Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-01-2025 19:22
General
-
Target
2025-01-16_242fe026b7757526eaf7d5710c05b4a6_darkgate_magniber_pos.exe
-
Size
26.7MB
-
MD5
242fe026b7757526eaf7d5710c05b4a6
-
SHA1
bd0a5c55bc824bd5b73e505e379e9b688b5c1c33
-
SHA256
1a90320e4bd2b6bfdd9dbc71377a4fec0012333216fd6503a476e8a171728b2e
-
SHA512
814a18007cf1908d6614071d05a1126488f878202dfa3f967dcaf8676855fa982f03d573730c6b548b131eeaba7268ec2b67a5c5d7d3be6b42b07bf01c72d6c3
-
SSDEEP
786432:hu2+/t6D6dbsDTOXFTXRkdObGXYztTHMa0S:N0ZBkd4zZMzS
Score
10/10
Malware Config
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 8 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Stops running service(s) 4 TTPs
-
Executes dropped EXE 35 IoCs
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-16_242fe026b7757526eaf7d5710c05b4a6_darkgate_magniber_pos.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-16_242fe026b7757526eaf7d5710c05b4a6_darkgate_magniber_pos.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_2025-01-16_242fe026b7757526eaf7d5710c05b4a6_darkgate_magniber_pos.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2025-01-16_242fe026b7757526eaf7d5710c05b4a6_darkgate_magniber_pos.exe"2⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y3⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" path Win32_NetworkAdapter get ServiceName /value /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2432) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe stop KMSEmulator3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc.exe stop KMSEmulator4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 4924⤵
- Loads dropped DLL
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"C:\Users\Admin\AppData\Local\Temp\OUninstall"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1904) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe delete KMSEmulator3⤵
-
C:\Windows\system32\sc.exesc.exe delete KMSEmulator4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"C:\Users\Admin\AppData\Local\Temp\OUninstall"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=3052) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2716) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 4924⤵
- Loads dropped DLL
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1972) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"C:\Users\Admin\AppData\Local\Temp\OUninstall"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1716) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1584) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"C:\Users\Admin\AppData\Local\Temp\OUninstall"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2248) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 4964⤵
- Loads dropped DLL
- Program crash
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP3⤵
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP3⤵
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP3⤵
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=16883⤵
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=16884⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP3⤵
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=16883⤵
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=16884⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto3⤵
-
C:\Windows\system32\sc.exesc.exe create KMSEmulator binpath= temp.exe type= own start= auto4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator3⤵
-
C:\Windows\system32\sc.exesc.exe start KMSEmulator4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"C:\Users\Admin\AppData\Local\Temp\OUninstall"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1544) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1576) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 4924⤵
- Loads dropped DLL
- Program crash
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP3⤵
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=16883⤵
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=16884⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto3⤵
-
C:\Windows\system32\sc.exesc.exe create KMSEmulator binpath= temp.exe type= own start= auto4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator3⤵
-
C:\Windows\system32\sc.exesc.exe start KMSEmulator4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1044) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2952) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1768) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=828) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1468) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2248) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1696) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=3060) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=920) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1592) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1716) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=372) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=3008) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=468) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2708) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2764) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=1744) get ParentProcessID /FORMAT:List /FORMAT:List4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" process where (ProcessId=2772) get ExecutablePath /FORMAT:List /FORMAT:List4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q3⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y4⤵
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\KMS\bin\KMSSS.exe"C:\Windows\KMS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26.7MB
MD5242fe026b7757526eaf7d5710c05b4a6
SHA1bd0a5c55bc824bd5b73e505e379e9b688b5c1c33
SHA2561a90320e4bd2b6bfdd9dbc71377a4fec0012333216fd6503a476e8a171728b2e
SHA512814a18007cf1908d6614071d05a1126488f878202dfa3f967dcaf8676855fa982f03d573730c6b548b131eeaba7268ec2b67a5c5d7d3be6b42b07bf01c72d6c3
-
Filesize
24KB
MD56a3a8a64450679c4f7075da96ad1d4b1
SHA190cabdd347f4c3e22e32b04851333123a9093b6e
SHA256af5755447aa4f26ca3ab026f3c65b43022d67db0207bff2199141dd8a62f4600
SHA512c49119fdcd5173da32d097a3edf3589e0f81be069f90b01e44fe6d40568dc8862f0e59646f89b4940cd142f90b2dc30c06343025576820d68f1bbdaff6987c32
-
Filesize
26KB
MD5744eaea15e1349cba0be72bd458ebf56
SHA1d62fdc18cf2eff80446d6a5aa099d455ee9db96b
SHA256503d9a48871d47b124faf361777f2ffcece1b7bb7cbad165655dd09e78eed227
SHA51248de71c2aa498eda4a64faa369afe13514b329804f2961a80250f604ab9bb51a70267c22b08626b481d35df805b73a11bdef6c36193734389c34ad70c095409b
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
27KB
MD58df2e30ffa034800ca6b08911ed45196
SHA19039114852c8e16a537819690f1ad9a8d6ee1f13
SHA25678a706d433808ced5723934a7b7ff17db651aa7b2aa62b5281e3cda8d66adafc
SHA51249426d7d642700ba0882a595eed8e36386e57039ebd462d26ad7badaa46ab975c27acb3ffa722ebaf41a74be5c5db13ab307a513ecbd97ff7d2f268d8ba1475e
-
Filesize
26KB
MD5ff0cc0539e1d5701f25a4a18dc239855
SHA18374496d590e5c2096cc2f004013a18707bc1fe3
SHA25668b828fe5c83cb57b6c6af5e0f2dcb2e91a52268253663e3239ce27412c1f06f
SHA5125f3b971a223271d4e0ed3dfd9b82a79d0ae6d45d1937ca88da962add007744e67b14bebaea53c9190fbfdda9eac6e30a6233fccf40b75c75e1f0abb1d783abc3
-
Filesize
2.9MB
MD509ae69b459fbbbd85be5b40e4799c5a4
SHA16d0ebb4082a003de0b49955ba05993d8f0794882
SHA2566cd04a28b98ef7a55756759114f712f099f706c4f1d23aa55903220ae9217243
SHA512e6078147593f0d25efc02fc1a8b5c5a2d6b604fd9a381db954e8dd2a1ac0ae3cafa188705f6027be4bc31a905d891be226c95052a96a06a9b715895b73301721
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
Filesize
773B
MD5e1daaa79aa5d79711922eb05d27e43d1
SHA1b45d3d2313a4cf61d96982a1f366061b29bc5678
SHA2569dd26fd685bff1e0950aa70c2bb970a71cf7bd8a3c1b5e90eb9ab26af51c5e14
SHA512fd6fcfe29f82a9f7318093c348d9742ff8ea305e26937c0a522de25ac9f08539dc910cd5eed2f8d110a33b8b21dd7032ef8725afd5e6509f95b7541ad84b1d5a
-
Filesize
26.0MB
MD5d02f15eb9d0c8cdb597d5b892a8aba86
SHA1b8344bb2157669389119be005b74c45d5adcbe7e
SHA2564140061e52a95ecd9e6c9f55e8a18f7fb1f0605fb26e1d8236eaf0dfda04e866
SHA51247cdd36ef62be7a48d8d80a08fa9cdc3ce2a7176c26818baf1626270633c072a790b41508d179c15f488d831ab439ab0baf47211d1d8a3e16b312a2143fd6328
-
Filesize
453KB
MD5019d71bd3e4ebf5e1b9171ef6859f071
SHA121d297f667f5698af15eee601a9a2a7245fd442f
SHA2569c6ad0c7cd85ff0d73c3ece7917b698758b48801323f6800022bd01fb42fde4a
SHA512a462744df26b2ae601a9bcd5d0522587c667707bb01dcd39f2388f4a7120149c2c4c1440d8ce587fbb82d5cdd45c9d8138600203d20759cabe1aa48da9353a09
-
Filesize
13.4MB
MD5f5f3bc6191392a2ace905124537763a5
SHA10bd88a29c7c436e62d20fd70c42fda2320a20ec8
SHA256d935d643158439897fb19eafef0c79164b63301ffb94f2eb958c0a10c996c4dc
SHA5121a46fe2fc6c62eb0f9b6382e5a8960206a1df5a0241174033a2529d6f450d6cd3ac6c180698bf3fc68be346ebeeef5c6bdae0f2457e505694e332ed0afb12b86
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
26.7MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
26.7MB
-
Filesize
26.7MB
-
Filesize
26.7MB
-
Filesize
26.7MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB