blackshades | ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2025, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe
Size

520KB
MD5

f22e4c8ddaf28f4dff8a71497169e78f
SHA1

1370d731ef1a4b01edf47dbc72cfd6abb9b76d6f
SHA256

ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62
SHA512

3f2153c6cbf463086af6bd4338fc3998ded0d0aa09b37bb37229992ec358fbbfcbda4f77c5088436ffd387862d56c8d592e1c9d2fa3b62810acedec439f0311d
SSDEEP

12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXx:zW6ncoyqOp6IsTl/mXx

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 14 IoCs

resource	yara_rule
behavioral1/memory/5724-353-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-355-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-360-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-361-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-362-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-364-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-365-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-367-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-368-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-369-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-371-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-372-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-373-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/5724-375-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CQMYOSQTEJOBNVN\\service.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\service.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\service.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	service.exe

Executes dropped EXE 14 IoCs

pid	Process
4788	service.exe
1192	service.exe
2680	service.exe
1516	service.exe
3672	service.exe
2432	service.exe
3172	service.exe
2980	service.exe
2672	service.exe
4832	service.exe
4576	service.exe
3644	service.exe
3440	service.exe
5724	service.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SJTPKTEUETURBMS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MIXVLVPNPBFLYXK\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KFDFVJQLPAMXUAS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DQMPSRTFJOCNWNB\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MLYFOYWGCNGHXQU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XARKQXIJCWADTPQ\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ACWSNBWIXCHXYVE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CQMYOSQTEJOBNVN\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XJSJTPKTEUETURA = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DUNSLBLFDGWSTBP\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\APQNWIOTECGBJVW = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QJYIQEEFAFBWREL\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JAUWKWHGKXYBLRY = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YRQAYMLNIGNIYMT\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HMJJURPTOWKLELL = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SLKSGFGCAHCXSGN\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OCDXUPCYJEJYWFR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FPYGDRVHIFOAGLB\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ACWTNBXIYDHXYVE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CQMYPSRTFJOBNVN\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IXYVEFQWNLPKSGH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QTICBIRHMEVMALB\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UYVJVGFJWYAKQXX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XDWGSRTOMTPESAI\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TUPNQFTBKBVKXIG = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EOXFCQUGHENFKYA\\service.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3440 set thread context of 5724	3440	service.exe	174

