latentbot | 9b0d3e63e3167214577b30e6f2e19034414f2f565c708f689de51390fe0c772e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2024, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c1c607c7085f6819346979715dda033_JaffaCakes118.exe
Size 981KB
Sample240815-3s47laxbpm
SHA256 9b0d3e63e3167214577b30e6f2e19034414f2f565c708f689de51390fe0c772e
MD5 9c1c607c7085f6819346979715dda033
SHA1 166414beefabaf1866cfdfea8a72b222dcc674dc
SHA512 f1824dd69f9250664c71ae28d5b1045c6551abc5af61f9f44cc0f877de722acb7100d72486584df614979dc27222dba1e1dbeddd02161afc633fab68670176b9
SSDEEP 24576:T/////76QhEtOa5VxNmfFWBlI9G4hOkjIIkGhBLE:fREtO8xNmwB293rIvqB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot discovery evasion persistence trojan

Malware Config

Extracted

Family

latentbot

1rockanimal.zapto.org
2rockanimal.zapto.org
3rockanimal.zapto.org
4rockanimal.zapto.org
5rockanimal.zapto.org
6rockanimal.zapto.org
7rockanimal.zapto.org
8rockanimal.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b5Srg.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b5Srg.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IGTN21UM2I.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
2116	TUza5.exe
964	b5Srg.exe
2428	bUnQwWvf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Windows Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwm.exe"	TUza5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4436 set thread context of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5Srg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TUza5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bUnQwWvf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
5068	reg.exe
2456	reg.exe
3208	reg.exe
1568	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe
Token: 1	964	b5Srg.exe
Token: SeCreateTokenPrivilege	964	b5Srg.exe
Token: SeAssignPrimaryTokenPrivilege	964	b5Srg.exe
Token: SeLockMemoryPrivilege	964	b5Srg.exe
Token: SeIncreaseQuotaPrivilege	964	b5Srg.exe
Token: SeMachineAccountPrivilege	964	b5Srg.exe
Token: SeTcbPrivilege	964	b5Srg.exe
Token: SeSecurityPrivilege	964	b5Srg.exe
Token: SeTakeOwnershipPrivilege	964	b5Srg.exe
Token: SeLoadDriverPrivilege	964	b5Srg.exe
Token: SeSystemProfilePrivilege	964	b5Srg.exe
Token: SeSystemtimePrivilege	964	b5Srg.exe
Token: SeProfSingleProcessPrivilege	964	b5Srg.exe
Token: SeIncBasePriorityPrivilege	964	b5Srg.exe
Token: SeCreatePagefilePrivilege	964	b5Srg.exe
Token: SeCreatePermanentPrivilege	964	b5Srg.exe
Token: SeBackupPrivilege	964	b5Srg.exe
Token: SeRestorePrivilege	964	b5Srg.exe
Token: SeShutdownPrivilege	964	b5Srg.exe
Token: SeDebugPrivilege	964	b5Srg.exe
Token: SeAuditPrivilege	964	b5Srg.exe
Token: SeSystemEnvironmentPrivilege	964	b5Srg.exe
Token: SeChangeNotifyPrivilege	964	b5Srg.exe
Token: SeRemoteShutdownPrivilege	964	b5Srg.exe
Token: SeUndockPrivilege	964	b5Srg.exe
Token: SeSyncAgentPrivilege	964	b5Srg.exe
Token: SeEnableDelegationPrivilege	964	b5Srg.exe
Token: SeManageVolumePrivilege	964	b5Srg.exe
Token: SeImpersonatePrivilege	964	b5Srg.exe
Token: SeCreateGlobalPrivilege	964	b5Srg.exe
Token: 31	964	b5Srg.exe
Token: 32	964	b5Srg.exe
Token: 33	964	b5Srg.exe
Token: 34	964	b5Srg.exe
Token: 35	964	b5Srg.exe
Token: SeDebugPrivilege	2428	bUnQwWvf.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
964	b5Srg.exe
964	b5Srg.exe
964	b5Srg.exe
964	b5Srg.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3560	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	84
PID 4436 wrote to memory of 3560	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	84
PID 4436 wrote to memory of 3560	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	84
PID 3560 wrote to memory of 2232	3560	csc.exe	88
PID 3560 wrote to memory of 2232	3560	csc.exe	88
PID 3560 wrote to memory of 2232	3560	csc.exe	88
