njrat | 3990ab6d73f0a92606cb4c86d39e077f014da65413a264be94d03ca8478e64b8

Analysis

max time kernel
179s
max time network
192s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
22/03/2025, 09:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

pisun.exe
Size

54KB
MD5

45140e967970cd63521eaa76dc4db7d7
SHA1

aae8aa4c5fb8e1d5a830f1f095d7550a89b7634a
SHA256

3990ab6d73f0a92606cb4c86d39e077f014da65413a264be94d03ca8478e64b8
SHA512

d8c5274fc1c66700c3fb63527973cb20106070698eebdf90e6b3f9ace371e34a653e382f949683d9aab0cb33fdd00ab2b943e499a4d2d6f42a24822fa2142129
SSDEEP

768:U8I0g652Esltuq55JR2ET3NwJSNbxWQG35bmaePD5PvXOC2XXJdxIEpmvg:U8ZVGtZ5DTCGlWQcGD0LX3xIEpmvg

Score

10^/10

njrat bootkit defense_evasion discovery persistence trojan upx

Malware Config

Signatures

Njrat family
njrat

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	311a64c6e4374fc4bdf87748bec6524d.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	311a64c6e4374fc4bdf87748bec6524d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\311a64c6e4374fc4bdf87748bec6524d.exe"	311a64c6e4374fc4bdf87748bec6524d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	311a64c6e4374fc4bdf87748bec6524d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\311a64c6e4374fc4bdf87748bec6524d.exe"	311a64c6e4374fc4bdf87748bec6524d.exe

Executes dropped EXE 11 IoCs

pid	Process
5680	a34b3bf600ba42c48b93755d1520d114.exe
4836	0e4593201ff1496c9c2690eb96b149ea.exe
4388	6e4cc25bbf1e4b5ba7ff5fa5747064e1.exe
5644	cb74eaf3608c487db60a0841faf30d3b.exe
4392	huii.exe
440	hui.exe
4600	6abb5cb471664612a9b64bd6f1fd0465.exe
240	d14df2d33aae449086f2a088ed4c67a9.exe
2808	9308118ad08d453fa45aa3a69e4047b1.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
1748	311a64c6e4374fc4bdf87748bec6524d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Java = "C:\\Users\\Admin\\AppData\\Local\\Temp\\311a64c6e4374fc4bdf87748bec6524d.exe"	311a64c6e4374fc4bdf87748bec6524d.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	311a64c6e4374fc4bdf87748bec6524d.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	pisun.exe
File opened for modification	\??\PhysicalDrive0	311a64c6e4374fc4bdf87748bec6524d.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002b42a-142.dat	upx
behavioral1/memory/5360-146-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1748-149-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1748-151-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/5360-171-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/5360-174-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/5360-177-0x0000000000400000-0x00000000006D8000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pisun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb74eaf3608c487db60a0841faf30d3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6abb5cb471664612a9b64bd6f1fd0465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9308118ad08d453fa45aa3a69e4047b1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	311a64c6e4374fc4bdf87748bec6524d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	311a64c6e4374fc4bdf87748bec6524d.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	pisun.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3144	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5940	pisun.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	3764	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3764	AUDIODG.EXE
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: SeBackupPrivilege	5360	311a64c6e4374fc4bdf87748bec6524d.exe
Token: SeRestorePrivilege	5360	311a64c6e4374fc4bdf87748bec6524d.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe
Token: 33	5940	pisun.exe
Token: SeIncBasePriorityPrivilege	5940	pisun.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5940	pisun.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4600	6abb5cb471664612a9b64bd6f1fd0465.exe
5360	311a64c6e4374fc4bdf87748bec6524d.exe
1748	311a64c6e4374fc4bdf87748bec6524d.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 5680	5940	pisun.exe	79
PID 5940 wrote to memory of 5680	5940	pisun.exe	79
PID 5940 wrote to memory of 4836	5940	pisun.exe	80
PID 5940 wrote to memory of 4836	5940	pisun.exe	80
PID 5940 wrote to memory of 4388	5940	pisun.exe	81
PID 5940 wrote to memory of 4388	5940	pisun.exe	81
PID 5940 wrote to memory of 5644	5940	pisun.exe	83
PID 5940 wrote to memory of 5644	5940	pisun.exe	83
PID 5940 wrote to memory of 5644	5940	pisun.exe	83
PID 5644 wrote to memory of 4392	5644	cb74eaf3608c487db60a0841faf30d3b.exe	84
PID 5644 wrote to memory of 4392	5644	cb74eaf3608c487db60a0841faf30d3b.exe	84
PID 5644 wrote to memory of 4392	5644	cb74eaf3608c487db60a0841faf30d3b.exe	84
PID 4392 wrote to memory of 440	4392	huii.exe	85
PID 4392 wrote to memory of 440	4392	huii.exe	85
PID 4392 wrote to memory of 440	4392	huii.exe	85
PID 5940 wrote to memory of 4600	5940	pisun.exe	89
PID 5940 wrote to memory of 4600	5940	pisun.exe	89
PID 5940 wrote to memory of 4600	5940	pisun.exe	89
PID 5940 wrote to memory of 240	5940	pisun.exe	90
PID 5940 wrote to memory of 240	5940	pisun.exe	90
PID 5940 wrote to memory of 240	5940	pisun.exe	90
PID 5940 wrote to memory of 2808	5940	pisun.exe	91
PID 5940 wrote to memory of 2808	5940	pisun.exe	91
PID 5940 wrote to memory of 2808	5940	pisun.exe	91
PID 5940 wrote to memory of 3144	5940	pisun.exe	93
PID 5940 wrote to memory of 3144	5940	pisun.exe	93
PID 5940 wrote to memory of 3144	5940	pisun.exe	93
PID 5940 wrote to memory of 5360	5940	pisun.exe	94
PID 5940 wrote to memory of 5360	5940	pisun.exe	94
PID 5940 wrote to memory of 5360	5940	pisun.exe	94
PID 5360 wrote to memory of 5868	5360	311a64c6e4374fc4bdf87748bec6524d.exe	97
PID 5360 wrote to memory of 5868	5360	311a64c6e4374fc4bdf87748bec6524d.exe	97
PID 5360 wrote to memory of 5868	5360	311a64c6e4374fc4bdf87748bec6524d.exe	97

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	311a64c6e4374fc4bdf87748bec6524d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	311a64c6e4374fc4bdf87748bec6524d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	311a64c6e4374fc4bdf87748bec6524d.exe

C:\Users\Admin\AppData\Local\Temp\pisun.exe
"C:\Users\Admin\AppData\Local\Temp\pisun.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Users\Admin\AppData\Local\Temp\a34b3bf600ba42c48b93755d1520d114.exe
  "C:\Users\Admin\AppData\Local\Temp\a34b3bf600ba42c48b93755d1520d114.exe"
  2⤵
  - Executes dropped EXE
  PID:5680
- C:\Users\Admin\AppData\Local\Temp\0e4593201ff1496c9c2690eb96b149ea.exe
  "C:\Users\Admin\AppData\Local\Temp\0e4593201ff1496c9c2690eb96b149ea.exe"
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\6e4cc25bbf1e4b5ba7ff5fa5747064e1.exe
  "C:\Users\Admin\AppData\Local\Temp\6e4cc25bbf1e4b5ba7ff5fa5747064e1.exe"
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Users\Admin\AppData\Local\Temp\cb74eaf3608c487db60a0841faf30d3b.exe
  "C:\Users\Admin\AppData\Local\Temp\cb74eaf3608c487db60a0841faf30d3b.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Users\Admin\AppData\Local\Temp\huii.exe
    "C:\Users\Admin\AppData\Local\Temp\huii.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\hui.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\hui.exe" xui2
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:440
- C:\Users\Admin\AppData\Local\Temp\6abb5cb471664612a9b64bd6f1fd0465.exe
  "C:\Users\Admin\AppData\Local\Temp\6abb5cb471664612a9b64bd6f1fd0465.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4600
- C:\Users\Admin\AppData\Local\Temp\d14df2d33aae449086f2a088ed4c67a9.exe
  "C:\Users\Admin\AppData\Local\Temp\d14df2d33aae449086f2a088ed4c67a9.exe"
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Users\Admin\AppData\Local\Temp\9308118ad08d453fa45aa3a69e4047b1.exe
  "C:\Users\Admin\AppData\Local\Temp\9308118ad08d453fa45aa3a69e4047b1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2808
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\46f43196e52442b49872b60eb18bddc6.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3144
- C:\Users\Admin\AppData\Local\Temp\311a64c6e4374fc4bdf87748bec6524d.exe
  "C:\Users\Admin\AppData\Local\Temp\311a64c6e4374fc4bdf87748bec6524d.exe"
  2⤵
  - UAC bypass
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5360
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c TASKKILL /F /FI "Imagename ne 311a64c6e4374fc4bdf87748bec6524d.exe" /FI "USERNAME eq %USERNAME%
    3⤵
    PID:5868

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Users\Admin\AppData\Local\Temp\311a64c6e4374fc4bdf87748bec6524d.exe
C:\Users\Admin\AppData\Local\Temp\311a64c6e4374fc4bdf87748bec6524d.exe explorer.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\311a64c6e4374fc4bdf87748bec6524d.exe

