cerber | cd665494b4a760a948b940d3bbae302134c282deee633f04343fe34790406001

Analysis

max time kernel
110s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kopx_Perm.exe
Size

5.5MB
MD5

8c13d2fd7836abcfe22c00ace0061d40
SHA1

3c9640ec84a86cb10e87f2b2d8217f034aab1d5b
SHA256

cd665494b4a760a948b940d3bbae302134c282deee633f04343fe34790406001
SHA512

3c192fe7231e7c0306521c2701a3c9eeac0fd0091f6d59ef0f35a2dca193fcf5ff36008065838b2cabc92757708525a4d500e315a5502cbd8d7a6e5850255285
SSDEEP

49152:/WFnhV6qMFnhVSr9JkzvkjXa+FnhVSr9JkzvkjXabsBFnhVKTTFBySg6etzcwp86:/YrkzgXyrkzgX9orG8farR1

Score

10^/10

cerber discovery evasion ransomware themida trojan

Malware Config

Signatures

Cerber 32 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	Process
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}	AMIDEWINx64.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	applecleaner.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	applecleaner.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Kopx_Perm.exe

Executes dropped EXE 33 IoCs

pid	Process
516	winxsrcsv64.exe
4468	winxsrcsv64.exe
4548	winxsrcsv64.exe
1676	winxsrcsv64.exe
4808	winxsrcsv64.exe
2404	winxsrcsv64.exe
812	winxsrcsv64.exe
4836	winxsrcsv64.exe
4104	winxsrcsv64.exe
2800	winxsrcsv64.exe
708	winxsrcsv64.exe
4968	winxsrcsv64.exe
2032	winxsrcsv64.exe
3000	winxsrcsv64.exe
2732	winxsrcsv64.exe
4000	winxsrcsv64.exe
4820	applecleaner.exe
1688	AMIDEWINx64.exe
2516	AMIDEWINx64.exe
5076	AMIDEWINx64.exe
2496	AMIDEWINx64.exe
928	AMIDEWINx64.exe
2492	AMIDEWINx64.exe
3452	AMIDEWINx64.exe
1708	AMIDEWINx64.exe
2984	AMIDEWINx64.exe
4492	AMIDEWINx64.exe
2020	AMIDEWINx64.exe
3092	AMIDEWINx64.exe
4648	AMIDEWINx64.exe
1628	AMIDEWINx64.exe
3244	AMIDEWINx64.exe
4572	AMIDEWINx64.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000c000000021a6e-29.dat	themida
behavioral1/memory/4820-32-0x00007FF708DA0000-0x00007FF709742000-memory.dmp	themida
behavioral1/memory/4820-34-0x00007FF708DA0000-0x00007FF709742000-memory.dmp	themida
behavioral1/memory/4820-36-0x00007FF708DA0000-0x00007FF709742000-memory.dmp	themida
behavioral1/memory/4820-35-0x00007FF708DA0000-0x00007FF709742000-memory.dmp	themida
behavioral1/memory/4820-37-0x00007FF708DA0000-0x00007FF709742000-memory.dmp	themida
behavioral1/memory/4820-39-0x00007FF708DA0000-0x00007FF709742000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	applecleaner.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
35	raw.githubusercontent.com
36	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4820	applecleaner.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\amifldrv64.sys	Kopx_Perm.exe
File created	C:\Windows\Kopx\checker.bat	Kopx_Perm.exe
File created	C:\Windows\Globalization\winxsrcsv64.sys	Kopx_Perm.exe
File created	C:\Windows\Globalization\winxsrcsv64.exe	Kopx_Perm.exe
File created	C:\Windows\Globalization\iqvw64e.sys	Kopx_Perm.exe
File created	C:\Windows\IME\applecleaner.exe	Kopx_Perm.exe
File created	C:\Windows\Fonts\AMIDEWINx64.EXE	Kopx_Perm.exe
File created	C:\Windows\Fonts\amigendrv64.sys	Kopx_Perm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2828	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Kopx_Perm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Kopx_Perm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Kopx_Perm.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
768	taskkill.exe
1300	taskkill.exe
4484	taskkill.exe

