXE
PID:3672

C:\Users\Admin\AppData\Roaming\XenoManager\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
C:\Users\Admin\AppData\Roaming\XenoManager\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
5⤵
- Executes dropped EXE
PID:2744

C:\Users\Admin\AppData\Roaming\XenoManager\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
C:\Users\Admin\AppData\Roaming\XenoManager\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
5⤵
- Executes dropped EXE
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4676 -ip 4676
1⤵
PID:756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe.log
Filesize
706B

MD5
d95c58e609838928f0f49837cab7dfd2

SHA1
55e7139a1e3899195b92ed8771d1ca2c7d53c916

SHA256
0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

SHA512
405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
Filesize
219KB

MD5
30d7677802933ebd3dd972c1ff4d4297

SHA1
0a8427b245a3cbf570a13c3f736acb17cf26efd7

SHA256
2a82ff043b6278465c551a33a97fb5a1f0148feca497047abf9904ae76e9182b

SHA512
8660d89594d8356dc8bb2d8cd6069e3a55192e350d0cda7ed9289068b0719a11bf06aa49f43c392d9d755464eb74abe1e728a1d560955844be3590fe6a7182b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ESTADO_DE_CUENTA.xll
Filesize
805KB

MD5
46752fe1a6739bcb8f4b5d5feefaa244

SHA1
69f1a8c024ac4c95aa6ecb2c35274523c5ff6c4f

SHA256
0263e56acd74c0e93b43a5ee9f2321b9624113c22782c367949a6b8b68b9a606

SHA512
2e9a54aeda90fd578ef78169b85080a5b650ba5ea74339ecbd0efa3afe4e9f71dfc38cbdc82ddd76e5cf8af18ec8bf9ee2899504083342152e34436abc149081

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp409E.tmp
Filesize
1KB

MD5
b70dea5b0e0e18cd5fd7602f46f4689e

SHA1
11a6f31bab11b7a83f301d4b258f516eafc33946

SHA256
d21eec6938aeef530932ff27ccf3daffe904bdf8e705d3ffbc1d9290e9359764

SHA512
8b7b42dbae04d438293d3a45f710d3e223a6a00d180023e154221ec6e35db370e5ab09c618bad7216f16704920d7b14783831927666f212a460617bcc99372e6

Download Submit
memory/1528-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3048-27-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-8-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-24-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-3-0x00007FFC79990000-0x00007FFC799A0000-memory.dmp

Filesize
64KB

Download
memory/3048-29-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-7-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-6-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-5-0x00007FFC79990000-0x00007FFC799A0000-memory.dmp

Filesize
64KB

Download
memory/3048-9-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-12-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-13-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-14-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-15-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-16-0x00007FFC77820000-0x00007FFC77830000-memory.dmp

Filesize
64KB

Download
memory/3048-11-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-28-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-18-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-20-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-19-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-10-0x00007FFC77820000-0x00007FFC77830000-memory.dmp

Filesize
64KB

Download
memory/3048-23-0x0000021DDF1B0000-0x0000021DDF292000-memory.dmp

Filesize
904KB

Download
memory/3048-1-0x00007FFC79990000-0x00007FFC799A0000-memory.dmp

Filesize
64KB

Download
memory/3048-26-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-25-0x0000021DE1EC0000-0x0000021DE1ED4000-memory.dmp

Filesize
80KB

Download
memory/3048-4-0x00007FFCB99AD000-0x00007FFCB99AE000-memory.dmp

Filesize
4KB

Download
memory/3048-2-0x00007FFC79990000-0x00007FFC799A0000-memory.dmp

Filesize
64KB

Download
memory/3048-17-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-30-0x0000021DFB9E0000-0x0000021DFBB64000-memory.dmp

Filesize
1.5MB

Download
memory/3048-31-0x0000021DE35E0000-0x0000021DE361C000-memory.dmp

Filesize
240KB

Download
memory/3048-32-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-33-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-34-0x0000021DFB7A0000-0x0000021DFB7E0000-memory.dmp

Filesize
256KB

Download
memory/3048-82-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-110-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-107-0x00007FFC79990000-0x00007FFC799A0000-memory.dmp

Filesize
64KB

Download
memory/3048-109-0x00007FFC79990000-0x00007FFC799A0000-memory.dmp

Filesize
64KB

Download
memory/3048-108-0x00007FFC79990000-0x00007FFC799A0000-memory.dmp

Filesize
64KB

Download
memory/3048-106-0x00007FFC79990000-0x00007FFC799A0000-memory.dmp

Filesize
64KB

Download
memory/3048-0-0x00007FFC79990000-0x00007FFC799A0000-memory.dmp

Filesize
64KB

Download
memory/3048-90-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/3048-91-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/4924-53-0x00000000058D0000-0x000000000596C000-memory.dmp

Filesize
624KB

Download
memory/4924-52-0x0000000005520000-0x000000000555A000-memory.dmp

Filesize
232KB

Download
memory/4924-51-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/4924-50-0x0000000005510000-0x0000000005516000-memory.dmp

Filesize
24KB

Download
memory/4924-49-0x0000000000CF0000-0x0000000000D2C000-memory.dmp

Filesize
240KB

Download
memory/4924-48-0x00007FFCB9910000-0x00007FFCB9B05000-memory.dmp

Filesize
2.0MB

Download
memory/4924-54-0x0000000005F20000-0x00000000064C4000-memory.dmp

Filesize
5.6MB

Download
memory/4924-55-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/4924-56-0x00000000056F0000-0x00000000056F6000-memory.dmp

Filesize
24KB

Download

description	pid	process	target process
PID 3048 wrote to memory of 4924	3048	EXCEL.EXE	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 3048 wrote to memory of 4924	3048	EXCEL.EXE	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 3048 wrote to memory of 4924	3048	EXCEL.EXE	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4676	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4676	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4676	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4676	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4676	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4676	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4676	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4676	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 1528	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 1528	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 1528	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 1528	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 1528	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 1528	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 1528	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 1528	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4256	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4256	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4256	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4256	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4256	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4256	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4256	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4924 wrote to memory of 4256	4924	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4256 wrote to memory of 1556	4256	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4256 wrote to memory of 1556	4256	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 4256 wrote to memory of 1556	4256	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 3672	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 3672	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 3672	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 3672	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 3672	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 3672	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 3672	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 3672	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 2744	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 2744	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 2744	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 2744	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 2744	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 2744	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 2744	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 2744	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 844	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 844	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 844	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 844	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 844	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 844	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 844	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1556 wrote to memory of 844	1556	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe
PID 1528 wrote to memory of 2860	1528	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	schtasks.exe
PID 1528 wrote to memory of 2860	1528	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	schtasks.exe
PID 1528 wrote to memory of 2860	1528	7ca28a6a-4a13-415c-90b0-543da08b4b5b.exe	schtasks.exe

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads