cryptbot | 636e55648c9d3fc08bc814e01765f34e71db576aef5397e16e6498d3a7ee7f7e

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe
Size

3.9MB
MD5

5adcf9918838e95aa439ddcc4217c8e1
SHA1

8ae5c3de8cb1e9788bdd2a09e840b31348cd76c0
SHA256

636e55648c9d3fc08bc814e01765f34e71db576aef5397e16e6498d3a7ee7f7e
SHA512

cc48b85171edd62861f4eca49980e9353e8f0a65fdcec9f34928ce8f7e1bfbef932c28cdbcf2aa1f0c53490affd6d87c1fb5d7a62cb29e02fd924e797db15352
SSDEEP

98304:zziZpcTIjmxUPjRJjPmEriDJbg5ajTd806/x/rMsr:zzqGMfeEmDJM5andZ6J/Asr

Score

10^/10

cryptbot lumma defense_evasion discovery persistence spyware stealer

Malware Config

Extracted

Family

lumma

https://starjetv.run/GPazo

https://koreheatq.live/gsopp

https://castmaxw.run/ganzde

https://weldorae.digital/geds

https://steelixr.live/aguiz

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://smeltingt.run/giiaus

https://ferromny.digital/gwpd

Extracted

Family

cryptbot

http://home.sixbb6mn.top/jTNyqiIkTqrjLPexvdad174

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe

Executes dropped EXE 19 IoCs

pid	Process
2700	1.exe
4808	1.exe
5276	icsys.icn.exe
3612	explorer.exe
4676	spoolsv.exe
5584	svchost.exe
4996	spoolsv.exe
3136	2.exe
372	svchost.exe
3692	explorer.exe
5668	svchost.exe
3560	explorer.exe
896	2.exe
3252	icsys.icn.exe
2436	explorer.exe
3484	svchost.exe
4604	explorer.exe
5412	svchost.exe
6136	explorer.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	1.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x00070000000242a0-77.dat	embeds_openssl
behavioral2/files/0x00090000000242af-109.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
2700	1.exe
4808	1.exe
4808	1.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3612	explorer.exe
5584	svchost.exe

