gh0strat | 432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf

Analysis

max time kernel
148s
max time network
134s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
Size

2.3MB
MD5

3661801094ece049030d74f100a62a7d
SHA1

be2ad7cb68f836ed2eb7904d84a736b7bdfff46f
SHA256

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf
SHA512

72659287e7fc1c22ce7a3d7e8bae4121395cd32f1553069fadb2c80badea58a5ec80a18a5915ba38858bdf829524748bdf5eacdf2f289565dbd60a26f50757bb
SSDEEP

24576:YFbkIsaPiXSVnC7Yp9zkNmZG8RRln4yz1Iila8CUpDPkebAeppIg1QR0zKWs6c8u:YREXSVMDi3C0aFUF/pRzK9ihFlkZ

Score

10^/10

gh0strat neshta discovery persistence rat spyware stealer

Malware Config

Signatures

Detect Neshta payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0001000000010319-10.dat	family_neshta
behavioral1/memory/2268-103-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2268-105-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0007000000016c75-17.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

Processes:

look2.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259522233.bat"	look2.exe

Executes dropped EXE 3 IoCs

Processes:

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exelook2.exesvchcst.exe

pid	Process
2544	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
2288	look2.exe
2516	svchcst.exe

Loads dropped DLL 7 IoCs

Processes:

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exelook2.exesvchost.exesvchcst.exe

pid	Process
2268	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
2544	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
2288	look2.exe
2912	svchost.exe
2268	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
2912	svchost.exe
2516	svchcst.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\259522233.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 64 IoCs

Processes:

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

description	ioc	Process
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

Drops file in Windows directory 1 IoCs

Processes:

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

svchcst.exe432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exelook2.exesvchost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	look2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 1 IoCs

Processes:

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

pid	Process
2544	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
2544	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exesvchost.exe

description	pid	Process	procid_target
PID 2268 wrote to memory of 2544	2268	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe	29
PID 2268 wrote to memory of 2544	2268	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe	29
PID 2268 wrote to memory of 2544	2268	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe	29
PID 2268 wrote to memory of 2544	2268	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe	29
PID 2544 wrote to memory of 2288	2544	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe	30
PID 2544 wrote to memory of 2288	2544	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe	30
PID 2544 wrote to memory of 2288	2544	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe	30
PID 2544 wrote to memory of 2288	2544	432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe	30
PID 2912 wrote to memory of 2516	2912	svchost.exe	33
PID 2912 wrote to memory of 2516	2912	svchost.exe	33
PID 2912 wrote to memory of 2516	2912	svchost.exe	33
PID 2912 wrote to memory of 2516	2912	svchost.exe	33

C:\Users\Admin\AppData\Local\Temp\432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
"C:\Users\Admin\AppData\Local\Temp\432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\3582-490\432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\look2.exe
    C:\Users\Admin\AppData\Local\Temp\\look2.exe
    3⤵
    - Server Software Component: Terminal Services DLL
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2288

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:2876

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\259522233.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\432ea6299e26471cc3f16ebe28bc694e45afd3d85f11ac5bd5395cb2f951d3bf.exe

Filesize
2.2MB

MD5
70e7fc95995215806697e6f7464ae162

SHA1
66630fe8d91d87420d75175ae377e502002b8532

SHA256
b509ede47c7f127da5e1e9124aea85a41f6279bc5a97d17e4f4cfc6873dc3b67

SHA512
7b4e35420d531a768d67780ddd771c1f9ca6a9e2106a5f42ed644edbf151e7a88db9a55cd7d23012a27d74f07bc1ce8114307cf7f8abf883a399298271fa0c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
337KB

MD5
2f3b6f16e33e28ad75f3fdaef2567807

SHA1
85e907340faf1edfc9210db85a04abd43d21b741

SHA256
86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857

SHA512
db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Windows\SysWOW64\259522233.bat

Filesize
51KB

MD5
8fc2871e5e70ce0b21ff0ee012fdbaae

SHA1
b55461faff586d1a5b24abbb02a2b153f847f9b7

SHA256
4466fec89fc1b6cfaa5fb1cf8eb4ae6022c172e84a5343708df6f6ecd3f3ed65

SHA512
5509a333712951a91c79ce5c710c2736b28fe2e2e0225d606eb841eba439d20a09d999ce02243360e847ff85f620ee70ca63e6e0efe8a26233d5da7a1ca177ca

Download Submit
\Windows\SysWOW64\svchcst.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/2268-103-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2268-105-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download