gh0strat | 9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a

Analysis

max time kernel
150s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Size

2.2MB
MD5

b01a11449dd83a10497833b23fb0887d
SHA1

8f5276ee02a5b4b23cb7e9d500dd0df71382e211
SHA256

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a
SHA512

cf3634a8253c439d54233162db10b9668f080e184e4e1b52aae60db303e89d2ca9fead16097937a871d54685592b1b58e389d481b94f6c261d5caec98223ec81
SSDEEP

24576:ZFbkIsaPiXSVnC7Yp9zkNmZG8RRlnZyz/Iila8CJn0BgtscdTtOOa9pfthIDdsRQ:ZREXSVMDi350aFJqciOa925sRtMZ

Score

10^/10

gh0strat neshta discovery persistence rat spyware stealer

Malware Config

Signatures

Detect Neshta payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0001000000010314-10.dat	family_neshta
behavioral1/memory/2936-126-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2936-128-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x00070000000175f1-17.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

Processes:

look2.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259454732.bat"	look2.exe

Executes dropped EXE 4 IoCs

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exelook2.exeHD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exesvchcst.exe

pid	Process
2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2516	look2.exe
2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
1152	svchcst.exe

Loads dropped DLL 10 IoCs

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exelook2.exesvchost.exesvchcst.exe

pid	Process
2936	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2516	look2.exe
2568	svchost.exe
2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2936	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2936	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2568	svchost.exe
1152	svchcst.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\259454732.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 64 IoCs

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

Drops file in Windows directory 1 IoCs

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exelook2.exesvchost.exeHD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exesvchcst.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	look2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe

Modifies registry class 1 IoCs

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

pid	Process
2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

description	pid	Process
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: 33	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
Token: SeIncBasePriorityPrivilege	2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exeHD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

pid	Process
2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
2636	HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exesvchost.exe

description	pid	Process	procid_target
PID 2936 wrote to memory of 2908	2936	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	29
PID 2936 wrote to memory of 2908	2936	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	29
PID 2936 wrote to memory of 2908	2936	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	29
PID 2936 wrote to memory of 2908	2936	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	29
PID 2908 wrote to memory of 2516	2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	30
PID 2908 wrote to memory of 2516	2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	30
PID 2908 wrote to memory of 2516	2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	30
PID 2908 wrote to memory of 2516	2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	30
PID 2908 wrote to memory of 2636	2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	33
PID 2908 wrote to memory of 2636	2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	33
PID 2908 wrote to memory of 2636	2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	33
PID 2908 wrote to memory of 2636	2908	9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe	33
PID 2568 wrote to memory of 1152	2568	svchost.exe	34
PID 2568 wrote to memory of 1152	2568	svchost.exe	34
PID 2568 wrote to memory of 1152	2568	svchost.exe	34
PID 2568 wrote to memory of 1152	2568	svchost.exe	34

C:\Users\Admin\AppData\Local\Temp\9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
"C:\Users\Admin\AppData\Local\Temp\9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\3582-490\9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Users\Admin\AppData\Local\Temp\look2.exe
    C:\Users\Admin\AppData\Local\Temp\\look2.exe
    3⤵
    - Server Software Component: Terminal Services DLL
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2516
- - C:\Users\Admin\AppData\Local\Temp\3582-490\HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2636

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:2832

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\259454732.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe

Filesize
1.6MB

MD5
368d54c69746fb31b62a15f5e301985f

SHA1
87148fe56d71df166239e5459f50721d15bc7028

SHA256
c9d5ed0975c7e70358172241767af75cf390a79139345641aeab244ca129f9b2

SHA512
d4f2db7921a97345bf19340357534155a7ea2ad48fd1c58d437cbbc4790f06f1e0878b3eb85244a849fa55472711da883efbf8e299971f78d050233c51526b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

Filesize
2.1MB

MD5
3e1b9039148d196063ab784e4548e798

SHA1
bb8c6ddf201aa6f3a23649fc7d206f6471f4f024

SHA256
c96306e907e6532cb82ae4d410a5ca72fd19955e28d4c209f7b2495da9925b88

SHA512
39c121a7bdb91074aac4af762cdb824d7bb78c71ac1bb4acf500293afb35e92dc49da65d91646ebbf03ae31d2428ac07409139e76bfef37c2451bc0c313af6c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.3MB

MD5
ebea7267d953cf95a2dc1c6b0a57738e

SHA1
6b03b9bf837a7fb61b4164b03c611335db5c56ab

SHA256
291d8260378ac894d10b140c053985907b53d0593b2cda19028cc3f0c132f514

SHA512
335edeff6cc79633382ba83105497ef6a4eba5b5696164bc0703df6546a7e5c1c994262063e0eaf28f909cb4dd7f242b6209862de4e05e6ff82853bb2149d899

Download Submit
C:\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
337KB

MD5
2f3b6f16e33e28ad75f3fdaef2567807

SHA1
85e907340faf1edfc9210db85a04abd43d21b741

SHA256
86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857

SHA512
db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\HD_9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a.exe

Filesize
896KB

MD5
8bacad1c57463f2e403ca5656ffa129e

SHA1
7cd8041fb1bd703d31f778700813531ed43882da

SHA256
bdec97ee615088549771300bd65d6114a74dd0a4c1ecc6bb4ffc8ac484f19fac

SHA512
40a5a0cabd2561b2d32ec14e91172db6f812d0e2dcc6cfda3a2f458e0994fc387324212bd47f21acb6d05bed151a96ad444a0a5a7f7bb35ae6fd0dcd57d25d64

Download Submit
\Windows\SysWOW64\259454732.bat

Filesize
51KB

MD5
b85231d34e465628a53749aa5302663d

SHA1
fd6da7f84db574c980b67b32945afe560b710e07

SHA256
8e79a4b1f18d278b25b04b4d708b33bae08dbf3da02a17dbd02ef5948e6c2e2a

SHA512
48898e4c2481def3cf05296f7066c5f7e4e33811a1c28744003f32f5c8ca8b96650bd7d983b171cb7b523c7197c355cf71dfc828a2cc76b41202947129d23fd0

Download Submit
\Windows\SysWOW64\svchcst.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/2936-126-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2936-128-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download