Suspicious use of SetWindowsHookEx 45 IoCs

pid	Process
2700	1.exe
2700	1.exe
2700	1.exe
4808	1.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
5276	icsys.icn.exe
3612	explorer.exe
3612	explorer.exe
3612	explorer.exe
4676	spoolsv.exe
4676	spoolsv.exe
4676	spoolsv.exe
5584	svchost.exe
5584	svchost.exe
5584	svchost.exe
4996	spoolsv.exe
4996	spoolsv.exe
4996	spoolsv.exe
3136	2.exe
3136	2.exe
3136	2.exe
372	svchost.exe
372	svchost.exe
3692	explorer.exe
3692	explorer.exe
5668	svchost.exe
5668	svchost.exe
3560	explorer.exe
3560	explorer.exe
896	2.exe
3252	icsys.icn.exe
3252	icsys.icn.exe
3252	icsys.icn.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
3484	svchost.exe
4604	explorer.exe
3484	svchost.exe
4604	explorer.exe
5412	svchost.exe
6136	explorer.exe
5412	svchost.exe
6136	explorer.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2700	2356	2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe	90
PID 2356 wrote to memory of 2700	2356	2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe	90
PID 2356 wrote to memory of 2700	2356	2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe	90
PID 2700 wrote to memory of 4808	2700	1.exe	99
PID 2700 wrote to memory of 4808	2700	1.exe	99
PID 2700 wrote to memory of 4808	2700	1.exe	99
PID 2700 wrote to memory of 5276	2700	1.exe	100
PID 2700 wrote to memory of 5276	2700	1.exe	100
PID 2700 wrote to memory of 5276	2700	1.exe	100
PID 5276 wrote to memory of 3612	5276	icsys.icn.exe	101
PID 5276 wrote to memory of 3612	5276	icsys.icn.exe	101
PID 5276 wrote to memory of 3612	5276	icsys.icn.exe	101
PID 3612 wrote to memory of 4676	3612	explorer.exe	102
PID 3612 wrote to memory of 4676	3612	explorer.exe	102
PID 3612 wrote to memory of 4676	3612	explorer.exe	102
PID 4676 wrote to memory of 5584	4676	spoolsv.exe	103
PID 4676 wrote to memory of 5584	4676	spoolsv.exe	103
PID 4676 wrote to memory of 5584	4676	spoolsv.exe	103
PID 5584 wrote to memory of 4996	5584	svchost.exe	104
PID 5584 wrote to memory of 4996	5584	svchost.exe	104
PID 5584 wrote to memory of 4996	5584	svchost.exe	104
PID 2356 wrote to memory of 3136	2356	2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe	109
PID 2356 wrote to memory of 3136	2356	2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe	109
PID 2356 wrote to memory of 3136	2356	2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe	109
PID 3132 wrote to memory of 372	3132	cmd.exe	114
PID 3132 wrote to memory of 372	3132	cmd.exe	114
PID 3132 wrote to memory of 372	3132	cmd.exe	114
PID 2032 wrote to memory of 3692	2032	cmd.exe	115
PID 2032 wrote to memory of 3692	2032	cmd.exe	115
PID 2032 wrote to memory of 3692	2032	cmd.exe	115
PID 2564 wrote to memory of 5668	2564	cmd.exe	116
PID 2564 wrote to memory of 5668	2564	cmd.exe	116
PID 2564 wrote to memory of 5668	2564	cmd.exe	116
PID 3812 wrote to memory of 3560	3812	cmd.exe	117
PID 3812 wrote to memory of 3560	3812	cmd.exe	117
PID 3812 wrote to memory of 3560	3812	cmd.exe	117
PID 3136 wrote to memory of 896	3136	2.exe	118
PID 3136 wrote to memory of 896	3136	2.exe	118
PID 3136 wrote to memory of 896	3136	2.exe	118
PID 3136 wrote to memory of 3252	3136	2.exe	119
PID 3136 wrote to memory of 3252	3136	2.exe	119
PID 3136 wrote to memory of 3252	3136	2.exe	119
PID 3252 wrote to memory of 2436	3252	icsys.icn.exe	120
PID 3252 wrote to memory of 2436	3252	icsys.icn.exe	120
PID 3252 wrote to memory of 2436	3252	icsys.icn.exe	120
PID 3204 wrote to memory of 3484	3204	cmd.exe	135
PID 3204 wrote to memory of 3484	3204	cmd.exe	135
PID 3204 wrote to memory of 3484	3204	cmd.exe	135
PID 3564 wrote to memory of 4604	3564	cmd.exe	134
PID 3564 wrote to memory of 4604	3564	cmd.exe	134
PID 3564 wrote to memory of 4604	3564	cmd.exe	134
PID 1484 wrote to memory of 5412	1484	cmd.exe	140
PID 1484 wrote to memory of 5412	1484	cmd.exe	140
PID 1484 wrote to memory of 5412	1484	cmd.exe	140
PID 3916 wrote to memory of 6136	3916	cmd.exe	141
PID 3916 wrote to memory of 6136	3916	cmd.exe	141
PID 3916 wrote to memory of 6136	3916	cmd.exe	141

C:\Users\Admin\AppData\Local\Temp\2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-30_5adcf9918838e95aa439ddcc4217c8e1_black-basta_cobalt-strike_satacom.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2700
- - \??\c:\users\admin\appdata\local\temp\rarsfx0\1.exe
    c:\users\admin\appdata\local\temp\rarsfx0\1.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4808
- - C:\Windows\Resources\Themes\icsys.icn.exe
    C:\Windows\Resources\Themes\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3612
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4676
      - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        6⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5584
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4996
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3136
- - \??\c:\users\admin\appdata\local\temp\rarsfx0\2.exe
    c:\users\admin\appdata\local\temp\rarsfx0\2.exe
    3⤵
    - Enumerates VirtualBox registry keys
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:896
- - C:\Windows\Resources\Themes\icsys.icn.exe
    C:\Windows\Resources\Themes\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:3132
- \??\c:\windows\resources\svchost.exe
  c:\windows\resources\svchost.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- \??\c:\windows\resources\svchost.exe
  c:\windows\resources\svchost.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- \??\c:\windows\resources\svchost.exe
  c:\windows\resources\svchost.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- \??\c:\windows\resources\svchost.exe
  c:\windows\resources\svchost.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe

Filesize
9.6MB

MD5
eb502f0caf957979b4e3869af946e28e

SHA1
037e9b80fa676e9014b59b718d63e463830748ab

SHA256
54ab97093c98aafabba05ea42dfb861c5429570e2d17ffe3af0497dfbc1c6e7d

SHA512
13346d638b9c521b6759b7208652f5e40c27285eca45c648077877c64f43db93dcef019c874c543f9446bab7172ac6774266c577e9629da309f2097a24fe513b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe

Filesize
9.5MB

MD5
9a4946e4e8e43a04b1a274ee46daabfe

SHA1
4c2f1001cb9618647b5195f84f6b04b476a73d06

SHA256
29ff18a22cee6d7d5e5b502f18b525c318722145e099ee69c7e9337b8292b76f

SHA512
39ef028c4f3cab001566f23e057ca0812fe232eee7120fc782505eda880fac3700faa6cb9411f0d16bdaba7d53dc52ac5049c261171775ba97461ce2e343303e

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
4848a64aa5ba4d6133eac19148e8d9df

SHA1
41d296670967444974cccc740cf89d6729d58362

SHA256
568bf8699197c83ead67ff16eb57ab78de6b61b38cf9d18ef3222880ee23dc67

SHA512
76a82777e9b3b6df86127de69e032cec62201cd016b67f05238ee8b158cb2b35028b97da2bb51f17c168cb90bdd376a54b596e9cc45b4679ca3f654d7514cffb

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
32934efd882389859edec5ec83e00b77

SHA1
7b20566031a7226f70f5c40c9168a988a2e86976

SHA256
410f8aa97aea1104624e8e312d103087439e3273ae23c934e8132bd3ce16ca83

SHA512
adc807ccf6c20d17f73c21d2f32497d65ebf05784f2b64c487695d9b6afbfd3137fbd64ec475c361932eeedb092f91e5a2952cfd83d83f1c55feb8444d400b4c

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
df5e724d42c606ad50b7bf829e67633c

SHA1
21f195be03e4951c8b2471085a88440378dd4f50

SHA256
b624ea5b24c87b1546091a28b13c0b1cb1500e9259edaa9d26721972374c015f

SHA512
4711f312cbd21e0f6455d6c68e2c8d320e8f30797bdc162ee51e352b4801d6735e75abe600b34b447aefd98374504302029ebf3780b42d3367f1933525020c1c

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
22281d961ad4d58c1f3d1e5a68e79a6f

SHA1
9dce23c71590f83fa00124053750b09a5cf2447b

SHA256
f0f7028b2316959e7f75447184454a072c09efcff12912b095160e1d2c5a223c

SHA512
d30513c762b5edbcac5862d8a1cbb15e14dc240ca1d73be2098255f3894bcc5a19684a6a8e6e1b8ebc6b193958f7a5d85bc3d8a28dc75e6aeb1e0744320e37e2

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
09f03649c913fc91b3aee8f08cdf8491

SHA1
09ac0a2f7ac3bbdc5c9353fc321a1791f7e42292

SHA256
ac4292061f748386c00f4755ba24c2fc590c760db0350b192ad4a65515d2b882

SHA512
515243d34656f4ac80066a9e7230ca87a857e8a7c815530934318299b57f2c5abfa6045ad0dac2e4ac80d5b2129e5dc48dd7e4909642e330e5bc2d93d4c197e2

Download Submit
memory/372-91-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/372-88-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/896-126-0x0000000000480000-0x0000000000E01000-memory.dmp

Filesize
9.5MB

Download
memory/896-125-0x0000000000480000-0x0000000000E01000-memory.dmp

Filesize
9.5MB

Download
memory/2436-122-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2700-67-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2700-13-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3136-78-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3136-124-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3252-114-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3252-123-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3484-136-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3560-106-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3612-137-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3692-98-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3692-90-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4604-135-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4676-65-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4808-24-0x0000000002870000-0x00000000028B4000-memory.dmp

Filesize
272KB

Download
memory/4808-27-0x0000000002D00000-0x0000000002D62000-memory.dmp

Filesize
392KB

Download
memory/4808-26-0x0000000000D70000-0x0000000000D73000-memory.dmp

Filesize
12KB

Download
memory/4808-23-0x0000000002870000-0x00000000028B4000-memory.dmp

Filesize
272KB

Download
memory/4996-64-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5276-66-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5412-147-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5584-138-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5668-102-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/6136-148-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download