Suspicious behavior: LoadsDriver 32 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	768	taskkill.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	4484	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 516	736	Kopx_Perm.exe	98
PID 736 wrote to memory of 516	736	Kopx_Perm.exe	98
PID 736 wrote to memory of 4468	736	Kopx_Perm.exe	100
PID 736 wrote to memory of 4468	736	Kopx_Perm.exe	100
PID 736 wrote to memory of 4548	736	Kopx_Perm.exe	102
PID 736 wrote to memory of 4548	736	Kopx_Perm.exe	102
PID 736 wrote to memory of 1676	736	Kopx_Perm.exe	104
PID 736 wrote to memory of 1676	736	Kopx_Perm.exe	104
PID 736 wrote to memory of 4808	736	Kopx_Perm.exe	106
PID 736 wrote to memory of 4808	736	Kopx_Perm.exe	106
PID 736 wrote to memory of 2404	736	Kopx_Perm.exe	108
PID 736 wrote to memory of 2404	736	Kopx_Perm.exe	108
PID 736 wrote to memory of 812	736	Kopx_Perm.exe	110
PID 736 wrote to memory of 812	736	Kopx_Perm.exe	110
PID 736 wrote to memory of 4836	736	Kopx_Perm.exe	112
PID 736 wrote to memory of 4836	736	Kopx_Perm.exe	112
PID 736 wrote to memory of 4104	736	Kopx_Perm.exe	114
PID 736 wrote to memory of 4104	736	Kopx_Perm.exe	114
PID 736 wrote to memory of 2800	736	Kopx_Perm.exe	116
PID 736 wrote to memory of 2800	736	Kopx_Perm.exe	116
PID 736 wrote to memory of 708	736	Kopx_Perm.exe	118
PID 736 wrote to memory of 708	736	Kopx_Perm.exe	118
PID 736 wrote to memory of 4968	736	Kopx_Perm.exe	120
PID 736 wrote to memory of 4968	736	Kopx_Perm.exe	120
PID 736 wrote to memory of 2032	736	Kopx_Perm.exe	122
PID 736 wrote to memory of 2032	736	Kopx_Perm.exe	122
PID 736 wrote to memory of 3000	736	Kopx_Perm.exe	124
PID 736 wrote to memory of 3000	736	Kopx_Perm.exe	124
PID 736 wrote to memory of 2732	736	Kopx_Perm.exe	126
PID 736 wrote to memory of 2732	736	Kopx_Perm.exe	126
PID 736 wrote to memory of 4000	736	Kopx_Perm.exe	128
PID 736 wrote to memory of 4000	736	Kopx_Perm.exe	128
PID 736 wrote to memory of 4820	736	Kopx_Perm.exe	130
PID 736 wrote to memory of 4820	736	Kopx_Perm.exe	130
PID 4820 wrote to memory of 2456	4820	applecleaner.exe	132
PID 4820 wrote to memory of 2456	4820	applecleaner.exe	132
PID 2456 wrote to memory of 768	2456	cmd.exe	133
PID 2456 wrote to memory of 768	2456	cmd.exe	133
PID 4820 wrote to memory of 2828	4820	applecleaner.exe	134
PID 4820 wrote to memory of 2828	4820	applecleaner.exe	134
PID 2828 wrote to memory of 1300	2828	cmd.exe	135
PID 2828 wrote to memory of 1300	2828	cmd.exe	135
PID 4820 wrote to memory of 1120	4820	applecleaner.exe	136
PID 4820 wrote to memory of 1120	4820	applecleaner.exe	136
PID 1120 wrote to memory of 4484	1120	cmd.exe	137
PID 1120 wrote to memory of 4484	1120	cmd.exe	137
PID 736 wrote to memory of 1688	736	Kopx_Perm.exe	138
PID 736 wrote to memory of 1688	736	Kopx_Perm.exe	138
PID 736 wrote to memory of 2516	736	Kopx_Perm.exe	140
PID 736 wrote to memory of 2516	736	Kopx_Perm.exe	140
PID 736 wrote to memory of 5076	736	Kopx_Perm.exe	142
PID 736 wrote to memory of 5076	736	Kopx_Perm.exe	142
PID 736 wrote to memory of 2496	736	Kopx_Perm.exe	144
PID 736 wrote to memory of 2496	736	Kopx_Perm.exe	144
PID 736 wrote to memory of 928	736	Kopx_Perm.exe	146
PID 736 wrote to memory of 928	736	Kopx_Perm.exe	146
PID 736 wrote to memory of 2492	736	Kopx_Perm.exe	148
PID 736 wrote to memory of 2492	736	Kopx_Perm.exe	148
PID 736 wrote to memory of 3452	736	Kopx_Perm.exe	150
PID 736 wrote to memory of 3452	736	Kopx_Perm.exe	150
PID 736 wrote to memory of 1708	736	Kopx_Perm.exe	152
PID 736 wrote to memory of 1708	736	Kopx_Perm.exe	152
PID 736 wrote to memory of 2984	736	Kopx_Perm.exe	154
PID 736 wrote to memory of 2984	736	Kopx_Perm.exe	154