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3612	reg.exe
4856	reg.exe
4088	reg.exe
4032	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	5724	service.exe
Token: SeCreateTokenPrivilege	5724	service.exe
Token: SeAssignPrimaryTokenPrivilege	5724	service.exe
Token: SeLockMemoryPrivilege	5724	service.exe
Token: SeIncreaseQuotaPrivilege	5724	service.exe
Token: SeMachineAccountPrivilege	5724	service.exe
Token: SeTcbPrivilege	5724	service.exe
Token: SeSecurityPrivilege	5724	service.exe
Token: SeTakeOwnershipPrivilege	5724	service.exe
Token: SeLoadDriverPrivilege	5724	service.exe
Token: SeSystemProfilePrivilege	5724	service.exe
Token: SeSystemtimePrivilege	5724	service.exe
Token: SeProfSingleProcessPrivilege	5724	service.exe
Token: SeIncBasePriorityPrivilege	5724	service.exe
Token: SeCreatePagefilePrivilege	5724	service.exe
Token: SeCreatePermanentPrivilege	5724	service.exe
Token: SeBackupPrivilege	5724	service.exe
Token: SeRestorePrivilege	5724	service.exe
Token: SeShutdownPrivilege	5724	service.exe
Token: SeDebugPrivilege	5724	service.exe
Token: SeAuditPrivilege	5724	service.exe
Token: SeSystemEnvironmentPrivilege	5724	service.exe
Token: SeChangeNotifyPrivilege	5724	service.exe
Token: SeRemoteShutdownPrivilege	5724	service.exe
Token: SeUndockPrivilege	5724	service.exe
Token: SeSyncAgentPrivilege	5724	service.exe
Token: SeEnableDelegationPrivilege	5724	service.exe
Token: SeManageVolumePrivilege	5724	service.exe
Token: SeImpersonatePrivilege	5724	service.exe
Token: SeCreateGlobalPrivilege	5724	service.exe
Token: 31	5724	service.exe
Token: 32	5724	service.exe
Token: 33	5724	service.exe
Token: 34	5724	service.exe
Token: 35	5724	service.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2224	ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe
4788	service.exe
1192	service.exe
2680	service.exe
1516	service.exe
3672	service.exe
2432	service.exe
3172	service.exe
2980	service.exe
2672	service.exe
4832	service.exe
4576	service.exe
3644	service.exe
3440	service.exe
5724	service.exe
5724	service.exe
5724	service.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4532	2224	ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe	89
PID 2224 wrote to memory of 4532	2224	ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe	89
PID 2224 wrote to memory of 4532	2224	ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe	89
PID 4532 wrote to memory of 4492	4532	cmd.exe	91
PID 4532 wrote to memory of 4492	4532	cmd.exe	91
PID 4532 wrote to memory of 4492	4532	cmd.exe	91
PID 2224 wrote to memory of 4788	2224	ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe	94
PID 2224 wrote to memory of 4788	2224	ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe	94
PID 2224 wrote to memory of 4788	2224	ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe	94
PID 4788 wrote to memory of 528	4788	service.exe	97
PID 4788 wrote to memory of 528	4788	service.exe	97
PID 4788 wrote to memory of 528	4788	service.exe	97
PID 528 wrote to memory of 5432	528	cmd.exe	99
PID 528 wrote to memory of 5432	528	cmd.exe	99
PID 528 wrote to memory of 5432	528	cmd.exe	99
PID 4788 wrote to memory of 1192	4788	service.exe	104
PID 4788 wrote to memory of 1192	4788	service.exe	104
PID 4788 wrote to memory of 1192	4788	service.exe	104
PID 1192 wrote to memory of 1432	1192	service.exe	105
PID 1192 wrote to memory of 1432	1192	service.exe	105
PID 1192 wrote to memory of 1432	1192	service.exe	105
PID 1432 wrote to memory of 1184	1432	cmd.exe	107
PID 1432 wrote to memory of 1184	1432	cmd.exe	107
PID 1432 wrote to memory of 1184	1432	cmd.exe	107
PID 1192 wrote to memory of 2680	1192	service.exe	110
PID 1192 wrote to memory of 2680	1192	service.exe	110
PID 1192 wrote to memory of 2680	1192	service.exe	110
PID 2680 wrote to memory of 2168	2680	service.exe	111
PID 2680 wrote to memory of 2168	2680	service.exe	111
PID 2680 wrote to memory of 2168	2680	service.exe	111
PID 2168 wrote to memory of 784	2168	cmd.exe	114
PID 2168 wrote to memory of 784	2168	cmd.exe	114
PID 2168 wrote to memory of 784	2168	cmd.exe	114
PID 2680 wrote to memory of 1516	2680	service.exe	117
PID 2680 wrote to memory of 1516	2680	service.exe	117
PID 2680 wrote to memory of 1516	2680	service.exe	117
PID 1516 wrote to memory of 2392	1516	service.exe	118
PID 1516 wrote to memory of 2392	1516	service.exe	118
PID 1516 wrote to memory of 2392	1516	service.exe	118
PID 2392 wrote to memory of 4380	2392	cmd.exe	120
PID 2392 wrote to memory of 4380	2392	cmd.exe	120
PID 2392 wrote to memory of 4380	2392	cmd.exe	120
PID 1516 wrote to memory of 3672	1516	service.exe	123
PID 1516 wrote to memory of 3672	1516	service.exe	123
PID 1516 wrote to memory of 3672	1516	service.exe	123
PID 3672 wrote to memory of 6044	3672	service.exe	126
PID 3672 wrote to memory of 6044	3672	service.exe	126
PID 3672 wrote to memory of 6044	3672	service.exe	126
PID 6044 wrote to memory of 3156	6044	cmd.exe	128
PID 6044 wrote to memory of 3156	6044	cmd.exe	128
PID 6044 wrote to memory of 3156	6044	cmd.exe	128
PID 3672 wrote to memory of 2432	3672	service.exe	131
PID 3672 wrote to memory of 2432	3672	service.exe	131
PID 3672 wrote to memory of 2432	3672	service.exe	131
PID 2432 wrote to memory of 4460	2432	service.exe	132
PID 2432 wrote to memory of 4460	2432	service.exe	132
PID 2432 wrote to memory of 4460	2432	service.exe	132
PID 4460 wrote to memory of 5328	4460	cmd.exe	134
PID 4460 wrote to memory of 5328	4460	cmd.exe	134
PID 4460 wrote to memory of 5328	4460	cmd.exe	134
PID 2432 wrote to memory of 3172	2432	service.exe	137
PID 2432 wrote to memory of 3172	2432	service.exe	137
PID 2432 wrote to memory of 3172	2432	service.exe	137
PID 3172 wrote to memory of 4944	3172	service.exe	138

