xworm | 227dbbb256d5236819196deda5707bc6abd1df5ba9a483edf82443ad12f26930

Analysis

max time kernel
5s
max time network
10s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
02/03/2025, 20:57

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

XClient.exe
Size

336KB
MD5

5fcc047b04b088650ffab33ab0d3a991
SHA1

310de3660d360e55e02aeabc2bb96fe1a00fbeb1
SHA256

227dbbb256d5236819196deda5707bc6abd1df5ba9a483edf82443ad12f26930
SHA512

5bc2803bb1fbcd18b33f7c23120fa144cb29c07376c40622f20d69386932bbf82e8160ec7ec11c781a0624a875ee198369c7b2cf8b2464986054d7c5d94c4cf4
SSDEEP

6144:gv9QxBt25x/5bTgVziHzZnSKrCbYM+2ba8Mq:NxBt8/5/gVziHlBrCbYP85

Score

10^/10

xworm defense_evasion execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral3/memory/3304-1-0x0000024300880000-0x00000243008DA000-memory.dmp	family_xworm
behavioral3/memory/3304-278-0x000002431B1A0000-0x000002431B1C8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1412	powershell.exe
3800	powershell.exe
2112	powershell.exe
3084	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3308	dthhm3wr.eck.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4088	SCHTASKS.exe
1848	schtasks.exe
4236	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe
3308	dthhm3wr.eck.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	XClient.exe
Token: SeDebugPrivilege	3308	dthhm3wr.eck.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 3308	3304	XClient.exe	82
PID 3304 wrote to memory of 3308	3304	XClient.exe	82
PID 3304 wrote to memory of 4236	3304	XClient.exe	83
PID 3304 wrote to memory of 4236	3304	XClient.exe	83
PID 3308 wrote to memory of 652	3308	dthhm3wr.eck.exe	5
PID 3308 wrote to memory of 700	3308	dthhm3wr.eck.exe	7
PID 3308 wrote to memory of 1004	3308	dthhm3wr.eck.exe	12
PID 3308 wrote to memory of 548	3308	dthhm3wr.eck.exe	13
PID 3308 wrote to memory of 1048	3308	dthhm3wr.eck.exe	14
PID 3308 wrote to memory of 1076	3308	dthhm3wr.eck.exe	16
PID 3308 wrote to memory of 1084	3308	dthhm3wr.eck.exe	17
PID 3308 wrote to memory of 1168	3308	dthhm3wr.eck.exe	18
PID 3308 wrote to memory of 1248	3308	dthhm3wr.eck.exe	19
PID 3308 wrote to memory of 1276	3308	dthhm3wr.eck.exe	20
PID 3308 wrote to memory of 1384	3308	dthhm3wr.eck.exe	21
PID 3308 wrote to memory of 1440	3308	dthhm3wr.eck.exe	22
PID 3308 wrote to memory of 1452	3308	dthhm3wr.eck.exe	23
PID 3308 wrote to memory of 1464	3308	dthhm3wr.eck.exe	24
PID 3308 wrote to memory of 1488	3308	dthhm3wr.eck.exe	25
PID 3308 wrote to memory of 1620	3308	dthhm3wr.eck.exe	26
PID 3308 wrote to memory of 1628	3308	dthhm3wr.eck.exe	27
PID 3308 wrote to memory of 1640	3308	dthhm3wr.eck.exe	28
PID 3308 wrote to memory of 1696	3308	dthhm3wr.eck.exe	29
PID 3308 wrote to memory of 1808	3308	dthhm3wr.eck.exe	30
PID 3308 wrote to memory of 1816	3308	dthhm3wr.eck.exe	31
PID 3308 wrote to memory of 1892	3308	dthhm3wr.eck.exe	32
PID 3308 wrote to memory of 1900	3308	dthhm3wr.eck.exe	33
PID 3308 wrote to memory of 2032	3308	dthhm3wr.eck.exe	34
PID 3308 wrote to memory of 2040	3308	dthhm3wr.eck.exe	35
PID 3308 wrote to memory of 2120	3308	dthhm3wr.eck.exe	36
PID 3308 wrote to memory of 2196	3308	dthhm3wr.eck.exe	38
PID 3308 wrote to memory of 2232	3308	dthhm3wr.eck.exe	39
PID 3308 wrote to memory of 2392	3308	dthhm3wr.eck.exe	40
PID 3308 wrote to memory of 2400	3308	dthhm3wr.eck.exe	41
PID 3308 wrote to memory of 2452	3308	dthhm3wr.eck.exe	42
PID 3308 wrote to memory of 2476	3308	dthhm3wr.eck.exe	43
PID 3308 wrote to memory of 2576	3308	dthhm3wr.eck.exe	44
PID 3308 wrote to memory of 2596	3308	dthhm3wr.eck.exe	45
PID 3308 wrote to memory of 2604	3308	dthhm3wr.eck.exe	46
PID 3308 wrote to memory of 2612	3308	dthhm3wr.eck.exe	47
PID 3308 wrote to memory of 2632	3308	dthhm3wr.eck.exe	48
PID 3308 wrote to memory of 3060	3308	dthhm3wr.eck.exe	49
PID 3308 wrote to memory of 2008	3308	dthhm3wr.eck.exe	50
PID 3308 wrote to memory of 1460	3308	dthhm3wr.eck.exe	51
PID 3308 wrote to memory of 3316	3308	dthhm3wr.eck.exe	52
PID 3308 wrote to memory of 3436	3308	dthhm3wr.eck.exe	53
PID 3308 wrote to memory of 3468	3308	dthhm3wr.eck.exe	54
PID 3308 wrote to memory of 3828	3308	dthhm3wr.eck.exe	57
PID 3308 wrote to memory of 3940	3308	dthhm3wr.eck.exe	58
PID 3308 wrote to memory of 3968	3308	dthhm3wr.eck.exe	59
PID 3308 wrote to memory of 4040	3308	dthhm3wr.eck.exe	60
PID 3308 wrote to memory of 4220	3308	dthhm3wr.eck.exe	61
PID 3308 wrote to memory of 4380	3308	dthhm3wr.eck.exe	62
PID 3308 wrote to memory of 4212	3308	dthhm3wr.eck.exe	65
PID 3308 wrote to memory of 4332	3308	dthhm3wr.eck.exe	66
PID 3308 wrote to memory of 1128	3308	dthhm3wr.eck.exe	67
PID 3308 wrote to memory of 5000	3308	dthhm3wr.eck.exe	69
PID 3308 wrote to memory of 332	3308	dthhm3wr.eck.exe	70
PID 3308 wrote to memory of 2056	3308	dthhm3wr.eck.exe	71
PID 3308 wrote to memory of 2840	3308	dthhm3wr.eck.exe	72
PID 3308 wrote to memory of 4284	3308	dthhm3wr.eck.exe	73
PID 3308 wrote to memory of 4120	3308	dthhm3wr.eck.exe	74
PID 3308 wrote to memory of 2172	3308	dthhm3wr.eck.exe	75
PID 3308 wrote to memory of 3304	3308	dthhm3wr.eck.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:652
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:548

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2040

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2196
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2576

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2008

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1460

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3316
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Users\Admin\AppData\Local\Temp\dthhm3wr.eck.exe
    "C:\Users\Admin\AppData\Local\Temp\dthhm3wr.eck.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3308
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonXClient.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\XClient.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonXClient.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\XClient.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4088
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2112
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3468

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3828

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3968

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4040

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5000

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:332

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4284

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2172

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER.83465a5b-3521-4533-a97e-9d2e4a6980c8.tmp.txt

Filesize
13KB

MD5
c6b26c42aa43067fcc443397f753ac60

SHA1
88b63e95ced812e640033edb26fc0a458b6d4807

SHA256
9fdfb0259c469223598240388a85eb07479f962979e30e1dd4191c8314d3c516

SHA512
2ba09a0d3027b311036872e5c3e3edd3744dfcdfe84da25943239b03d3aa79f38b2d62465dee6bad35131f26a5df30ae67deefc3641ce6cdd0fa73c0f479b8ca

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.bd5d1478-1e8c-4530-adf8-bfa0b4b58823.tmp.csv

Filesize
35KB

MD5
acc782d83a440729516225ae604b34ee

SHA1
d94d6734d32321ee5e49377b6db981575facc034

SHA256
4a107b37b43c3750cd5157a6741d8554251437caa334e94c545f3385a9449990

SHA512
ee2bc188e806f17ebcdcf6e5744ee8ac8959880b3e381502642ba78e7a01c5e9df66ef2e5f1a5eecbac8684e3ef43b2b060db66928db4934feff388c3908ec12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d0a4a3b9a52b8fe3b019f6cd0ef3dad6

SHA1
fed70ce7834c3b97edbd078eccda1e5effa527cd

SHA256
21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

SHA512
1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f8c40f7624e23fa92ae2f41e34cfca77

SHA1
20e742cfe2759ac2adbc16db736a9e143ca7b677

SHA256
c51a52818a084addbfa913d2bb4bb2b0e60c287a4cf98e679f18b8a521c0aa7b

SHA512
f1da3ec61403d788d417d097a7ed2947203c6bff3cf1d35d697c31edecdf04710b3e44b2aa263b886e297b2ce923fea410ccc673261928f1d0cd81252740dbe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8a7ab7bae6a69946da69507ee7ae7b0

SHA1
b367c72fa4948493819e1c32c32239aa6e78c252

SHA256
cd5480d72c1a359e83f7d6b6d7d21e1be2463f2c6718385cc6c393c88323b272

SHA512
89b22519bc3986be52801397e6eff4550621b4804abd2d04f431c9b2591ba8e3eab2625490a56ebb947ba3b122b6186badb6c461e917b69d7e13644c86a6f683

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjl2k4l5.abo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dthhm3wr.eck.exe

Filesize
161KB

MD5
94f1ab3a068f83b32639579ec9c5d025

SHA1
38f3d5bc5de46feb8de093d11329766b8e2054ae

SHA256
879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0

SHA512
44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c

Download Submit
memory/548-38-0x000002606F860000-0x000002606F88B000-memory.dmp

Filesize
172KB

Download
memory/548-25-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/548-24-0x000002606F860000-0x000002606F88B000-memory.dmp

Filesize
172KB

Download
memory/652-15-0x000001E937EE0000-0x000001E937F0B000-memory.dmp

Filesize
172KB

Download
memory/652-35-0x000001E937EE0000-0x000001E937F0B000-memory.dmp

Filesize
172KB

Download
memory/652-36-0x00007FFD9E7E4000-0x00007FFD9E7E5000-memory.dmp

Filesize
4KB

Download
memory/652-14-0x000001E937EB0000-0x000001E937ED5000-memory.dmp

Filesize
148KB

Download
memory/652-16-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/700-19-0x000002036DA40000-0x000002036DA6B000-memory.dmp

Filesize
172KB

Download
memory/700-37-0x000002036DA40000-0x000002036DA6B000-memory.dmp

Filesize
172KB

Download
memory/700-20-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/1004-28-0x000002A7CB9A0000-0x000002A7CB9CB000-memory.dmp

Filesize
172KB

Download
memory/1004-39-0x000002A7CB9A0000-0x000002A7CB9CB000-memory.dmp

Filesize
172KB

Download
memory/1004-29-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/1004-380-0x000002A7CB9A0000-0x000002A7CB9CB000-memory.dmp

Filesize
172KB

Download
memory/1048-33-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/1048-32-0x000001CD80300000-0x000001CD8032B000-memory.dmp

Filesize
172KB

Download
memory/1048-40-0x000001CD80300000-0x000001CD8032B000-memory.dmp

Filesize
172KB

Download
memory/1048-381-0x000001CD80300000-0x000001CD8032B000-memory.dmp

Filesize
172KB

Download
memory/1076-45-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/1076-53-0x000001C30C690000-0x000001C30C6BB000-memory.dmp

Filesize
172KB

Download
memory/1076-44-0x000001C30C690000-0x000001C30C6BB000-memory.dmp

Filesize
172KB

Download
memory/1084-48-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/1084-47-0x000001BB07090000-0x000001BB070BB000-memory.dmp

Filesize
172KB

Download
memory/1168-51-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/1168-50-0x000001FE47BD0000-0x000001FE47BFB000-memory.dmp

Filesize
172KB

Download
memory/1248-58-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/1248-57-0x000001ECB0310000-0x000001ECB033B000-memory.dmp

Filesize
172KB

Download
memory/1276-61-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/1276-60-0x00000280DD950000-0x00000280DD97B000-memory.dmp

Filesize
172KB

Download
memory/1452-70-0x00000283052B0000-0x00000283052DB000-memory.dmp

Filesize
172KB

Download
memory/1452-71-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/3084-293-0x000001B2C1480000-0x000001B2C14A2000-memory.dmp

Filesize
136KB

Download
memory/3304-278-0x000002431B1A0000-0x000002431B1C8000-memory.dmp

Filesize
160KB

Download
memory/3304-0-0x00007FFD7D8F3000-0x00007FFD7D8F5000-memory.dmp

Filesize
8KB

Download
memory/3304-399-0x000002431B110000-0x000002431B120000-memory.dmp

Filesize
64KB

Download
memory/3304-2-0x0000024300CE0000-0x0000024300D0C000-memory.dmp

Filesize
176KB

Download
memory/3304-1-0x0000024300880000-0x00000243008DA000-memory.dmp

Filesize
360KB

Download
memory/3308-12-0x00007FFD9DA20000-0x00007FFD9DADD000-memory.dmp

Filesize
756KB

Download
memory/3308-342-0x00007FFD9E740000-0x00007FFD9E949000-memory.dmp

Filesize
2.0MB

Download
memory/3308-11-0x00007FFD9E740000-0x00007FFD9E949000-memory.dmp

Filesize
2.0MB

Download
memory/3308-13-0x00007FFD9E741000-0x00007FFD9E86A000-memory.dmp

Filesize
1.2MB

Download
memory/3308-31-0x00007FFD9E740000-0x00007FFD9E949000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads