sectoprat | 0b3a5a436be69f5e20ac0fd84dab58e27abb3cc5ecb821a182da5a3c25418feb

Analysis

max time kernel
146s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20250207-en
resource tags

arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
submitted
09-02-2025 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KSCMWOLPRKU31OY0O7IA05ZD.exe
Size

4.0MB
MD5

0b32762b67c07329013d3b4f01b9f840
SHA1

6cc1205ae97744ae4ebfed85577404a03e4d64f0
SHA256

0b3a5a436be69f5e20ac0fd84dab58e27abb3cc5ecb821a182da5a3c25418feb
SHA512

836d54d2ff9bec071c49746e23e82ff9bafc24547ffaad6c37d18b8b9eeab47f25dd8bf88217e02cef38e298be197714177774a37689c72022f5b1795cd85ae9
SSDEEP

98304:vmH01flvieIOBNZSAHVnAELyOpGKOnxz9M5iCj:eUfhIOB/HVnfLyOOxB8vj

Score

10^/10

sectoprat discovery persistence rat spyware trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral3/memory/664-58-0x0000000001100000-0x00000000011C4000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	4476	Process not Found

Executes dropped EXE 3 IoCs

pid	Process
1808	KSCMWOLPRKU31OY0O7IA05ZD.tmp
3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp
3064	Maui.com

Loads dropped DLL 2 IoCs

pid	Process
1808	KSCMWOLPRKU31OY0O7IA05ZD.tmp
3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2744694949-1425932173-1917497025-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rabbitweed = "\"C:\\19632664-12b8-4d9d-8fdd-71183bddaef2\\Autoit3.exe\" \"C:\\19632664-12b8-4d9d-8fdd-71183bddaef2\\rabbitweed.a3x\""	Maui.com