C:\Users\Admin\AppData\Local\Temp\ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe
"C:\Users\Admin\AppData\Local\Temp\ad9d4850d66a6daacd49b1db769b214767a3d6672b1ab8da23c1fd8c49e82f62.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMSXJH.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XJSJTPKTEUETURA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4492
- C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe
  "C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRPSHV.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:528
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "APQNWIOTECGBJVW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5432
- - C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe
    "C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYBCY.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TUPNQFTBKBVKXIG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe
      "C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYJAAC.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2168
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JAUWKWHGKXYBLRY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe" /f
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:784
    - - C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1516
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HMJJURPTOWKLELL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SLKSGFGCAHCXSGN\service.exe" /f
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\SLKSGFGCAHCXSGN\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SLKSGFGCAHCXSGN\service.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXOLQL.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6044
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OCDXUPCYJEJYWFR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe" /f
        8⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWMKO.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ACWTNBXIYDHXYVE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe" /f
        9⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJHLG.bat" "
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SJTPKTEUETURBMS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MIXVLVPNPBFLYXK\service.exe" /f
        10⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\MIXVLVPNPBFLYXK\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MIXVLVPNPBFLYXK\service.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYAHHQ.bat" "
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IXYVEFQWNLPKSGH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe" /f
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRNOO.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KFDFVJQLPAMXUAS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DQMPSRTFJOCNWNB\service.exe" /f
        12⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\DQMPSRTFJOCNWNB\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DQMPSRTFJOCNWNB\service.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHIFN.bat" "
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MLYFOYWGCNGHXQU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe" /f
        13⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIBDQM.bat" "
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:396
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UYVJVGFJWYAKQXX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe" /f
        14⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPWMKO.bat" "
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ACWSNBWIXCHXYVE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe" /f
        15⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe
        
        C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        17⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe:*:Enabled:Windows Messanger" /f
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe:*:Enabled:Windows Messanger" /f
        17⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3612
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:844
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        17⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f
        17⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe
1⤵
PID:6004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe
1⤵
PID:5752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe
1⤵
PID:5868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe
1⤵
PID:3136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\SLKSGFGCAHCXSGN\service.exe
1⤵
PID:5768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe
1⤵
PID:3212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe
1⤵
PID:2208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MIXVLVPNPBFLYXK\service.exe
1⤵
PID:588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe
1⤵
PID:3552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\DQMPSRTFJOCNWNB\service.exe
1⤵
PID:4788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe
1⤵
PID:5884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe
1⤵
PID:2292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\TempIBDQM.txt

Filesize
163B

MD5
1e8813a92712fe490ba4002048c487cf

SHA1
41743664b2ac68b55cc34d6d9d93224c21bcc9f5

SHA256
b8effe0feaff70a9f1a251de4017611a9e5ab48d22ee4297a6a48d972101d898

SHA512
22999cdfb36cf286c378439456f35f38298d0dee487fe21265d63e190a5fd040623b9891e8c8a325742b420cfecfeb03a66e1fe75169707243bee435a3211aab

Download Submit
C:\Users\Admin\AppData\Local\TempLYBCY.txt

Filesize
163B

MD5
46646b2f639ee11a2bb7add9040e5c9e

SHA1
f9059c2659661e399712a5409aa75a3dfcc9a9d7

SHA256
c26731709f0910215fbef9653d080e1e90db9c1b0f540e2693e0f45f2b78d784

SHA512
2b39b0a1eaac2da85306d488a87bfcd22bfa9d61ee54d69ebaf594e6ba8500856d5cc2af3b5540279f5a93e8afe0b88d676146e4ce30396c9b158c1c56742445

Download Submit
C:\Users\Admin\AppData\Local\TempMSXJH.txt

Filesize
163B

MD5
19c3d00b54e1a732e3ff4f4691641bfa

SHA1
f341b0d51a62fcda2446db29014a154750314816

SHA256
69c0b28d1cecb511e40da563e46d586e182b14c1b99ebf8295d9991ed8c281e6

SHA512
b7d973aff28960034760f8a8e1150f2062e91dfa2ed4e7a756eb887a08d7ad53417b2f7437d7987cfc7028cdf1d1c145bbcc578618ccbf8b6c94af1e4b14ad4a