PID 4436 wrote to memory of 2116	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	90
PID 4436 wrote to memory of 2116	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	90
PID 4436 wrote to memory of 2116	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	90
PID 4436 wrote to memory of 3224	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	91
PID 4436 wrote to memory of 3224	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	91
PID 4436 wrote to memory of 3224	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	91
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 3224 wrote to memory of 396	3224	csc.exe	94
PID 3224 wrote to memory of 396	3224	csc.exe	94
PID 3224 wrote to memory of 396	3224	csc.exe	94
PID 4436 wrote to memory of 2428	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	95
PID 4436 wrote to memory of 2428	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	95
PID 4436 wrote to memory of 2428	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	95
PID 964 wrote to memory of 4628	964	b5Srg.exe	96
PID 964 wrote to memory of 4628	964	b5Srg.exe	96
PID 964 wrote to memory of 4628	964	b5Srg.exe	96
PID 964 wrote to memory of 2168	964	b5Srg.exe	97
PID 964 wrote to memory of 2168	964	b5Srg.exe	97
PID 964 wrote to memory of 2168	964	b5Srg.exe	97
PID 964 wrote to memory of 4732	964	b5Srg.exe	98
PID 964 wrote to memory of 4732	964	b5Srg.exe	98
PID 964 wrote to memory of 4732	964	b5Srg.exe	98
PID 964 wrote to memory of 412	964	b5Srg.exe	99
PID 964 wrote to memory of 412	964	b5Srg.exe	99
PID 964 wrote to memory of 412	964	b5Srg.exe	99
PID 4628 wrote to memory of 5068	4628	cmd.exe	104
PID 4628 wrote to memory of 5068	4628	cmd.exe	104
PID 4628 wrote to memory of 5068	4628	cmd.exe	104
PID 2168 wrote to memory of 2456	2168	cmd.exe	105
PID 2168 wrote to memory of 2456	2168	cmd.exe	105
PID 2168 wrote to memory of 2456	2168	cmd.exe	105
PID 412 wrote to memory of 3208	412	cmd.exe	106
PID 412 wrote to memory of 3208	412	cmd.exe	106
PID 412 wrote to memory of 3208	412	cmd.exe	106
PID 4732 wrote to memory of 1568	4732	cmd.exe	107
PID 4732 wrote to memory of 1568	4732	cmd.exe	107
PID 4732 wrote to memory of 1568	4732	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\9c1c607c7085f6819346979715dda033_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9c1c607c7085f6819346979715dda033_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wcdxdyq_.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E4D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5E4C.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
- C:\Users\Admin\AppData\Local\Temp\TUza5.exe
  "C:\Users\Admin\AppData\Local\Temp\TUza5.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xegjfq0n.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61E7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC61E6.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:396
- C:\Users\Admin\AppData\Local\Temp\b5Srg.exe
  C:\Users\Admin\AppData\Local\Temp\b5Srg.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b5Srg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b5Srg.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b5Srg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b5Srg.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3208
- C:\Users\Admin\AppData\Local\Temp\bUnQwWvf.exe
  "C:\Users\Admin\AppData\Local\Temp\bUnQwWvf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5E4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5E4D.tmp
Size 1KB
SHA256 2e2331b093254846301a6aba7a2762b78dc287fd48a3e2bdfa9817eb02ba265c
MD5 07e36d5ed52635fa5c7c81bd3e1766fa
SHA1 1a55adfc9b47b68c5da98ffca47f6f5bffef4643
SHA512 b91b5a47b345126e252bab5486d469ebb25fbaa018a2d1fe70759ed61e562174408c3143b5ef82e8bc00c5d1f7c6004d8d86033e84c9651467f47b4602b29743
MD5 SHA1 SHA512

