sectoprat | 0b3a5a436be69f5e20ac0fd84dab58e27abb3cc5ecb821a182da5a3c25418feb

Analysis

max time kernel
125s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2025 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KSCMWOLPRKU31OY0O7IA05ZD.exe
Size

4.0MB
MD5

0b32762b67c07329013d3b4f01b9f840
SHA1

6cc1205ae97744ae4ebfed85577404a03e4d64f0
SHA256

0b3a5a436be69f5e20ac0fd84dab58e27abb3cc5ecb821a182da5a3c25418feb
SHA512

836d54d2ff9bec071c49746e23e82ff9bafc24547ffaad6c37d18b8b9eeab47f25dd8bf88217e02cef38e298be197714177774a37689c72022f5b1795cd85ae9
SSDEEP

98304:vmH01flvieIOBNZSAHVnAELyOpGKOnxz9M5iCj:eUfhIOB/HVnfLyOOxB8vj

Score

10^/10

sectoprat discovery persistence rat spyware trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3908-61-0x00000000011A0000-0x0000000001264000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	4988	Process not Found

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	KSCMWOLPRKU31OY0O7IA05ZD.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	KSCMWOLPRKU31OY0O7IA05ZD.tmp

Executes dropped EXE 3 IoCs

pid	Process
4768	KSCMWOLPRKU31OY0O7IA05ZD.tmp
4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp
2908	Maui.com

Loads dropped DLL 2 IoCs

pid	Process
4768	KSCMWOLPRKU31OY0O7IA05ZD.tmp
4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rabbitweed = "\"C:\\777361c7-5708-4133-8daf-b77462ac39c9\\Autoit3.exe\" \"C:\\777361c7-5708-4133-8daf-b77462ac39c9\\rabbitweed.a3x\""	Maui.com

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
388	tasklist.exe
1844	tasklist.exe
1764	tasklist.exe
1404	tasklist.exe
32	tasklist.exe
1172	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 3908	2908	Maui.com	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maui.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSCMWOLPRKU31OY0O7IA05ZD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSCMWOLPRKU31OY0O7IA05ZD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSCMWOLPRKU31OY0O7IA05ZD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSCMWOLPRKU31OY0O7IA05ZD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1628	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp
4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp
2908	Maui.com
2908	Maui.com
2908	Maui.com
2908	Maui.com
3908	jsc.exe
3908	jsc.exe
3908	jsc.exe
3908	jsc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	tasklist.exe
Token: SeDebugPrivilege	32	tasklist.exe
Token: SeDebugPrivilege	1172	tasklist.exe
Token: SeDebugPrivilege	388	tasklist.exe
Token: SeDebugPrivilege	1844	tasklist.exe
Token: SeDebugPrivilege	1764	tasklist.exe
Token: SeDebugPrivilege	3908	jsc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3908	jsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4768	5004	KSCMWOLPRKU31OY0O7IA05ZD.exe	85
PID 5004 wrote to memory of 4768	5004	KSCMWOLPRKU31OY0O7IA05ZD.exe	85
PID 5004 wrote to memory of 4768	5004	KSCMWOLPRKU31OY0O7IA05ZD.exe	85
PID 4768 wrote to memory of 4012	4768	KSCMWOLPRKU31OY0O7IA05ZD.tmp	86
PID 4768 wrote to memory of 4012	4768	KSCMWOLPRKU31OY0O7IA05ZD.tmp	86
PID 4768 wrote to memory of 4012	4768	KSCMWOLPRKU31OY0O7IA05ZD.tmp	86
PID 4012 wrote to memory of 4204	4012	KSCMWOLPRKU31OY0O7IA05ZD.exe	87
PID 4012 wrote to memory of 4204	4012	KSCMWOLPRKU31OY0O7IA05ZD.exe	87
PID 4012 wrote to memory of 4204	4012	KSCMWOLPRKU31OY0O7IA05ZD.exe	87
PID 4204 wrote to memory of 4964	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	88
PID 4204 wrote to memory of 4964	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	88
PID 4204 wrote to memory of 4964	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	88
PID 4964 wrote to memory of 1404	4964	cmd.exe	90
PID 4964 wrote to memory of 1404	4964	cmd.exe	90
PID 4964 wrote to memory of 1404	4964	cmd.exe	90
PID 4964 wrote to memory of 3496	4964	cmd.exe	91
PID 4964 wrote to memory of 3496	4964	cmd.exe	91
PID 4964 wrote to memory of 3496	4964	cmd.exe	91
PID 4204 wrote to memory of 116	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	93
PID 4204 wrote to memory of 116	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	93
PID 4204 wrote to memory of 116	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	93
PID 116 wrote to memory of 32	116	cmd.exe	95
PID 116 wrote to memory of 32	116	cmd.exe	95
PID 116 wrote to memory of 32	116	cmd.exe	95
PID 116 wrote to memory of 3084	116	cmd.exe	96
PID 116 wrote to memory of 3084	116	cmd.exe	96
PID 116 wrote to memory of 3084	116	cmd.exe	96
PID 4204 wrote to memory of 3884	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	97
PID 4204 wrote to memory of 3884	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	97
PID 4204 wrote to memory of 3884	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	97
PID 3884 wrote to memory of 1172	3884	cmd.exe	99
PID 3884 wrote to memory of 1172	3884	cmd.exe	99
PID 3884 wrote to memory of 1172	3884	cmd.exe	99
PID 3884 wrote to memory of 3832	3884	cmd.exe	100
PID 3884 wrote to memory of 3832	3884	cmd.exe	100
PID 3884 wrote to memory of 3832	3884	cmd.exe	100
PID 4204 wrote to memory of 2900	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	101
PID 4204 wrote to memory of 2900	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	101
PID 4204 wrote to memory of 2900	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	101
PID 2900 wrote to memory of 388	2900	cmd.exe	103
PID 2900 wrote to memory of 388	2900	cmd.exe	103
PID 2900 wrote to memory of 388	2900	cmd.exe	103
PID 2900 wrote to memory of 4172	2900	cmd.exe	104
PID 2900 wrote to memory of 4172	2900	cmd.exe	104
PID 2900 wrote to memory of 4172	2900	cmd.exe	104
PID 4204 wrote to memory of 3936	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	105
PID 4204 wrote to memory of 3936	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	105
PID 4204 wrote to memory of 3936	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	105
PID 3936 wrote to memory of 1844	3936	cmd.exe	107
PID 3936 wrote to memory of 1844	3936	cmd.exe	107
PID 3936 wrote to memory of 1844	3936	cmd.exe	107
PID 3936 wrote to memory of 852	3936	cmd.exe	108
PID 3936 wrote to memory of 852	3936	cmd.exe	108
PID 3936 wrote to memory of 852	3936	cmd.exe	108
PID 4204 wrote to memory of 4452	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	109
PID 4204 wrote to memory of 4452	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	109
PID 4204 wrote to memory of 4452	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	109
PID 4452 wrote to memory of 1764	4452	cmd.exe	111
PID 4452 wrote to memory of 1764	4452	cmd.exe	111
PID 4452 wrote to memory of 1764	4452	cmd.exe	111
PID 4452 wrote to memory of 4048	4452	cmd.exe	112
PID 4452 wrote to memory of 4048	4452	cmd.exe	112
PID 4452 wrote to memory of 4048	4452	cmd.exe	112
PID 4204 wrote to memory of 2908	4204	KSCMWOLPRKU31OY0O7IA05ZD.tmp	113

C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe
"C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\is-IBH7A.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IBH7A.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp" /SL5="$50272,2664948,119296,C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe
    "C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\is-R4V0S.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-R4V0S.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp" /SL5="$A01DC,2664948,119296,C:\Users\Admin\AppData\Local\Temp\KSCMWOLPRKU31OY0O7IA05ZD.exe" /VERYSILENT
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4964
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
      - C:\Windows\SysWOW64\find.exe
        
        find /I "wrsa.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:116
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:32
      - C:\Windows\SysWOW64\find.exe
        
        find /I "opssvc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3884
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172
      - C:\Windows\SysWOW64\find.exe
        
        find /I "avastui.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2900
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:388
      - C:\Windows\SysWOW64\find.exe
        
        find /I "avgui.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3936
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1844
      - C:\Windows\SysWOW64\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:852
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
      - C:\Windows\SysWOW64\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
    - - C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\Maui.com
        
        "C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\Maui.com" rabbitweed.a3x
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2908
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3908

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTI5M0JFODctNDE4OC00MEE5LTkwMDgtNkNFODIzQ0VFRTRFfSIgdXNlcmlkPSJ7REZCMkYzMzUtMTEwNC00Qjc5LTgyMjQtNzU3RTQwQjMwRDlGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MUNEMUI1MzAtOTgyMy00QkM1LUJBQzYtNkNBNDE5ODY5RjVCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU1NzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODAxNjUyMzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDQ0NDAwMDAwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\Maui.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\rabbitweed.a3x

Filesize
805KB

MD5
ab6bea1bc5f739877f1991e78642b2ae

SHA1
a29b46ef3bd3a07338085570d0845bfb53304403

SHA256
9c86fad55d4ccc6bb2a10d6b835952c40080c2ce20bec49ac94ffc22305c05e3

SHA512
177135126ec9e7d3e6cdd227bf0f26a4c512a95908b80db3e1222c9893af0b1a5a342480ed8aa8f18c655ac83d9d73ddc3fb00f3ac886e9ef2297df6501bfd57

Download Submit
C:\ProgramData\{601B404E-CB65-4102-816E-E044F381B78D}\rabbitweed.vssm

Filesize
755KB

MD5
69971244ef6a1a10f85c5a334932cd67

SHA1
f43d2c261f9279f37f5e8d009b96d531d5bd3a43

SHA256
085ec8918f9d2daf85d53d18bfc56b315fb227ec4824bd3bee3aa0e3f6fa5e6a

SHA512
3bd046950ad77550528c2fdb4aa36f4eeddfef38bff5d7f14b6fcb7060532f5fcc6b9ef02fcf13b5a3f27278689f92773b95275e06307b84f446776ae9afca53

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9I8EQ.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GHS3M.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IBH7A.tmp\KSCMWOLPRKU31OY0O7IA05ZD.tmp

Filesize
1.1MB

MD5
b1f9d665e52c29972b50d7145d88dce1

SHA1
df2c67a5c32a19bb110ec8372134522c0dab9ac2

SHA256
2ffabb0018d335267d2d0101a41cac7ac7d1aa80956fae91825e46aaa85c0787

SHA512
bcdce189402ffc1c17b9803ac4040bd1cb23e32ba2c1476cbcfae13438078e01f78ad3f76e1bf71a6ec204663aa5f5780990016fc074218763d63db1431f1e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD68D.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
memory/3908-69-0x00000000065F0000-0x000000000660E000-memory.dmp

Filesize
120KB

Download
memory/3908-67-0x00000000058A0000-0x00000000058F0000-memory.dmp

Filesize
320KB

Download
memory/3908-70-0x00000000066D0000-0x0000000006736000-memory.dmp

Filesize
408KB

Download
memory/3908-65-0x0000000005C70000-0x0000000005E32000-memory.dmp

Filesize
1.8MB

Download
memory/3908-64-0x00000000033B0000-0x00000000033BA000-memory.dmp

Filesize
40KB

Download
memory/3908-66-0x0000000005990000-0x0000000005A06000-memory.dmp

Filesize
472KB

Download
memory/3908-68-0x0000000006B20000-0x000000000704C000-memory.dmp

Filesize
5.2MB

Download
memory/3908-63-0x0000000005F40000-0x00000000064E4000-memory.dmp

Filesize
5.6MB

Download
memory/3908-92-0x0000000005AC0000-0x0000000005AD2000-memory.dmp

Filesize
72KB

Download
memory/3908-89-0x0000000008700000-0x000000000870A000-memory.dmp

Filesize
40KB

Download
memory/3908-62-0x00000000058F0000-0x0000000005982000-memory.dmp

Filesize
584KB

Download
memory/3908-93-0x0000000005B60000-0x0000000005B9C000-memory.dmp

Filesize
240KB

Download
memory/3908-61-0x00000000011A0000-0x0000000001264000-memory.dmp

Filesize
784KB

Download
memory/4012-55-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4012-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4012-34-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4012-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4204-52-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4204-36-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4204-37-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4204-26-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4768-21-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4768-6-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/5004-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5004-23-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5004-3-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download