gh0strat | 8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7

General

Target

8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
Size

2.9MB
MD5

f9a15443745c8b6c0e2c2e871f46ca30
SHA1

c00e4316da7d3e4a658a15aa2a3ef537d87bce66
SHA256

8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7
SHA512

b0e6752be0a30e10251fada4ff432c7fd09ad45429cd08343304c5f169cc30d94ccaf41ddb90e1844338b396f1977aa03562e8fc121ae5840661aa8cfa95008b
SSDEEP

49152:KYREXSVMDi3D+3+XGwv2tP1zTPADnWPMklKu8bi4O8b8ITDnl13S:/2SVMD8D+3+Wwv2tP1PPknK

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\259456884.bat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259456884.bat"	look2.exe

Executes dropped EXE 4 IoCs

Processes:

look2.exeHD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exeHD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exesvchcst.exe

pid	process
1968	look2.exe
2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
2868	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
1624	svchcst.exe

Loads dropped DLL 7 IoCs

Processes:

8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exelook2.exesvchost.exeHD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exesvchcst.exe

pid	process
2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
1968	look2.exe
2324	svchost.exe
2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
2324	svchost.exe
1624	svchcst.exe

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\259456884.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

Processes:

8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exelook2.exesvchost.exeHD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exeHD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exesvchcst.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	look2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

description ioc process

Key created \REGISTRY\USER\ HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

description	ioc	process
Key created	\REGISTRY\USER\	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

Modifies registry class 1 IoCs

Processes:

HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

pid process

2332 8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

pid	process
2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exeHD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

C:\Users\Admin\AppData\Local\Temp\8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
"C:\Users\Admin\AppData\Local\Temp\8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\look2.exe
  C:\Users\Admin\AppData\Local\Temp\\look2.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
  C:\Users\Admin\AppData\Local\Temp\HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
    "C:\Users\Admin\AppData\Local\Temp\HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe" --channel=2368.0.589249908 --type=renderer
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2868

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:1408

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2324
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\259456884.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.4MB

MD5
06d978dd90f0f028ac682657a328ac4a

SHA1
d45928316caafd1402df444e44bcdaaaee1a3678

SHA256
9bdcca0eb16f0549cda899a222d028e882895c6447329a5ddbb449f3ed9069ba

SHA512
90a5c1b92410572207a1c9c21a32de136ef9243e1a5472ae31d96a1bfc181c07fa7d85a9b12d1a9b9158e1196fe31e9ec1eb40c444a5420b7158490e83bb8601

Download Submit
\Users\Admin\AppData\Local\Temp\HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

Filesize
1.5MB

MD5
7a97aa40d8a3da4a9095873c72d524c5

SHA1
d219db66995e0548ea1226cb1806388b1ac718f7

SHA256
00d2ce2c35e8f2d31c2a8778c6e8846be3d1467cd1e66aa494571a14dea0e4d1

SHA512
16de6e0fdda9ebd7de996e97f73d9fad661c947320b604e5aafdcde50ee4582b1b07da98233b12dc76c464abe2104323c056b1ab477532ee10f5117cb03aa90c

Download Submit
\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
337KB

MD5
2f3b6f16e33e28ad75f3fdaef2567807

SHA1
85e907340faf1edfc9210db85a04abd43d21b741

SHA256
86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857

SHA512
db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4

Download Submit
\Windows\SysWOW64\259456884.bat

Filesize
51KB

MD5
a9085e2a4792b122da0475b6556f1315

SHA1
b42baf387b0f4b2646a990e65b12ddeceedb1c8e

SHA256
1ffe3bd7c38c213f068a8470ec6c45bce1046d53e0399a993cee1856e3cdd4a2

SHA512
960c5653322f070d817d2a00a6a6d82b455b0712b38d3020a597bad516743e6197c63984e28f0221679e70f39c170c747fff0204de8856867025a0ee325ffd55

Download Submit
\Windows\SysWOW64\svchcst.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/2868-33-0x0000000000470000-0x0000000000472000-memory.dmp

Filesize
8KB

Download

description	pid	process	target process
PID 2332 wrote to memory of 1968	2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	look2.exe
PID 2332 wrote to memory of 1968	2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	look2.exe
PID 2332 wrote to memory of 1968	2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	look2.exe
PID 2332 wrote to memory of 1968	2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	look2.exe
PID 2332 wrote to memory of 2368	2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2332 wrote to memory of 2368	2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2332 wrote to memory of 2368	2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2332 wrote to memory of 2368	2332	8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe
PID 2368 wrote to memory of 2868	2368	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe	HD_8143703d320fe0b7849fbce9371af5f703a78ddae3439c6b83cc8d2296db75b7.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads