Analysis Overview
SHA256
b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a
Threat Level: Known bad
The file b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a was found to be: Known bad.
Malicious Activity Summary
Windows security bypass
Drops file in Drivers directory
Event Triggered Execution: Image File Execution Options Injection
Boot or Logon Autostart Execution: Active Setup
Loads dropped DLL
Windows security modification
Executes dropped EXE
Modifies WinLogon
Indicator Removal: Clear Persistence
Drops file in System32 directory
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-14 01:52
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-14 01:52
Reported
2024-11-14 01:54
Platform
win7-20240903-en
Max time kernel
149s
Max time network
142s
Command Line
Signatures
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Boot or Logon Autostart Execution: Active Setup
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A514142-4f50-5745-5A51-41424F505745}\IsInstalled = "1" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A514142-4f50-5745-5A51-41424F505745}\StubPath = "C:\\Windows\\system32\\ahuy.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A514142-4f50-5745-5A51-41424F505745} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A514142-4f50-5745-5A51-41424F505745}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\etc\hosts | C:\Windows\SysWOW64\rmass.exe | N/A |
Event Triggered Execution: Image File Execution Options Injection
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Indicator Removal: Clear Persistence
| Description | Indicator | Process | Target |
| Delete value | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger | C:\Windows\SysWOW64\rmass.exe | N/A |
Modifies WinLogon
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| File created | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| File created | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\Common Files\System\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\winlogon.exe
winlogon.exe
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe
"C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe"
C:\Windows\SysWOW64\rmass.exe
"C:\Windows\system32\rmass.exe"
C:\Windows\SysWOW64\rmass.exe
--k33p
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | okrkaise.ws | udp |
| US | 64.70.19.203:80 | okrkaise.ws | tcp |
| US | 8.8.8.8:53 | utbidet-ugeas.biz | udp |
| US | 172.234.222.143:80 | utbidet-ugeas.biz | tcp |
| US | 8.8.8.8:53 | utbidet-ugeas.biz | udp |
| US | 172.234.222.138:80 | utbidet-ugeas.biz | tcp |
Files
\Windows\SysWOW64\rmass.exe
| MD5 | 0a142a0cffb5b0344435446f1a3600ee |
| SHA1 | ab322c5329c3eeef1d71c2568ce4662215a15255 |
| SHA256 | b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a |
| SHA512 | 2dd422c56ccf87cb12c3a6a4f049e149c69d216f730b154a32bec17485eb1a4632ad3a46866fd09548b4b6085112fe43ab8827ebf74b845815769d06ce032b5c |
memory/880-9-0x0000000000400000-0x000000000040E000-memory.dmp
C:\Windows\SysWOW64\ahuy.exe
| MD5 | c0fe8fe7cdbcb5453b3ac7522a0d1857 |
| SHA1 | 5a9215b7ee890d4aae324fce9a661d23f76f7989 |
| SHA256 | b13047fa5d7c1f252d490597154021ee7f60ca996ebcbaf7a2c2ea8da4aad41d |
| SHA512 | 383e49115950fd20cf9ef701e4e94a151e5e81886d34fc54fe5e1a71a64f794e36bce6ba8e0fa53be0d71c503ad742dc80c7544dd2178dfa6ba332f1d10a408c |
C:\Windows\SysWOW64\ntdbg.exe
| MD5 | bc2f70277867011a0d8db9ee1ee70516 |
| SHA1 | d41e74be42a471481eed176322c265d63974b6b3 |
| SHA256 | 717d1e2a0d9f2f940c6ea569fe2fdfe4e1168070cc6455c67c4895134705acb1 |
| SHA512 | 80afa6cf6e8968fce557a41e1b13f5e801627420172d4106cb969a5f9ff82c32c11f8933a345e5556d2ba9f71ede56c7010ea46ef6ef552202a893a3c3db5359 |
C:\Windows\SysWOW64\RECOVER32.DLL
| MD5 | 2b2c28a7a01f9584fe220ef84003427f |
| SHA1 | 5fc023df0b5064045eb8de7f2dbe26f07f6fec70 |
| SHA256 | 9e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb |
| SHA512 | 39192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78 |
memory/2924-52-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2936-53-0x0000000000400000-0x000000000040E000-memory.dmp
C:\Windows\System32\drivers\etc\hosts
| MD5 | b10b13206b0f2cf3968050072f6979bf |
| SHA1 | 699db21ba9cecf3f13ac3d76e22cfa41aa94da80 |