Submit Download

RES61E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES61E7.tmp
Size 1KB
SHA256 4e524c1b261516a2ed7a114adf0a3d7eca187ea83744fa5bf3caa327ddeea3b1
MD5 5a7b3fffaa2cb55ebcb133ba2f0da41c
SHA1 8278e1d13bb3d84b20016b64e82165901afba331
SHA512 862b580c09d77a14b1b883021ff774aa2a6c602188bed76cf78efeff234c5edb0106754d6afda47d58bf1338f46c53492258d4ccadba3af815f9fffa624374d3
MD5 SHA1 SHA512

Submit Download

TUza5.exe

Path C:\Users\Admin\AppData\Local\Temp\TUza5.exe
Size 4KB
SHA256 be987422ba33c67a33e90b3f3b42a5996310a7981edbd327387a718267e6ae1c
MD5 af37074c1df8e232fbf969543e583a92
SHA1 7492b6f4f8614593cd1abe410c9dc3ddc4f10d4e
SHA512 c3fa033bf8bbc497be26d03e5070599c099806fbe242def43ab7e9a3bc694468231c646cb463d0749972d2a024f33bd782e584f5d608d414c1e340a98372e979
MD5 SHA1 SHA512

Submit Download

b5Srg.exe

Path C:\Users\Admin\AppData\Local\Temp\b5Srg.exe
Size 34KB
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
SSDEEP 768:Paq4bp49YK+2Cza0pS6icHmMl9CvwOElkn3yKdn5y85p3:ud4+KTMVJHmMsEBKdn5vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

bUnQwWvf.exe

Path C:\Users\Admin\AppData\Local\Temp\bUnQwWvf.exe
Size 20KB
SHA256 6e4d8c0695cc1ccada850b1c9732787185a849d793de36b86644a21c11b55f36
MD5 3e6330b83cd70ddc73fddd1b3c8ce926
SHA1 4a5ff9bf3c0cf67926d75b832c3825bbcc26bd40
SHA512 2c5b13493b18329232efa081c2a2b40901210169d59f8e57e35cc7392d01ebeff959811c385b599d669b5cc63368654a92988f85e6aabcc2c234fc495777d9b7
SSDEEP 192:ME0HMfWyxVUFQZYD/WKQH80Zje7U4gMAOAuvhqFy/UfaWYnx7vYosuElAAs7/9N8:MpMfHKQPpcO8Auvn/UCjxLEqH78
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC5E4C.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC5E4C.tmp
Size 636B
SHA256 36b00dbac3ff22f0d514c99721c3320c95ecaf0e80f80171b40eb0752bc754a6
MD5 729f44c1955f67140715900aafbe8403
SHA1 f97f52197cdff16634475f1272a6bd5893133206
SHA512 142446e606cbad39d89122c409acdef22d9af77ea1332483af08a1069a4308a4b31a8c0809bbcec6a379a98ccb4d4e1d63c50bdbba1ad3e72595de884bd8a5f2
MD5 SHA1 SHA512

Submit Download

CSC61E6.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC61E6.tmp
Size 652B
SHA256 1c3207eeb9c0edf7c1234c30b941c38091d9f1afaf6fde9697c18d1393cb8c79
MD5 a37aac35a137cd5aa3c2c294239a51a6
SHA1 56f6d5860ade02a365e6443d43d09975cf4cf339
SHA512 f6e945e250eb41d9c99091317581004abce8cc921614fbb37d0fcaa2ce87f65c47d04a9995e46d15430658e73c85e1f4c7777d36a84c45ccc1a85ae59305fd50
MD5 SHA1 SHA512

Submit Download

resource.resources

Path \??\c:\Users\Admin\AppData\Local\Temp\resource.resources
Size 15KB
SHA256 35f139b7ff1909d42b09123c4fce94bfdbf0a944bc2d482f31d4edcd44ee3b09
MD5 d0294b85a3cb4ef59a5565a2e6b1209f
SHA1 0c9f87cd89f2388d9d16d25533ac4dfe59ef0874
SHA512 aef43cc881516364dcd6fdcba34e44448ff91e2cfe6849b36aef868ed7fde432662c3a32e14887e7f5f3f2cbad2a30aa6dcc15377f636bfbf8f394e8d14b7f06
SSDEEP 192:JHMfWyxVUFQZYD/WKQH80Zje7U4gMAOAuvhqFy/UfaWYnx7vYosu:xMfHKQPpcO8Auvn/UCjxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

wcdxdyq_.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wcdxdyq_.0.cs
Size 1KB
SHA256 73e91506323efce31ff4b24197e6d8e527453a3308dd9d78e38602feb31abad6
MD5 e940e1d28d80e3124599d150cc8fb399
SHA1 8b8e9390e582e50f9370a5fc14bc85da793b36ba
SHA512 23ee20cc5ca65e67e9d4651b5f90d7c786d84712ec726c4bd725ce40f5241289249fa243b21bb5564aa335e6080f8f775e9eaa47289f8f8c623d44beda25bfd9
MD5 SHA1 SHA512

Submit Download

wcdxdyq_.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wcdxdyq_.cmdline
Size 258B
SHA256 8065e96b1bdb785a07d0a4f0d4e8839e837336abc15afc31e712ef9e5a965253
MD5 ad27da9c50cec16b335b38ee5ae88497
SHA1 eda1037ed4e94bf453b9aca4057651e0c0bc1db4
SHA512 b28c29f9c87dd3bae749d128e58c39c54153b9db519568b7a35bf23099235e6e90de629488588f083a462fa667dbe782b30240b3cdb00dc529c3461f7cfd73ce
MD5 SHA1 SHA512

Submit Download

xegjfq0n.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xegjfq0n.0.cs
Size 4KB
SHA256 0c9cfff90b6fcefc52829e30b79b83f33c91c9f7a7cf1d1d325e9019c7873b64
MD5 a84f64a4a43951ab36bf4000ad289ac2
SHA1 e1fea253ebc0ffa061b76021d1056a5781b4fde7
SHA512 a0732fd769dc42831eab918c979eb4d9207e8e6ee52883aebdfad138c93f5b211705a145bbf1945de00ecd30ca559ceee64bdb178c98718810291dcf37757ab6
SSDEEP 96:JoXV0X1Uy4ho4SMuW73l/nDwJDhFUI0hhaJ9W:OBC3JW7V7wJ1Ft0Dai
MD5 SHA1 SHA512 SSDEEP

Submit Download

xegjfq0n.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xegjfq0n.cmdline
Size 321B
SHA256 983e49b7e2a5b1bdeb15be96e6ae13fb6ec0d8e167ffa368945fba8f06a79542
MD5 990c66a61178b6d8ad4bd242f9514a4f
SHA1 6b55335f1d2b623232cd1fbcb22122a911c0b056
SHA512 8de9f39b72170d4c3765d92a5274a8c09467feef65a50d2e7bfcc11fbd5f748813e80e344aee5b5e59802f508064e71b0b8a73252d1f366e331ee7ad43c306e2
MD5 SHA1 SHA512

Submit Download

memory/964-62-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/964-55-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/964-56-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/964-61-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/964-30-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/964-36-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/964-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/964-63-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/964-67-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2116-53-0x00000000750C0000-0x0000000075671000-memory.dmp

Download

memory/2116-25-0x00000000750C0000-0x0000000075671000-memory.dmp

Download

memory/2116-24-0x00000000750C0000-0x0000000075671000-memory.dmp

Download

memory/3224-44-0x00000000750C0000-0x0000000075671000-memory.dmp

Download

memory/3224-37-0x00000000750C0000-0x0000000075671000-memory.dmp

Download

memory/3560-15-0x00000000750C0000-0x0000000075671000-memory.dmp

Download

memory/3560-8-0x00000000750C0000-0x0000000075671000-memory.dmp

Download

memory/4436-52-0x00000000750C0000-0x0000000075671000-memory.dmp

Download

memory/4436-0-0x00000000750C2000-0x00000000750C3000-memory.dmp

Download

memory/4436-2-0x00000000750C0000-0x0000000075671000-memory.dmp

Download

memory/4436-1-0x00000000750C0000-0x0000000075671000-memory.dmp

Download