Download Submit
C:\Users\Admin\AppData\Local\TempPWMKO.txt

Filesize
163B

MD5
dda85f8b0d58ae1c32bfb3a623293ee1

SHA1
5290027dda62b16265d2cacc70fc8dced232ded5

SHA256
3a56eeaa48064e930e0a457a374cc3c44df9445ab8c0ce37a43a6848ee18339a

SHA512
055f9e8eb1ae0295896234448df3b0d79ea3e6a40a227a1b2fb5dcbf1b974d8d78c7bf4e0cf9d942c9bd76c6248e34d2a8ae4e3b6ea70ce8b1c621c18d177dcf

Download Submit
C:\Users\Admin\AppData\Local\TempQWMKO.txt

Filesize
163B

MD5
a043f02835dad303c1429240508802b7

SHA1
5ee62658090a5de3b0829dad0c403e8064c17492

SHA256
9e77587d0c213e0ec3e88a597ebb55b96bc0c32759a5e8307cb2c21fb5b428ea

SHA512
12d045af37c149a50d14903f735713a412b0279a20b7ec647b4f2deed409640983136d6423dec8f377cae717d88cb2e83bf4d8d0eba6c92abb4cfc035c50043f

Download Submit
C:\Users\Admin\AppData\Local\TempRPSHV.txt

Filesize
163B

MD5
4ace9412f0d3247a2d34d55d8a262db0

SHA1
9f03d399e963eb65645677fc98c0e112423ad8d1

SHA256
a58dfaa7fb5a1159dd4d047cecae029d157d2ae841f86ea1ae6234d7a077983f

SHA512
c87797d67d85070a19793c333ae1a14b6ca1a9ac60c2b08b25583bc729b2771e6e11708a2ea7f21f7603f70c446042a0631b436b7b42e2a489ab1e9cc8daa0b9

Download Submit
C:\Users\Admin\AppData\Local\TempUQYPE.txt

Filesize
163B

MD5
19a6c120952d344fa948640e89de2e11

SHA1
ffdb5fdee93d7d2159925fc94bc4a4edb00bf941

SHA256
10d48cad1224598e675f798148d64825b8765a175bf4fd7d3eebd3b2137262f9

SHA512
b4b66f43099caa2acfa64426881d211cc919a36dad4e962db53fc3216a9e9bc95a9cd4232a005150563d7df2936b5e60df5e2ee794cc3a3925095115fe6b8921

Download Submit
C:\Users\Admin\AppData\Local\TempVHIFN.txt

Filesize
163B

MD5
e9eb2adb3304563975152049f77c0fdd

SHA1
8b23c5f6b6eb2021ba49af6b0be2d7d2170138cf

SHA256
e7c38e673649a8f0ff7e3cdfdcc6c5d72957020e44d60851dded6fe9ef185681

SHA512
62526786542976834d648b3b2884cc5d75c5701ffce0a8afaff11b06aab1961322ed7daab06629dd5b7cd6e075811317c06f0eebf775d5d224a91d9cfc11ed14

Download Submit
C:\Users\Admin\AppData\Local\TempWRNOO.txt

Filesize
163B

MD5
a82677d1fe3597e7154fc5e851b108b2

SHA1
5eb7f0f21e825daa2335d5dde05a1f5065788a89

SHA256
1037e73e809966a18c99c4a6a542d8c8295f24b53e4736e34a3f84233af13981

SHA512
c8bd6524f8187e0a3a156c4acf6d6112b34e5ae5777edc13caa475ae1b741a35fbdce56677509cc51583daf1425f7e471c94a6be07d6ffd2ddce656516851477

Download Submit
C:\Users\Admin\AppData\Local\TempXJHLG.txt

Filesize
163B

MD5
53ea4a982507501170cf2d5c9e97e1ab

SHA1
25cdf70552f7eed9cc52678bcf0ce418bba9ca91

SHA256
d0a5b63ff6a89942d51cb0180f3a851c730bf22c6fe872362ff4471b4dcfe0ef

SHA512
86270bba81b72a27121c48d11bb33d3c175c971330ef79f7a1e2427cae8e4c07b4cc7c93a8509877f7e5c724589f729191a4223b68c557bbc2d5118109a4a763