| SHA256 | 0eef3217095cb97b695c434e74d6314bf9e869a013d6e9c88e58c34576a276b4 |
| SHA512 | d33bfd931be6676539507a69101d99fa4c5ef36b12422bd11f063b9b6a47b7444f6c4ad5f35e044714fdb872e96cd9fddf049e8329af1219483887f6ac5f4a5d |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-14 01:52
Reported
2024-11-14 01:54
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
136s
Command Line
Signatures
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Boot or Logon Autostart Execution: Active Setup
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{594C464F-4749-4f45-594C-464F47494f45}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{594C464F-4749-4f45-594C-464F47494f45}\IsInstalled = "1" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{594C464F-4749-4f45-594C-464F47494f45}\StubPath = "C:\\Windows\\system32\\ahuy.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{594C464F-4749-4f45-594C-464F47494f45} | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\etc\hosts | C:\Windows\SysWOW64\rmass.exe | N/A |
Event Triggered Execution: Image File Execution Options Injection
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Indicator Removal: Clear Persistence
| Description | Indicator | Process | Target |
| Delete value | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger | C:\Windows\SysWOW64\rmass.exe | N/A |
Modifies WinLogon
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| File created | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| File created | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\Common Files\System\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\winlogon.exe
winlogon.exe
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe
"C:\Users\Admin\AppData\Local\Temp\b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a.exe"
C:\Windows\SysWOW64\rmass.exe
"C:\Windows\system32\rmass.exe"
C:\Windows\SysWOW64\rmass.exe
--k33p
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | wvcfiamctegep.ws | udp |
| US | 64.70.19.203:80 | wvcfiamctegep.ws | tcp |
| US | 8.8.8.8:53 | utbidet-ugeas.biz | udp |
| US | 172.234.222.143:80 | utbidet-ugeas.biz | tcp |
| US | 8.8.8.8:53 | utbidet-ugeas.biz | udp |
| US | 172.234.222.143:80 | utbidet-ugeas.biz | tcp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.19.70.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.222.234.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
Files
C:\Windows\SysWOW64\rmass.exe
| MD5 | 0a142a0cffb5b0344435446f1a3600ee |
| SHA1 | ab322c5329c3eeef1d71c2568ce4662215a15255 |
| SHA256 | b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a |
| SHA512 | 2dd422c56ccf87cb12c3a6a4f049e149c69d216f730b154a32bec17485eb1a4632ad3a46866fd09548b4b6085112fe43ab8827ebf74b845815769d06ce032b5c |
memory/4588-6-0x0000000000400000-0x000000000040E000-memory.dmp
C:\Windows\SysWOW64\ahuy.exe
| MD5 | 3f9382250386ec71d2c34c4ad3f19fa6 |
| SHA1 | 1e39352353eb420bca6caaf88d55c59c75a71f68 |
| SHA256 | ef5e3ef457722307364e7ca233d0e673ac08ab3e5f92ddf79cad0731857e22e1 |
| SHA512 | fea7b50de3bbcbc2459ae582323ed3cb6b992fde4004762ca934438bc9eacd1d7590f01109a79bbc49aa8cc0f9da5986ed0ad800a8606816f50999721a45f670 |
C:\Windows\SysWOW64\RECOVER32.DLL
| MD5 | 2b2c28a7a01f9584fe220ef84003427f |
| SHA1 | 5fc023df0b5064045eb8de7f2dbe26f07f6fec70 |
| SHA256 | 9e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb |
| SHA512 | 39192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78 |
C:\Windows\SysWOW64\ntdbg.exe
| MD5 | 17969e23e76c68c2ba3d80d3dfeeae85 |
| SHA1 | c14f94a154549a9456632ae3badc2c968f231507 |
| SHA256 | e1ab6e4c12c69fabe27e01f9aefb8fa7440aee7dbe9d11340f5721fb8a514f76 |
| SHA512 | 5fd41afb8d2fc82f3350db7e9e3d5276ebd2160ec93a688840db481e3db5ef0056b536981e83e6bedf90c1b62a9f9c94c5acf9c4c005f5510e9e581ee984fa97 |
memory/3128-46-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2516-47-0x0000000000400000-0x000000000040E000-memory.dmp
C:\Windows\System32\drivers\etc\hosts
| MD5 | 6f47b62de25d1745e296a06b3f98ed19 |
| SHA1 | a688bb35a4c8a5cc198985d624a1b5a6ac5b9f6f |
| SHA256 | 15c7218eb9cef5fa0573db657b15ce3a5f0e0609f1166df8098ca7152df505b4 |
| SHA512 | dea26fff8060f44bf20fe4fff2ecbacf428727f10c0f5886fb4813e28fce9cbc3d088337c84edd9857b18514c83f1bb1cf0f51518aaecef09f30e921f4d758d7 |