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
2412	tasklist.exe
2296	tasklist.exe
2908	tasklist.exe
5112	tasklist.exe
2344	tasklist.exe
2400	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3064 set thread context of 664	3064	Maui.com	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSCMWOLPRKU31OY0O7IA05ZD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSCMWOLPRKU31OY0O7IA05ZD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maui.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSCMWOLPRKU31OY0O7IA05ZD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSCMWOLPRKU31OY0O7IA05ZD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4180	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp
3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp
3064	Maui.com
3064	Maui.com
3064	Maui.com
3064	Maui.com
664	jsc.exe
664	jsc.exe
664	jsc.exe
664	jsc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	tasklist.exe
Token: SeDebugPrivilege	2296	tasklist.exe
Token: SeDebugPrivilege	2908	tasklist.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	2344	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	664	jsc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
664	jsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1808	1096	KSCMWOLPRKU31OY0O7IA05ZD.exe	82
PID 1096 wrote to memory of 1808	1096	KSCMWOLPRKU31OY0O7IA05ZD.exe	82
PID 1096 wrote to memory of 1808	1096	KSCMWOLPRKU31OY0O7IA05ZD.exe	82
PID 1808 wrote to memory of 4540	1808	KSCMWOLPRKU31OY0O7IA05ZD.tmp	83
PID 1808 wrote to memory of 4540	1808	KSCMWOLPRKU31OY0O7IA05ZD.tmp	83
PID 1808 wrote to memory of 4540	1808	KSCMWOLPRKU31OY0O7IA05ZD.tmp	83
PID 4540 wrote to memory of 3420	4540	KSCMWOLPRKU31OY0O7IA05ZD.exe	84
PID 4540 wrote to memory of 3420	4540	KSCMWOLPRKU31OY0O7IA05ZD.exe	84
PID 4540 wrote to memory of 3420	4540	KSCMWOLPRKU31OY0O7IA05ZD.exe	84
PID 3420 wrote to memory of 440	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	85
PID 3420 wrote to memory of 440	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	85
PID 3420 wrote to memory of 440	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	85
PID 440 wrote to memory of 2412	440	cmd.exe	87
PID 440 wrote to memory of 2412	440	cmd.exe	87
PID 440 wrote to memory of 2412	440	cmd.exe	87
PID 440 wrote to memory of 2596	440	cmd.exe	88
PID 440 wrote to memory of 2596	440	cmd.exe	88
PID 440 wrote to memory of 2596	440	cmd.exe	88
PID 3420 wrote to memory of 2676	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	90
PID 3420 wrote to memory of 2676	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	90
PID 3420 wrote to memory of 2676	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	90
PID 2676 wrote to memory of 2296	2676	cmd.exe	92
PID 2676 wrote to memory of 2296	2676	cmd.exe	92
PID 2676 wrote to memory of 2296	2676	cmd.exe	92
PID 2676 wrote to memory of 1168	2676	cmd.exe	93
PID 2676 wrote to memory of 1168	2676	cmd.exe	93
PID 2676 wrote to memory of 1168	2676	cmd.exe	93
PID 3420 wrote to memory of 2760	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	94
PID 3420 wrote to memory of 2760	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	94
PID 3420 wrote to memory of 2760	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	94
PID 2760 wrote to memory of 2908	2760	cmd.exe	96
PID 2760 wrote to memory of 2908	2760	cmd.exe	96
PID 2760 wrote to memory of 2908	2760	cmd.exe	96
PID 2760 wrote to memory of 1776	2760	cmd.exe	97
PID 2760 wrote to memory of 1776	2760	cmd.exe	97
PID 2760 wrote to memory of 1776	2760	cmd.exe	97
PID 3420 wrote to memory of 1212	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	98
PID 3420 wrote to memory of 1212	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	98
PID 3420 wrote to memory of 1212	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	98
PID 1212 wrote to memory of 5112	1212	cmd.exe	100
PID 1212 wrote to memory of 5112	1212	cmd.exe	100
PID 1212 wrote to memory of 5112	1212	cmd.exe	100
PID 1212 wrote to memory of 1224	1212	cmd.exe	101
PID 1212 wrote to memory of 1224	1212	cmd.exe	101
PID 1212 wrote to memory of 1224	1212	cmd.exe	101
PID 3420 wrote to memory of 2940	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	102
PID 3420 wrote to memory of 2940	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	102
PID 3420 wrote to memory of 2940	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	102
PID 2940 wrote to memory of 2344	2940	cmd.exe	104
PID 2940 wrote to memory of 2344	2940	cmd.exe	104
PID 2940 wrote to memory of 2344	2940	cmd.exe	104
PID 2940 wrote to memory of 5036	2940	cmd.exe	105
PID 2940 wrote to memory of 5036	2940	cmd.exe	105
PID 2940 wrote to memory of 5036	2940	cmd.exe	105
PID 3420 wrote to memory of 3400	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	106
PID 3420 wrote to memory of 3400	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	106
PID 3420 wrote to memory of 3400	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	106
PID 3400 wrote to memory of 2400	3400	cmd.exe	108
PID 3400 wrote to memory of 2400	3400	cmd.exe	108
PID 3400 wrote to memory of 2400	3400	cmd.exe	108
PID 3400 wrote to memory of 4016	3400	cmd.exe	109
PID 3400 wrote to memory of 4016	3400	cmd.exe	109
PID 3400 wrote to memory of 4016	3400	cmd.exe	109
PID 3420 wrote to memory of 3064	3420	KSCMWOLPRKU31OY0O7IA05ZD.tmp	110

C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe
"C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\is-BVBDV.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BVBDV.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp" /SL5="$602CE,2664948,119296,C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe
    "C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\is-R6K47.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-R6K47.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp" /SL5="$702AA,2664948,119296,C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:440
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
      - C:\Windows\SysWOW64\find.exe
        
        find /I "wrsa.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2676
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
      - C:\Windows\SysWOW64\find.exe
        
        find /I "opssvc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1168
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2760
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
      - C:\Windows\SysWOW64\find.exe
        
        find /I "avastui.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1212
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5112
      - C:\Windows\SysWOW64\find.exe
        
        find /I "avgui.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2940
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
      - C:\Windows\SysWOW64\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3400
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
      - C:\Windows\SysWOW64\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
    - - C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\Maui.com
        
        "C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\Maui.com" rabbitweed.a3x
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3064
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:664

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODAwODUwODgtQTc3Qi00NUYxLThFQkQtNjRDOTdGNTczOTUwfSIgdXNlcmlkPSJ7OTIwNkRCNkItM0QyNy00RUEyLTk3RkUtQzM0OUI2QzRCMjNDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDc2ODcxNjAtNEEzQS00N0MyLTgzMDItRTAxMzk3NzRBRjEzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczODk1MTk2MCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI0NTQ1NjU5MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzMjAwOTMyNDMiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\Maui.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\rabbitweed.a3x

Filesize
805KB

MD5
ab6bea1bc5f739877f1991e78642b2ae

SHA1
a29b46ef3bd3a07338085570d0845bfb53304403

SHA256
9c86fad55d4ccc6bb2a10d6b835952c40080c2ce20bec49ac94ffc22305c05e3

SHA512
177135126ec9e7d3e6cdd227bf0f26a4c512a95908b80db3e1222c9893af0b1a5a342480ed8aa8f18c655ac83d9d73ddc3fb00f3ac886e9ef2297df6501bfd57

Download Submit
C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\rabbitweed.vssm

Filesize
755KB

MD5
69971244ef6a1a10f85c5a334932cd67

SHA1
f43d2c261f9279f37f5e8d009b96d531d5bd3a43

SHA256
085ec8918f9d2daf85d53d18bfc56b315fb227ec4824bd3bee3aa0e3f6fa5e6a

SHA512
3bd046950ad77550528c2fdb4aa36f4eeddfef38bff5d7f14b6fcb7060532f5fcc6b9ef02fcf13b5a3f27278689f92773b95275e06307b84f446776ae9afca53

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AF95F.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BVBDV.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp

Filesize
1.1MB

MD5
b1f9d665e52c29972b50d7145d88dce1

SHA1
df2c67a5c32a19bb110ec8372134522c0dab9ac2

SHA256
2ffabb0018d335267d2d0101a41cac7ac7d1aa80956fae91825e46aaa85c0787

SHA512
bcdce189402ffc1c17b9803ac4040bd1cb23e32ba2c1476cbcfae13438078e01f78ad3f76e1bf71a6ec204663aa5f5780990016fc074218763d63db1431f1e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UUCT0.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3B80.tmp

Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
memory/664-62-0x0000000005C60000-0x0000000005E22000-memory.dmp

Filesize
1.8MB

Download
memory/664-63-0x0000000005960000-0x00000000059D6000-memory.dmp

Filesize
472KB

Download
memory/664-89-0x0000000005AB0000-0x0000000005AC2000-memory.dmp

Filesize
72KB

Download
memory/664-90-0x0000000005B10000-0x0000000005B4C000-memory.dmp

Filesize
240KB

Download
memory/664-85-0x00000000085D0000-0x00000000085DA000-memory.dmp

Filesize
40KB

Download
memory/664-67-0x00000000066C0000-0x0000000006726000-memory.dmp

Filesize
408KB

Download
memory/664-66-0x00000000065F0000-0x000000000660E000-memory.dmp

Filesize
120KB

Download
memory/664-65-0x0000000006AF0000-0x000000000701C000-memory.dmp

Filesize
5.2MB

Download
memory/664-64-0x00000000059E0000-0x0000000005A30000-memory.dmp

Filesize
320KB

Download
memory/664-60-0x0000000005F10000-0x00000000064B6000-memory.dmp

Filesize
5.6MB

Download
memory/664-58-0x0000000001100000-0x00000000011C4000-memory.dmp

Filesize
784KB

Download
memory/664-59-0x00000000058C0000-0x0000000005952000-memory.dmp

Filesize
584KB

Download
memory/664-61-0x0000000003220000-0x000000000322A000-memory.dmp

Filesize
40KB

Download
memory/1096-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1096-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1096-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/1808-6-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1808-22-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3420-49-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3420-34-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4540-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4540-51-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4540-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4540-35-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download