Download Submit
C:\Users\Admin\AppData\Local\TempXOLQL.txt

Filesize
163B

MD5
dd39e3405cd956d2f46bfc4c0bc5f8be

SHA1
d1b2f5b4a95d8d31333626a0db4878fcb341a040

SHA256
33f630d17c7aec7c231791e3fe9ec50145908336cb8852f8fb1a33481c56ab27

SHA512
3d82b3657aeec4c9287b1e974004b95ae28a2209f8ddf0c9533f6c903480fbf7e33d492f4951697028099c8d8c9156e250e9e148c9852d9bbd54ed8ca50a0bf7

Download Submit
C:\Users\Admin\AppData\Local\TempYAHHQ.txt

Filesize
163B

MD5
e020fd89735fd051046c1015db42d980

SHA1
bd77c9a9a333210f5168e646549e351063865c18

SHA256
911393b3e92405293ce135c40d5b68d42060d21e867ca97549209a5108bfe7ab

SHA512
61816fbedfa9db687a47e536e0498bfe8a187d00b5f8023d09eb62026eedb7fbc1011096042de26e6d92c9a4c7256b0ac7f10788009b1518b1664449d94dbc87

Download Submit
C:\Users\Admin\AppData\Local\TempYJAAC.txt

Filesize
163B

MD5
71072ddaa690f07efb11530b0315d3af

SHA1
dd9f6327a40d0dcd5ae6fd481bea7106ca949d55

SHA256
f229807baa0c47338c43f2f18f2d2345be5b534fe561ad8b50328cc015bb55c9

SHA512
da937ea7574b0415ae1e93154aaea56401047707bf16f4b6b3904cbbd393f69fc54ab1380d073ba8eb03632b03121c4669796e78269b7251027f48e4a4b7c324

Download Submit
C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe

Filesize
520KB

MD5
fb5bf5e643d3f8332d6d29d33b115245

SHA1
577c719a7c9a7689d6e97425ddc6e3bf23674c40

SHA256
6aa2693ff95332a6c1186c2cd0cf3e13c8c13f9d72232f760a48d8d1b6a0138d

SHA512
eea0fef1689c8ce55a92c75a52ed87d00f474c412d0ad56e07043d9e2de10f659c8130d03509977b740a061cbaebc5fd106462cb6ca27b60c0b27943ce916bd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe

Filesize
520KB

MD5
6c84a9f7afcdec161e961a0cdf36b162

SHA1
8b7d575699a9c2a4932545e85a75933053f1d257

SHA256
2b14df370edd50c102c74734b33690b9d0edf52a69691392c279e91dbda0dfaf

SHA512
7837ff2793a0944e7f195a70977bfe0c7593fd82d9408320d6c96e8b67603dd96a5d09b18ce3ccbf4e093fe4cef2d6cab027de11e7003ddef1765cfe0600aa7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DQMPSRTFJOCNWNB\service.exe

Filesize
520KB

MD5
fb5773102d52a6b9b63e6351ddc03c3b

SHA1
9ec77b12b7ee67ba264536d45ac5cc00199e8033

SHA256
3ce65bf3ab48b5b1536bee9e12ad874be63af34c81415151040ca7709b549427

SHA512
3f82fafc9041061936ad975fb706242c38d6ae475086da1e22751e7a6903133f9d217f1c0fc4e9ee44c6d9d0be0b71f335a02ffad2556dd17577870d51570b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.txt

Filesize
520KB

MD5
74475a9455066c134df3456f0fde4295

SHA1
4d35242a045d29c82e7eef3b170ecc758a6afabd

SHA256
1ef2001c692213297dcd93ae28ebf7bfb32889ed05f1478fe47c1328518a2354

SHA512
a46eecfdaae7a3fc4f748e70e9b03585ff79c20b0e7da0485731a65374fa328120fa635bd4585556b59ff6ba0570d78b2b79d7de922caf92138c75119d85b58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe

Filesize
520KB

MD5
7c308b8e72df4cd125198feb69e1ca3b

SHA1
8b08f4159188994d78617d3681c6ade09cfd654e

SHA256
204f72baba258566fa16af8e61867618ebd834e4400f0b54729c28c1f93c0201

SHA512
93c08d0cd09f952961945f8fe92eeebeb6f708ce4a333e5bc86bd0e37ae6dc62f3aaabc27e97ba77e839df96d25e0d1da7e335c11b4eb1a91769799d41dca778

Download Submit
C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe

Filesize
520KB

MD5
0b8d42fbd9d5f1ad00d5d8db5d509e32

SHA1
0f7419c77277ee7e8df7e4b047f09fa8ac33d629

SHA256
eca71a78db167fd0edbc8987e1ac76299df67799d9567e94909c6ed29e454a10

SHA512
985df68bdbf84b76d14ddeee835e04e10f52a2b08b30b824313ab5172966675405c0690913ad1dcdcd5921621fe9ccf037aade389ffb48dc7f5133b776b62331

Download Submit
C:\Users\Admin\AppData\Local\Temp\MIXVLVPNPBFLYXK\service.exe

Filesize
520KB

MD5
3570c24c324982ce3baedc46068b6265

SHA1
20ceeca374d8cec4781282d99a6cfbc34da328b7

SHA256
ec4a3a06298ddb42411e5435bb218dd877ba969294526f7319e90327e6aa7e72

SHA512
b0d799a21ffdaf9730d567f8cd5b1f0ad692a5429e238526df2dcc8826da03a995744ea97dd75c79f9779ae7c8b8bf9bdb3c1c4ecad3d358bfb4f662f0ffa996

Download Submit
C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe

Filesize
520KB

MD5
1358ba5dc0f3e29579abb2ee6dcb77e9

SHA1
ba2c58afbd54aa3994d36e1e476e746097d70dce

SHA256
856d0b1528a2f009ce69610d03e57d79766797d241b85bfff072d87ffd0f564d

SHA512
f937a7e4be790f76bb9646b32642377a1c3ee40418a384399aa2b6969ed557d65e6fc27aa6e52ea71e30597dd4af3e56752e5a0ed108c8fb6f19d88a22402606

Download Submit
C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe

Filesize
520KB

MD5
f1ac40abc499d0c742fff636acce06f3

SHA1
f949ac506b22425115f130d774680be7c484a243

SHA256
c2356e1205d83730963aa92359bd79ab3bea978f76a8937e2deaddce7207c522

SHA512
b3c46c26f1e5bd76e5f0c75a26b1e427c0ced5c29ca051e0565ad9c76a4f554205ca4e32599d8d2356bd4614980ba27580767d830f1cbdf4b03203914d128747

Download Submit
C:\Users\Admin\AppData\Local\Temp\SLKSGFGCAHCXSGN\service.exe

Filesize
520KB

MD5
8ffa1e4655f26fa7b3eb4d1ac5a66a5d

SHA1
da527a3c7522d3cd3faf817600017671e917f4c2

SHA256
4519f7e60a28d896383af67ce3bc529b2e177fbe31397dc390dbb3b4701f60c0

SHA512
acfe1f4ff82d8555d86358c7d9d27d129a37c30e0523fba34e08eab94656351e041036b8b8ada97dafbf7a9afad64bfb536264e51e0eacd783a1392ba19da660

Download Submit
C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe

Filesize
520KB

MD5
ef1be6eb07916ca1d9c4c39d772d3272

SHA1
ebef0f975296c7e8e052efdfada49f79d210d210

SHA256
9752283fe0aaf3ebed961caffa901f8697463d939b9d7b147be8f8dd54ac1a1b

SHA512
0c1df59497a8f94aca3072bcc23de7f285e1a31a3b983bd3244b99ca098fd5d96ccc18f7103e85de84368b5e6425d18c6942e13d4f89299714cf1bb292dd5456

Download Submit
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe

Filesize
520KB

MD5
0997b0ac3aae820beb998400bee3b792

SHA1
7a314fc0c772e4710c16e755492c67c76e0afe5d

SHA256
f3f1c7f0093cdd6c8977b6911b5642888b42ab343a25261fb9681da20451a693

SHA512
8a1e8e6167c4bafd17e85064f64f3c1caa5cb5e48157e610a77cf32d96dc1d53054d74659cd9f62f96709c877a32de004f3f2cb8213afd90f5edd8fb35535e5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe

Filesize
520KB

MD5
41292246bf74f2e40ff801182a2cc47a

SHA1
71452cfce4fa405164678fc39f19640709282494

SHA256
446a6e92aa77cdfbba1055c7a0ff8b30ba9a57e37c5d722b083645fba5d89a49

SHA512
3658cd746c20b030522a96372f808a48d2feb08e6f6ef2b771539b268845d02dfca6d62212654461cf1233367be9f21b312af14de1a60f3b220da69b95cbd5b8

Download Submit
memory/5724-372-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-367-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-360-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-361-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-362-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-364-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-365-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-355-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-368-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-369-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-371-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-353-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-373-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5724-375-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads