08b9cc436ad26a14d42dbba3593cc54d8a501a0074aa2089bf50ad1b07b27e89

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 00:32 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01f3c0412dccc0b72ee4060d3a45d350N.exe
Size

45KB
MD5

01f3c0412dccc0b72ee4060d3a45d350
SHA1

6c9e1e21f3c408c5a03ad93b706fdc1c079c6587
SHA256

08b9cc436ad26a14d42dbba3593cc54d8a501a0074aa2089bf50ad1b07b27e89
SHA512

630b84b4581deb76a6bba97aad119ce93301ce43df28cc39bb39da4837e4c2e86de83d8eb1c6ce9e467e5bd2abd6641b611afbc72972f8f20edbd2d46b5a63ca
SSDEEP

768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nE4B:FAwEmBGz1lNNqDaG0PoxhlzmC

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	01f3c0412dccc0b72ee4060d3a45d350N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	01f3c0412dccc0b72ee4060d3a45d350N.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	01f3c0412dccc0b72ee4060d3a45d350N.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	01f3c0412dccc0b72ee4060d3a45d350N.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
1084	xk.exe
2744	IExplorer.exe
4576	WINLOGON.EXE
224	CSRSS.EXE
4232	SERVICES.EXE
3488	LSASS.EXE
1284	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	01f3c0412dccc0b72ee4060d3a45d350N.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	01f3c0412dccc0b72ee4060d3a45d350N.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	01f3c0412dccc0b72ee4060d3a45d350N.exe
File created	C:\Windows\SysWOW64\shell.exe	01f3c0412dccc0b72ee4060d3a45d350N.exe
File created	C:\Windows\SysWOW64\Mig2.scr	01f3c0412dccc0b72ee4060d3a45d350N.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	01f3c0412dccc0b72ee4060d3a45d350N.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	01f3c0412dccc0b72ee4060d3a45d350N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	01f3c0412dccc0b72ee4060d3a45d350N.exe
File created	C:\Windows\xk.exe	01f3c0412dccc0b72ee4060d3a45d350N.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	01f3c0412dccc0b72ee4060d3a45d350N.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	01f3c0412dccc0b72ee4060d3a45d350N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3744	01f3c0412dccc0b72ee4060d3a45d350N.exe
3744	01f3c0412dccc0b72ee4060d3a45d350N.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3744	01f3c0412dccc0b72ee4060d3a45d350N.exe
1084	xk.exe
2744	IExplorer.exe
4576	WINLOGON.EXE
224	CSRSS.EXE
4232	SERVICES.EXE
3488	LSASS.EXE
1284	SMSS.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 1084	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	85
PID 3744 wrote to memory of 1084	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	85
PID 3744 wrote to memory of 1084	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	85
PID 3744 wrote to memory of 2744	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	86
PID 3744 wrote to memory of 2744	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	86
PID 3744 wrote to memory of 2744	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	86
PID 3744 wrote to memory of 4576	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	87
PID 3744 wrote to memory of 4576	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	87
PID 3744 wrote to memory of 4576	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	87
PID 3744 wrote to memory of 224	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	88
PID 3744 wrote to memory of 224	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	88
PID 3744 wrote to memory of 224	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	88
PID 3744 wrote to memory of 4232	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	90
PID 3744 wrote to memory of 4232	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	90
PID 3744 wrote to memory of 4232	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	90
PID 3744 wrote to memory of 3488	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	91
PID 3744 wrote to memory of 3488	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	91
PID 3744 wrote to memory of 3488	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	91
PID 3744 wrote to memory of 1284	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	93
PID 3744 wrote to memory of 1284	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	93
PID 3744 wrote to memory of 1284	3744	01f3c0412dccc0b72ee4060d3a45d350N.exe	93

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	01f3c0412dccc0b72ee4060d3a45d350N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	01f3c0412dccc0b72ee4060d3a45d350N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	01f3c0412dccc0b72ee4060d3a45d350N.exe

C:\Users\Admin\AppData\Local\Temp\01f3c0412dccc0b72ee4060d3a45d350N.exe
"C:\Users\Admin\AppData\Local\Temp\01f3c0412dccc0b72ee4060d3a45d350N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3744
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1084
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2744
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4576
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:224
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4232
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3488
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1284

Network

DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

22.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.160.190.20.in-addr.arpa

IN PTR

Response
DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR
DNS

86.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.23.85.13.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

25.140.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

25.140.123.92.in-addr.arpa

IN PTR

Response

25.140.123.92.in-addr.arpa

IN PTR

a92-123-140-25deploystaticakamaitechnologiescom
DNS

240.143.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.143.123.92.in-addr.arpa

IN PTR

Response

240.143.123.92.in-addr.arpa

IN PTR

a92-123-143-240deploystaticakamaitechnologiescom

No results found

8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

22.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

22.160.190.20.in-addr.arpa
8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

146 B
147 B
2
1

DNS Request

196.249.167.52.in-addr.arpa

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

86.23.85.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

86.23.85.13.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

25.140.123.92.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

25.140.123.92.in-addr.arpa
8.8.8.8:53

240.143.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

240.143.123.92.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
45KB

MD5
c019db8f7c8d172f8e26bd8b2306bcf3

SHA1
1a6269106564e2f369dc712f3f4fe6dc1f274bb0

SHA256
dfd4139f760a6f851b1e1b7a13bc174283169de30cb320da973830438dbb9648

SHA512
61562dbc38bcb13828dc9c50f9ac6280b17d019500ca65a79e235b5cb6f7cb9d95de7e4be228d65d10bdb9631df9761d9145124adb9a834f78b6c336fea13180

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
45KB

MD5
7fd83153ae4d48f29ad823c60529c993

SHA1
ba20c14683d816a48dee608d57479581782d01f8

SHA256
542ce93dd3d3b9122dea684e1f7c98bb018275337d956745d164dba396e2e88d

SHA512
59f96aec064001f096b09e6fad703fadb1c0c0b2323e82aaa009d1d39c448d5d6d7f3f5dd87d6afd5289aa7b3bb0cfa6b57ef900c03cae5c95a70d975d491849

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
45KB

MD5
cdf061714f3274fb822cd24276ad549b

SHA1
f940d7cd4734790e20f736cc6346eee73d3dba76

SHA256
c0ee7c97b186bc68746f050e738bca514a7b92208e70ebf67f89511498369b47

SHA512
396678c0b859121978f5c303de59e96c368ae242cc79d1eba8baecdadc95a286815e97b57bb78e6aa5eda21ba577b9717d17238bcd892f3be83555e88b9b5416

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
45KB

MD5
0aa04d1107f4f169491caa96080bbd10

SHA1
32e7a799452a7c99b47f9ca4d7b255257cf2185d

SHA256
e6eb5cc1d2fe7ead54b9b17e9918146c7d0e5da928ceecb7072edd11a37cacc4

SHA512
a2cc6bc681fc463d2c05e0897024701095d09d63379f59d4899695a82c6027994bc9f944412035667b211a4e1adb5bcca53d02971d072d197948f951046437bd

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
45KB

MD5
01f3c0412dccc0b72ee4060d3a45d350

SHA1
6c9e1e21f3c408c5a03ad93b706fdc1c079c6587

SHA256
08b9cc436ad26a14d42dbba3593cc54d8a501a0074aa2089bf50ad1b07b27e89

SHA512
630b84b4581deb76a6bba97aad119ce93301ce43df28cc39bb39da4837e4c2e86de83d8eb1c6ce9e467e5bd2abd6641b611afbc72972f8f20edbd2d46b5a63ca

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
45KB

MD5
c4b403281f815e801e792ab2bcb0ae87

SHA1
18235f6f8ea91cecdfd59c6882019aa6547eb17a

SHA256
160ba4022081bce0554feeb6b31c6e0e2c6c10a636b2ad7c2c6cc77a5d10ed9a

SHA512
7cfff9c0bcf0d67a6056f1c33ecaaebea2d275c4041a15d03b54970abc76270df0baf4d56467b53fba041f791380e863b9f44418474455ce8123bb5a7db37a21

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
b3a98f6d829a96a7ce87429188ac2131

SHA1
a0d0954e134d8ded588c63794a3db47f31099f52

SHA256
0e0c7479b0237093dcff7cb3bdcc75c29193531342d2ad9919a69a9fc33e8873

SHA512
223e0774821aee355f0724e3260a78d2484823542296d7404c5d97de416ebb8190dcc17974d858118910b0f10c9c9cf4779ad2170a4bd2ae71023523f377d750

Download Submit
C:\Windows\xk.exe

Filesize
45KB

MD5
550055c1b98520e512baf7b56bc025ae

SHA1
3c846a6d3c676d5514ac6ae0833f0060c9ec8004

SHA256
b92f5ec749740fabab482a029800259c2c6d2f00f355d402a1e8acaeb9af6ac5

SHA512
b91915038555c2a0a66f4b2c68cb2c9ea2765e42904f6f9a19cffd32195b83300e716129adf496e8602f98775f51919e7e96c85b2a45f1fafcc4a89808a3948c

Download Submit
memory/224-132-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1084-113-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1284-152-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2744-118-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3488-145-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3744-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3744-153-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4232-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4576-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.