C:\Users\Admin\AppData\Local\Temp\Kopx_Perm.exe
"C:\Users\Admin\AppData\Local\Temp\Kopx_Perm.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /SU AUTO
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:516
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /BS 5T1GPY0C0P1DPDPO
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4468
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /CS 5T1GPY0C0P1DPDPO
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4548
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /SS 5T1GPY0C0P1DPDPO
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:1676
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /SM "System manufacturer"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4808
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /SP "System Product Name"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:2404
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /SV "System Version"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:812
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /SK "SKU"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4836
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /BT "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4104
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /BLC "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:2800
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /CM "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:708
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /CV "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4968
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /CA "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:2032
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /CSK "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:3000
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /SF "To be filled by O.E.M."
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:2732
- C:\Windows\Globalization\winxsrcsv64.exe
  "winxsrcsv64.exe" /PSN 5T1GPY0C0P1DPDPO
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4000
- C:\Windows\IME\applecleaner.exe
  "C:\Windows\IME\applecleaner.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im EpicGamesLauncher.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FortniteClient-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Battle.net.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4484
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /SU AUTO
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:1688
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /BS SNPJNU8PW2O4F6RR
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:2516
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /CS SNPJNU8PW2O4F6RR
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:5076
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /SS SNPJNU8PW2O4F6RR
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:2496
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /SM "System manufacturer"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:928
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /SP "System Product Name"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:2492
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /SV "System Version"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:3452
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /SK "SKU"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:1708
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /BT "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:2984
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /BLC "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4492
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /CM "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:2020
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /CV "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:3092
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /CA "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4648
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /CSK "Default string"
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:1628
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /SF "To be filled by O.E.M."
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:3244
- C:\Windows\Fonts\AMIDEWINx64.exe
  "AMIDEWINx64.exe" /PSN SNPJNU8PW2O4F6RR
  2⤵
  - Cerber
  - Executes dropped EXE
  PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\AMIDEWINx64.EXE

Filesize
377KB

MD5
64ae4aa4904d3b259dda8cc53769064f

SHA1
24be8fb54afd8182652819b9a307b6f66f3fc58d

SHA256
2c67fb6eb81630c917f08295e4ff3b5f777cb41b26f7b09dc36d79f089e61bc4

SHA512
6c16d2bc23c20a7456b4db7136e1bb5fcee9cbf83a73d8de507b7b3ffc618f81f020cde638d2cd1ef5f154541b745a2a0e27b4c654683a21571183f7a1bffd16

Download Submit
C:\Windows\Globalization\winxsrcsv64.exe

Filesize
379KB

MD5
91a31f23f3e50bd0a722e605687aed1e

SHA1
f56fa26aaccdd6eb3f1ea53f06674b01327cd7c4

SHA256
818d6d87d0facc03354bf7b0748467cf61040031248ba8b46045ed9dbe4053d8

SHA512
649ee112c0e9d0c63c199f0dee84332f915af336dd7ad0ff70cbd49cc148c832182ff748c67fe1dee958215ea4a095545d1a93fdeb90fbdeb6f98076b499aab0

Download Submit
C:\Windows\IME\applecleaner.exe

Filesize
3.6MB

MD5
f96eb2236970fb3ea97101b923af4228

SHA1
e0eed80f1054acbf5389a7b8860a4503dd3e184a

SHA256
46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172

SHA512
2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7

Download Submit
memory/736-0-0x00007FF8F69FB000-0x00007FF8F69FC000-memory.dmp

Filesize
4KB

Download
memory/736-1-0x00007FF8F69FB000-0x00007FF8F69FC000-memory.dmp

Filesize
4KB

Download
memory/4820-32-0x00007FF708DA0000-0x00007FF709742000-memory.dmp

Filesize
9.6MB

Download
memory/4820-34-0x00007FF708DA0000-0x00007FF709742000-memory.dmp

Filesize
9.6MB

Download
memory/4820-36-0x00007FF708DA0000-0x00007FF709742000-memory.dmp

Filesize
9.6MB

Download
memory/4820-35-0x00007FF708DA0000-0x00007FF709742000-memory.dmp

Filesize
9.6MB

Download
memory/4820-37-0x00007FF708DA0000-0x00007FF709742000-memory.dmp

Filesize
9.6MB

Download
memory/4820-39-0x00007FF708DA0000-0x00007FF709742000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads