xtremerat | 1003f7e89b991f70994c9f1701f53b584819d5bf5510fc377b8a5cdc721e9cef

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2024, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
Size 511KB
Sample240718-vmsyda1ekc
SHA256 1003f7e89b991f70994c9f1701f53b584819d5bf5510fc377b8a5cdc721e9cef
MD5 584e2ea9edb16ee433d34e54aa1a60a8
SHA1 4c13e894c6c3b9d1556505cfe77f82d4b6bb166f
SHA512 45ebe94426233b28a45fd428192724b2d4d1c5a156383d91b9486f019e3cee067675f539c9f8bdc59c7058674941b8b64de9ea77419b9eb7b57929828c30a91b
SSDEEP 12288:8uv7Dld+16KngUQaJwK/lGRgOUqmq9kR6lhKXFae/flS/riyT+G+:8uv/aKK/cRgOnmq9g6k5/N++
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/3744-32-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/3744-34-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/5108-104-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/956-176-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/1620-185-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/2876-193-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/1684-285-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}\StubPath = "C:\\Windows\\system32\\msn\\msn.exe restart"	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\msn\\msn.exe restart"	msn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\msn\\msn.exe restart"	msn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}	msn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}\StubPath = "C:\\Windows\\system32\\msn\\msn.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}	msn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}\StubPath = "C:\\Windows\\system32\\msn\\msn.exe restart"	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\msn\\msn.exe restart"	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB5108-E32B79832EB2}\StubPath = "C:\\Windows\\SysWOW64\\msn\\msn.exe restart"	msn.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	msn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	msn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	msn.exe

Executes dropped EXE 10 IoCs

pid	Process
3916	msn.exe
5108	msn.exe
3660	msn.exe
956	msn.exe
988	msn.exe
2876	msn.exe
4744	msn.exe
4440	msn.exe
1684	msn.exe
320	msn.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCUk = "C:\\Windows\\SysWOW64\\msn\\msn.exe"	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLMh = "C:\\Windows\\system32\\msn\\msn.exe"	msn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCUk = "C:\\Windows\\system32\\msn\\msn.exe"	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLMh = "C:\\Windows\\system32\\msn\\msn.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCUk = "C:\\Windows\\system32\\msn\\msn.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLMh = "C:\\Windows\\system32\\msn\\msn.exe"	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCUk = "C:\\Windows\\system32\\msn\\msn.exe"	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLMh = "C:\\Users\\Admin\\AppData\\Roaming\\msn\\msn.exe"	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLMh = "C:\\Windows\\SysWOW64\\msn\\msn.exe"	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLMh = "C:\\Users\\Admin\\AppData\\Roaming\\msn\\msn.exe"	msn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCUk = "C:\\Users\\Admin\\AppData\\Roaming\\msn\\msn.exe"	msn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCUk = "C:\\Users\\Admin\\AppData\\Roaming\\msn\\msn.exe"	msn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCUk = "C:\\Users\\Admin\\AppData\\Roaming\\msn\\msn.exe"	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLMh = "C:\\Users\\Admin\\AppData\\Roaming\\msn\\msn.exe"	msn.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msn\msn.exe	msn.exe
File created	C:\Windows\SysWOW64\msn\msn.exe	msn.exe
File created	C:\Windows\SysWOW64\msn\msn.exe	msn.exe
File opened for modification	C:\Windows\SysWOW64\msn\msn.exe	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msn\msn.exe	msn.exe
File opened for modification	C:\Windows\SysWOW64\msn\msn.exe	msn.exe
File created	C:\Windows\SysWOW64\msn\msn.exe	msn.exe
File opened for modification	C:\Windows\SysWOW64\msn\msn.exe	msn.exe
File opened for modification	C:\Windows\SysWOW64\msn\msn.exe	msn.exe
File created	C:\Windows\SysWOW64\msn\msn.exe	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msn\msn.exe	msn.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 3916 set thread context of 5108	3916	msn.exe	103
PID 3660 set thread context of 956	3660	msn.exe	115
PID 988 set thread context of 2876	988	msn.exe	127
PID 4744 set thread context of 1684	4744	msn.exe	138
PID 4440 set thread context of 320	4440	msn.exe	139

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msn.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
3916	msn.exe
3660	msn.exe
988	msn.exe
4744	msn.exe
4440	msn.exe
1684	msn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 632 wrote to memory of 3744	632	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	87
PID 3744 wrote to memory of 5084	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	88
PID 3744 wrote to memory of 5084	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	88
PID 3744 wrote to memory of 5084	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	88
PID 3744 wrote to memory of 2912	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	89
PID 3744 wrote to memory of 2912	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	89
PID 3744 wrote to memory of 2912	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	89
PID 3744 wrote to memory of 4176	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	90
PID 3744 wrote to memory of 4176	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	90
PID 3744 wrote to memory of 4176	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	90
PID 3744 wrote to memory of 2344	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	93
PID 3744 wrote to memory of 2344	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	93
PID 3744 wrote to memory of 2344	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	93
PID 3744 wrote to memory of 3652	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	94
PID 3744 wrote to memory of 3652	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	94
PID 3744 wrote to memory of 3652	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	94
PID 3744 wrote to memory of 1212	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	97
PID 3744 wrote to memory of 1212	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	97
PID 3744 wrote to memory of 1212	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	97
PID 3744 wrote to memory of 3716	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	98
PID 3744 wrote to memory of 3716	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	98
PID 3744 wrote to memory of 3716	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	98
PID 3744 wrote to memory of 3048	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	99
PID 3744 wrote to memory of 3048	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	99
PID 3744 wrote to memory of 3048	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	99
PID 3744 wrote to memory of 5096	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	100
PID 3744 wrote to memory of 5096	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	100
PID 3744 wrote to memory of 3916	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	101
PID 3744 wrote to memory of 3916	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	101
PID 3744 wrote to memory of 3916	3744	584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe	101
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 3916 wrote to memory of 5108	3916	msn.exe	103
PID 5108 wrote to memory of 2332	5108	msn.exe	104
PID 5108 wrote to memory of 2332	5108	msn.exe	104
PID 5108 wrote to memory of 2332	5108	msn.exe	104
PID 5108 wrote to memory of 3636	5108	msn.exe	105
PID 5108 wrote to memory of 3636	5108	msn.exe	105
PID 5108 wrote to memory of 3636	5108	msn.exe	105
PID 5108 wrote to memory of 4456	5108	msn.exe	106
PID 5108 wrote to memory of 4456	5108	msn.exe	106
PID 5108 wrote to memory of 4456	5108	msn.exe	106

C:\Users\Admin\AppData\Local\Temp\584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\584e2ea9edb16ee433d34e54aa1a60a8_JaffaCakes118.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\msn\msn.exe
    "C:\Windows\system32\msn\msn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\SysWOW64\msn\msn.exe
      "C:\Windows\SysWOW64\msn\msn.exe"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        
        PID:2332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:392
    - - C:\Users\Admin\AppData\Roaming\msn\msn.exe
        
        "C:\Users\Admin\AppData\Roaming\msn\msn.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3660
      - C:\Users\Admin\AppData\Roaming\msn\msn.exe
        
        "C:\Users\Admin\AppData\Roaming\msn\msn.exe"
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:956
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:1620
        
        C:\Windows\SysWOW64\msn\msn.exe
        
        "C:\Windows\system32\msn\msn.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4744
        
        C:\Windows\SysWOW64\msn\msn.exe
        
        "C:\Windows\SysWOW64\msn\msn.exe"
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\msn\msn.exe
        
        "C:\Windows\system32\msn\msn.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:988
        
        C:\Windows\SysWOW64\msn\msn.exe
        
        "C:\Windows\SysWOW64\msn\msn.exe"
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Roaming\msn\msn.exe
        
        "C:\Users\Admin\AppData\Roaming\msn\msn.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4440
        
        C:\Users\Admin\AppData\Roaming\msn\msn.exe
        
        "C:\Users\Admin\AppData\Roaming\msn\msn.exe"
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

k1nERt.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\k1nERt.cfg
Size 1KB
SHA256 23cf6335558da047e0df56b0edbb9106a6e6623a196c8fa42ceaee6fc66613c9
MD5 5f8e28435fdbdb28c38ba353dfc715ba
SHA1 3003280548e7cf84daafac929afdb85d194d553e
SHA512 9975a7a35cb49d9051a046d0ff04481d87df56270d4edbcd88bd4477c1f9a14deefa1693bd333cc2353c6e1f492c255e7d7eb5279a39dbcd45fa934563fc6ecc
MD5 SHA1 SHA512

Submit Download

msn.exe

Path C:\Windows\SysWOW64\msn\msn.exe
Size 511KB
SHA256 1003f7e89b991f70994c9f1701f53b584819d5bf5510fc377b8a5cdc721e9cef
MD5 584e2ea9edb16ee433d34e54aa1a60a8
SHA1 4c13e894c6c3b9d1556505cfe77f82d4b6bb166f
SHA512 45ebe94426233b28a45fd428192724b2d4d1c5a156383d91b9486f019e3cee067675f539c9f8bdc59c7058674941b8b64de9ea77419b9eb7b57929828c30a91b
SSDEEP 12288:8uv7Dld+16KngUQaJwK/lGRgOUqmq9kR6lhKXFae/flS/riyT+G+:8uv/aKK/cRgOnmq9g6k5/N++
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/632-2-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/632-22-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-30-0x0000000003B90000-0x0000000003B91000-memory.dmp

Download

memory/632-29-0x00000000022A0000-0x00000000022A1000-memory.dmp

Download

memory/632-28-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/632-27-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-26-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-25-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-24-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-7-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Download

memory/632-10-0x0000000003C70000-0x0000000003C71000-memory.dmp

Download

memory/632-21-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-20-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-19-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-17-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-16-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-15-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-13-0x0000000003C70000-0x0000000003C71000-memory.dmp

Download

memory/632-12-0x0000000003C70000-0x0000000003C71000-memory.dmp

Download

memory/632-11-0x0000000003C70000-0x0000000003C71000-memory.dmp

Download

memory/632-9-0x0000000003B70000-0x0000000003B7D000-memory.dmp

Download

memory/632-6-0x00000000024D0000-0x00000000024D1000-memory.dmp

Download

memory/632-14-0x0000000003C70000-0x0000000003C71000-memory.dmp

Download

memory/632-0-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/632-23-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/632-5-0x0000000002510000-0x0000000002511000-memory.dmp

Download

memory/632-4-0x0000000002540000-0x0000000002541000-memory.dmp

Download

memory/632-3-0x00000000024E0000-0x00000000024E1000-memory.dmp

Download

memory/632-1-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/632-8-0x0000000003B80000-0x0000000003B81000-memory.dmp

Download

memory/632-36-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/632-35-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/956-176-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/988-188-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/988-195-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/1620-185-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/1684-285-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/2876-193-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/3660-171-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/3660-178-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/3744-34-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/3744-32-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/3916-106-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4440-263-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4440-276-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4744-258-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4744-274-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/5108-104-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads