Analysis Overview
SHA256
4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e
Threat Level: Known bad
The file 4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e was found to be: Known bad.
Malicious Activity Summary
Windows security bypass
Drops file in Drivers directory
Boot or Logon Autostart Execution: Active Setup
Event Triggered Execution: Image File Execution Options Injection
Windows security modification
Loads dropped DLL
Executes dropped EXE
Modifies WinLogon
Indicator Removal: Clear Persistence
Drops file in System32 directory
UPX packed file
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-13 21:53
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-13 21:53
Reported
2024-11-13 21:55
Platform
win7-20240729-en
Max time kernel
149s
Max time network
141s
Command Line
Signatures
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Boot or Logon Autostart Execution: Active Setup
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{58454355-444e-4344-5845-4355444E4344} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{58454355-444e-4344-5845-4355444E4344}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{58454355-444e-4344-5845-4355444E4344}\IsInstalled = "1" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{58454355-444e-4344-5845-4355444E4344}\StubPath = "C:\\Windows\\system32\\ahuy.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\etc\hosts | C:\Windows\SysWOW64\rmass.exe | N/A |
Event Triggered Execution: Image File Execution Options Injection
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Indicator Removal: Clear Persistence
| Description | Indicator | Process | Target |
| Delete value | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger | C:\Windows\SysWOW64\rmass.exe | N/A |
Modifies WinLogon
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe | N/A |
| File created | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\Common Files\System\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\winlogon.exe
winlogon.exe
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe
"C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe"
C:\Windows\SysWOW64\rmass.exe
"C:\Windows\SysWOW64\rmass.exe"
C:\Windows\SysWOW64\rmass.exe
--k33p
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | wwqmmjzxmmrl.vg | udp |
| DE | 88.198.29.97:80 | wwqmmjzxmmrl.vg | tcp |
| US | 8.8.8.8:53 | utbidet-ugeas.biz | udp |
| US | 172.234.222.138:80 | utbidet-ugeas.biz | tcp |
| US | 8.8.8.8:53 | utbidet-ugeas.biz | udp |
| US | 172.234.222.138:80 | utbidet-ugeas.biz | tcp |
Files
\Windows\SysWOW64\rmass.exe
| MD5 | b9da59a931bb89d767fc4a0076b4ac1f |
| SHA1 | a972f2b6a12583a14af123b4d85682166359b5aa |
| SHA256 | 794add531d006278aceb95011933d98bc1790373baa0d00248f49a070050409e |
| SHA512 | e744608af3f96fe3aa8c0716b81ffd3b393c47531ee9f53b9d19ef448e4c0e3b318c2982512b6e02fd30bc940d64258dbb3846768bd7d8f98c50e8ea5322062a |
memory/2128-9-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2328-7-0x0000000000400000-0x0000000000403000-memory.dmp
memory/2128-21-0x0000000000360000-0x0000000000372000-memory.dmp
C:\Windows\SysWOW64\ahuy.exe
| MD5 | 837748f5d665212521514e7df818838b |
| SHA1 | 1a042bf4d9dbee6b0c1168ef27b99b8536b4d6ff |
| SHA256 | 08523eab576d87e341d418960def7388df8c902a4ae3c5749a1d75091afdef88 |
| SHA512 | 6b235d8bff93ed6a392ea11604c797e5fc8204ab8ba29896750bce82c433556a12b4323d07d409270b24f4b700d66fc2109dc4d6386c3d5c97ec5e212e65b96b |
C:\Windows\SysWOW64\ntdbg.exe
| MD5 | 371e1b1438a72f72453d0b9d6905075d |
| SHA1 | fa3d41378f518dfb986e72dfd17dd1e6e10dc033 |
| SHA256 | 3eeea3857357f67e7c6650e7619d731084a02f3a9f3a16da392994a374175b9f |
| SHA512 | 1017c987df82a123c91e65aaa68a43d576710ec5063ce5550f737016b24889243e3b2639a85bfac38f620df67ddc139843a98a8b1d61349c31c4b00366c99fc5 |
C:\Windows\SysWOW64\RECOVER32.DLL
| MD5 | 26d81b6407c77187d3e0d3d164d41d8b |
| SHA1 | 6194ccc0882d2c3b341e1fdedb7b6cfc596828d2 |
| SHA256 | cbcbc60fba71d01355fdbf9c17462085c5157ac7b63d0947e2307286f5368124 |
| SHA512 | 2fe6b7a4bba449ab80dd85b2157e69b1091c74fee66efe71e3efc0d2eb5934349d8a5c1863864ae1bf17aef0b406dd08836d7a902a03c37f61ca679e6c75b772 |
memory/2128-43-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2128-50-0x0000000000360000-0x0000000000372000-memory.dmp
memory/2668-51-0x0000000000400000-0x0000000000412000-memory.dmp
C:\Windows\System32\drivers\etc\hosts
| MD5 | b10b13206b0f2cf3968050072f6979bf |
| SHA1 | 699db21ba9cecf3f13ac3d76e22cfa41aa94da80 |
| SHA256 | 0eef3217095cb97b695c434e74d6314bf9e869a013d6e9c88e58c34576a276b4 |
| SHA512 | d33bfd931be6676539507a69101d99fa4c5ef36b12422bd11f063b9b6a47b7444f6c4ad5f35e044714fdb872e96cd9fddf049e8329af1219483887f6ac5f4a5d |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-13 21:53
Reported
2024-11-13 21:55
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Boot or Logon Autostart Execution: Active Setup
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{474C5A43-534e-4c4b-474C-5A43534E4c4b} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{474C5A43-534e-4c4b-474C-5A43534E4c4b}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{474C5A43-534e-4c4b-474C-5A43534E4c4b}\IsInstalled = "1" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{474C5A43-534e-4c4b-474C-5A43534E4c4b}\StubPath = "C:\\Windows\\system32\\ahuy.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\etc\hosts | C:\Windows\SysWOW64\rmass.exe | N/A |
Event Triggered Execution: Image File Execution Options Injection
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Indicator Removal: Clear Persistence
| Description | Indicator | Process | Target |
| Delete value | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger | C:\Windows\SysWOW64\rmass.exe | N/A |
Modifies WinLogon
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe | N/A |
| File created | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\Common Files\System\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\winlogon.exe
winlogon.exe
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe
"C:\Users\Admin\AppData\Local\Temp\4b70f90dc4b6a8eb0907918c7e3341b835b1553c472171f5387b2c0ba974817e.exe"
C:\Windows\SysWOW64\rmass.exe
"C:\Windows\SysWOW64\rmass.exe"
C:\Windows\SysWOW64\rmass.exe
--k33p
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | sikzledva.pw | udp |
| US | 8.8.8.8:53 | sikzledva.pw | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.73.42.20.in-addr.arpa | udp |
Files
C:\Windows\SysWOW64\rmass.exe
| MD5 | b9da59a931bb89d767fc4a0076b4ac1f |
| SHA1 | a972f2b6a12583a14af123b4d85682166359b5aa |
| SHA256 | 794add531d006278aceb95011933d98bc1790373baa0d00248f49a070050409e |
| SHA512 | e744608af3f96fe3aa8c0716b81ffd3b393c47531ee9f53b9d19ef448e4c0e3b318c2982512b6e02fd30bc940d64258dbb3846768bd7d8f98c50e8ea5322062a |
memory/428-4-0x0000000000400000-0x0000000000412000-memory.dmp
memory/800-3-0x0000000000400000-0x0000000000403000-memory.dmp
C:\Windows\SysWOW64\ahuy.exe
| MD5 | 284ce48806732c60c0462c929d964a54 |
| SHA1 | f4fa1844aac7573cae85d54b83d668816fbc6f7c |
| SHA256 | e495756ab15d025688c0af5689b6dcebfce61a8ec522e62ce7fe3ebbc582b8a6 |
| SHA512 | 8db9052f761eeada6a159ac4fc5fe4c5fc21ed961c69f88654bb1a4ce5a9eeb68907bc4dc27bce314b541269315ecbd1eb198a66c43d5290bb7d69feba3038bb |
C:\Windows\SysWOW64\ntdbg.exe
| MD5 | 6f5f6a56fc3f2f4bcf2485968aed68fb |
| SHA1 | fc7bcdad6d70d9ac8af9d0d397fc8ef00b5ec5b1 |
| SHA256 | e5a16c6df42389bf3e410c11210a14c977ba35a3bf76d2d420d7d342ec704e50 |
| SHA512 | e8abcf613a7f5d6e1147585013a5d92abbb5f19e8db7c7e4ec6e724a377e9d94acce73585796c6b51bdf726a56a8bfa4f36bcd986488917cd1b671b1b892d49f |
C:\Windows\SysWOW64\RECOVER32.DLL
| MD5 | 26d81b6407c77187d3e0d3d164d41d8b |
| SHA1 | 6194ccc0882d2c3b341e1fdedb7b6cfc596828d2 |
| SHA256 | cbcbc60fba71d01355fdbf9c17462085c5157ac7b63d0947e2307286f5368124 |
| SHA512 | 2fe6b7a4bba449ab80dd85b2157e69b1091c74fee66efe71e3efc0d2eb5934349d8a5c1863864ae1bf17aef0b406dd08836d7a902a03c37f61ca679e6c75b772 |
memory/428-39-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1340-44-0x0000000000400000-0x0000000000412000-memory.dmp
C:\Windows\System32\drivers\etc\hosts
| MD5 | 6f47b62de25d1745e296a06b3f98ed19 |
| SHA1 | a688bb35a4c8a5cc198985d624a1b5a6ac5b9f6f |
| SHA256 | 15c7218eb9cef5fa0573db657b15ce3a5f0e0609f1166df8098ca7152df505b4 |
| SHA512 | dea26fff8060f44bf20fe4fff2ecbacf428727f10c0f5886fb4813e28fce9cbc3d088337c84edd9857b18514c83f1bb1cf0f51518aaecef09f30e921f4d758d7 |