Filesize
1.7MB

MD5
6e628c5531010f1053fff090a7699659

SHA1
237e5b8870092dd0e9a3b0fb76da93fcfce56516

SHA256
52d65a486dd027d9d6e3ca10ea808815ff0fda4e5032695333b7c2d5a5f95e41

SHA512
53eb023d70038b2820a6c0ed0a453307f90b22279e521fa8af3b6ef240ce022300a1d05794bf02d52f472c5adeb87c814373c5e29b3f13102c0128af06d5f0e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\46f43196e52442b49872b60eb18bddc6.txt

Filesize
169B

MD5
2686c326a963fe516ed579c6024ee17b

SHA1
5522bcac346204ac26d0ef6ba643aad21af5abf9

SHA256
969498f939a373380c0d59996434685f0b61294d1f6245c7d74be6cb4d864f53

SHA512
ec3b807650d63bcaa89ed2d6a6cc411d1bdbac88e5cae478fddb58a190b1352540fd47316eb677f13218f780253048875fb45c6a2902f70f7cb2690c615e6c76

Download Submit
C:\Users\Admin\AppData\Local\Temp\6abb5cb471664612a9b64bd6f1fd0465.exe

Filesize
20KB

MD5
19796e0d82a76be6dafa5cb7b80e2506

SHA1
ce7d0842683febfbc4e52278a25f75e29ccf6155

SHA256
65d4c633bf347ed4766dbb6e003776a017ccb632d73c6138c3e880a94c114c2d

SHA512
049111891524683fd63036355f02006ca1fd69478aa9597050f1bbeda256b25ce9f28684df80d169d50dcc01a8cbdb17e78b82ea4d49d71b9ee72588bd1e6fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\9308118ad08d453fa45aa3a69e4047b1.exe

Filesize
135KB

MD5
c971c68b4e58ccc82802b21ae8488bc7

SHA1
7305f3a0a0a0d489e0bcf664353289f61556de77

SHA256
cede0b15d88c20bc750b516858f8bf31ee472f6cbd01640840890736c4333cce

SHA512
ff199691c35f2748772410bf454e8b76dd67d892dd76fc87d20b3bbe6c145c6af1685344de636326692df792f55d0fba9a0025a7cf491d0b4e73ff45c3b039d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\hui.exe

Filesize
5KB

MD5
17b935ed6066732a76bed69867702e4b

SHA1
23f28e3374f9d0e03d45843b28468aace138e71c

SHA256
e60353b37f785c77e1063ac44cba792e9ec69f27b1dc9f3b719280d5ce015cc0

SHA512
774ea047cdc5f008df03ad67242df04d630bb962bc99f1ea8974a21baf6a902c7a5d8b8d09d9e5c7d7e46b0378c7baf33bf80fb3e34777cd0958b8fc740d0318

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xui2.cur

Filesize
4KB

MD5
c1fd2feb9e2b56be00082dd06c2b9658

SHA1
6e9272d5d53272f901ebb75ea556e250d4fc54aa

SHA256
de7c8bd93cc576d719805835099ae0f2cb88d797fe71585e2f7eb56b67a8fb72

SHA512
7530ad40f0adc93d5166b2b4741ba66bc5792ca1882be658b86b290feaa3ccf08f15ef0d55cc40494c6f3fedb78ecc5dab2a5342e0bdc85a068a3a0ffdc6e79a

Download Submit
C:\Users\Admin\AppData\Local\Temp\a34b3bf600ba42c48b93755d1520d114.exe

Filesize
844KB

MD5
8cac1595b184f66d7a122af38d5dfe71

SHA1
e0bc0162472edf77a05134e77b540663ac050ab6

SHA256
00201a2fd4916193c9c7bbba7be6a77fa5876085480b67da4e1228fd8b23ae5f

SHA512
88d3753ce73bbf95ee1fdbdff21eb9331e59ca92cfa5c489f141c07dc90871e3032e331c9dd77b1fec4522add3ac25c51d5c699d7801a5343dd2ae447c60f8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb74eaf3608c487db60a0841faf30d3b.exe

Filesize
323KB

MD5
c76b0867436829232609a7f6c786c37c

SHA1
06d88a277a77db9494feca72c31a35af3f83a4f8

SHA256
3c399e4c4826de5f378e1da9a9e54c29bf8d557aae01f53d307c4bf565d03194

SHA512
9047a8ac3a2795c73e5650ce37d0595798532579ca4013f2498e9641796d9814aba1d138812ee28135edd4b48843f58063c278511c4279ee3afbd422a683359d

Download Submit
C:\Users\Admin\AppData\Local\Temp\d14df2d33aae449086f2a088ed4c67a9.exe

Filesize
2.3MB

MD5
782f6274654b584ff6d51ca55032f818

SHA1
d6d8d66c9d204ea5455e366b4047e713e471dceb

SHA256
7b44b3e5c2decf0b20a4dcc3b1437bff44c0d0fb78224dc690c190f844927664

SHA512
ed47e666a42b28250061f4d63d90fb03705f09889539fbaf936ca35afa7d0b35bad3c7edc2091d74ca1d99ef380dc478e352e0ad4e2aa81ae0552a6b85f9b2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\huii.exe

Filesize
313KB

MD5
c125391f5a989f964548e45decc7490e

SHA1
08906a336b65dbb61cfc0b95f11315f18a5301f8

SHA256
acc6fecd839b1de178b5d17525b3764fb7511e589ae04f6217666e869cacce91

SHA512
9a6b36c78b9016f662124f4761d4ad42965748259fba7f8fc59730d0fbd63b151ff34b650019645fe845659ea024e9a9f173c55427aced781b5e5a6938b8dd3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_AEFD5F33138B42C68DD2EE240F6B3263.dat

Filesize
940B

MD5
c700c0957bef79b17aebc82446080daa

SHA1
6b7934d38333fd90a433234858da5808cd007446

SHA256
ce38c6dfe8b8952d16789059c1e61a7da6e5b4b48a481b4b270bb154983d0c67

SHA512
e0ebd2b654eea9b506a5b24e3bcffaad942e756ec54070c35a53bfd6118b6922be1c196e62d5cb7787d9770754cc9a49b88abdd939bf16c65bfae9ed0fc4d7f7

Download Submit
memory/240-120-0x0000000000400000-0x0000000000582000-memory.dmp

Filesize
1.5MB

Download
memory/440-97-0x0000000000940000-0x0000000000948000-memory.dmp

Filesize
32KB

Download
memory/1748-149-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download
memory/1748-151-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download
memory/4836-64-0x00007FFA06BD0000-0x00007FFA07571000-memory.dmp

Filesize
9.6MB

Download
memory/4836-37-0x00007FFA06BD0000-0x00007FFA07571000-memory.dmp

Filesize
9.6MB

Download
memory/4836-38-0x00007FFA06BD0000-0x00007FFA07571000-memory.dmp

Filesize
9.6MB

Download
memory/5360-146-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download
memory/5360-171-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download
memory/5360-174-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download
memory/5360-177-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download
memory/5644-81-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5680-20-0x00007FFA06BD0000-0x00007FFA07571000-memory.dmp

Filesize
9.6MB

Download
memory/5680-21-0x000000001BFD0000-0x000000001C49E000-memory.dmp

Filesize
4.8MB

Download
memory/5680-60-0x00007FFA06BD0000-0x00007FFA07571000-memory.dmp

Filesize
9.6MB

Download
memory/5680-59-0x00007FFA06E85000-0x00007FFA06E86000-memory.dmp

Filesize
4KB

Download
memory/5680-48-0x00007FFA06BD0000-0x00007FFA07571000-memory.dmp

Filesize
9.6MB

Download
memory/5680-40-0x00007FFA06BD0000-0x00007FFA07571000-memory.dmp

Filesize
9.6MB

Download
memory/5680-25-0x000000001C770000-0x000000001C7BC000-memory.dmp

Filesize
304KB

Download
memory/5680-24-0x00000000014C0000-0x00000000014C8000-memory.dmp

Filesize
32KB

Download
memory/5680-23-0x00007FFA06BD0000-0x00007FFA07571000-memory.dmp

Filesize
9.6MB

Download
memory/5680-22-0x000000001C540000-0x000000001C5DC000-memory.dmp

Filesize
624KB

Download
memory/5680-18-0x00007FFA06E85000-0x00007FFA06E86000-memory.dmp

Filesize
4KB

Download
memory/5680-62-0x00007FFA06BD0000-0x00007FFA07571000-memory.dmp

Filesize
9.6MB

Download
memory/5680-19-0x000000001BA50000-0x000000001BAF6000-memory.dmp

Filesize
664KB

Download
memory/5940-0-0x0000000074E91000-0x0000000074E92000-memory.dmp

Filesize
4KB

Download
memory/5940-6-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/5940-5-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/5940-4-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/5940-3-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/5940-2-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/5940-1-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/5940-180-0x0000000073A40000-0x0000000073A9B000-memory.dmp

Filesize
364KB

Download
memory/5940-181-0x0000000073040000-0x000000007305E000-memory.dmp

Filesize
120KB

Download
memory/5940-179-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/5940-178-0x0000000075480000-0x000000007550D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads