Overview
overview
10Static
static
10250511-hcr7waxn14.zip
windows11-21h2-x64
1Dropper/Berbew.exe
windows11-21h2-x64
10Dropper/Phorphiex.exe
windows11-21h2-x64
5out.exe
windows11-21h2-x64
3RAT/31.exe
windows11-21h2-x64
10RAT/XClient.exe
windows11-21h2-x64
10RAT/file.exe
windows11-21h2-x64
7Ransomware...-2.exe
windows11-21h2-x64
10Ransomware...01.exe
windows11-21h2-x64
10Ransomware...lt.exe
windows11-21h2-x64
10Stealers/Azorult.exe
windows11-21h2-x64
10Stealers/B...on.exe
windows11-21h2-x64
10Stealers/Dridex.dll
windows11-21h2-x64
10Stealers/M..._2.exe
windows11-21h2-x64
10Stealers/lumma.exe
windows11-21h2-x64
3Trojan/BetaBot.exe
windows11-21h2-x64
10Trojan/Smo...er.exe
windows11-21h2-x64
10Resubmissions
21/11/2025, 18:12
251121-wtl9vadq3v11/11/2025, 00:19
251111-amds8swmcl1011/05/2025, 06:45
250511-hjhl1swwbv10Analysis
- max time kernel
899s - max time network
444s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system - submitted
11/11/2025, 00:19
Behavioral task
behavioral1
Sample
250511-hcr7waxn14.zip
Resource
win11-20251015-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win11-20251015-en
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win11-20250619-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
out.exe
Resource
win11-20251015-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win11-20251015-en
windows11-21h2-x64
53 signatures
900 seconds
Behavioral task
behavioral6
Sample
RAT/XClient.exe
Resource
win11-20251015-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral7
Sample
RAT/file.exe
Resource
win11-20251015-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral8
Sample
Ransomware/Client-2.exe
Resource
win11-20251015-en
windows11-21h2-x64
22 signatures
900 seconds
Behavioral task
behavioral9
Sample
Ransomware/criticalupdate01.exe
Resource
win11-20251015-en
windows11-21h2-x64
18 signatures
900 seconds
Behavioral task
behavioral10
Sample
Ransomware/default.exe
Resource
win11-20251015-en
windows11-21h2-x64
30 signatures
900 seconds
Behavioral task
behavioral11
Sample
Stealers/Azorult.exe
Resource
win11-20251015-en
windows11-21h2-x64
59 signatures
900 seconds
Behavioral task
behavioral12
Sample
Stealers/BlackMoon.exe
Resource
win11-20251015-en
windows11-21h2-x64
7 signatures
900 seconds
Behavioral task
behavioral13
Sample
Stealers/Dridex.dll
Resource
win11-20251015-en
windows11-21h2-x64
12 signatures
900 seconds
Behavioral task
behavioral14
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win11-20251015-en
windows11-21h2-x64
20 signatures
900 seconds
Behavioral task
behavioral15
Sample
Stealers/lumma.exe
Resource
win11-20251015-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral16
Sample
Trojan/BetaBot.exe
Resource
win11-20250619-en
windows11-21h2-x64
26 signatures
900 seconds
Behavioral task
behavioral17
Sample
Trojan/SmokeLoader.exe
Resource
win11-20251015-en
windows11-21h2-x64
8 signatures
900 seconds
General
- Target Stealers/Dridex.dll
- Size 1.2MB
- Sample251111-amds8swmcl
- SHA256 af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d
- MD5 304109f9a5c3726818b4c3668fdb71fd
- SHA1 2eb804e205d15d314e7f67d503940f69f5dc2ef8
- SHA512 cf01fca33392dc40495f4c39eb1fd240b425018c7088ca9782d883bb135b5dd469a11941d0d680a69e881fa95c4147d70fe567aeba7e98ff6adfd5c0ca1a0e01
- SSDEEP 24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Dridex family
-
resource yara_rule behavioral13/memory/3284-4-0x0000000002FB0000-0x0000000002FB1000-memory.dmp dridex_stager_shellcode - Executes dropped EXE 5 IoCs
pid Process 1676 cmstp.exe 4152 mmc.exe 4740 mmc.exe 5032 phoneactivate.exe 3888 cmstp.exe - Loads dropped DLL 6 IoCs
pid Process 1676 cmstp.exe 1676 cmstp.exe 4152 mmc.exe 4740 mmc.exe 5032 phoneactivate.exe 3888 cmstp.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uzpgfql = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\WcAdXcYNW\\mmc.exe" Process not Found - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA phoneactivate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmstp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmstp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mmc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mmc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3440 rundll32.exe 3440 rundll32.exe 3440 rundll32.exe 3440 rundll32.exe 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3284 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3284 wrote to memory of 3376 3284 Process not Found 78 PID 3284 wrote to memory of 3376 3284 Process not Found 78 PID 3284 wrote to memory of 1676 3284 Process not Found 79 PID 3284 wrote to memory of 1676 3284 Process not Found 79 PID 3284 wrote to memory of 4504 3284 Process not Found 80 PID 3284 wrote to memory of 4504 3284 Process not Found 80 PID 3284 wrote to memory of 4152 3284 Process not Found 81 PID 3284 wrote to memory of 4152 3284 Process not Found 81 PID 3284 wrote to memory of 5216 3284 Process not Found PID 3284 wrote to memory of 5216 3284 Process not Found PID 3284 wrote to memory of 5088 3284 Process not Found 84 PID 3284 wrote to memory of 5088 3284 Process not Found 84 PID 3284 wrote to memory of 5032 3284 Process not Found 85 PID 3284 wrote to memory of 5032 3284 Process not Found 85 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Stealers\Dridex.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3440
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵PID:3376
-
C:\Users\Admin\AppData\Local\4IVK95ED\cmstp.exeC:\Users\Admin\AppData\Local\4IVK95ED\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1676
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵PID:4504
-
C:\Users\Admin\AppData\Local\2mXK\mmc.exeC:\Users\Admin\AppData\Local\2mXK\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4152
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\WcAdXcYNW\mmc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\WcAdXcYNW\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4740
-
C:\Windows\system32\phoneactivate.exeC:\Windows\system32\phoneactivate.exe1⤵PID:5088
-
C:\Users\Admin\AppData\Local\Q7NaMSv\phoneactivate.exeC:\Users\Admin\AppData\Local\Q7NaMSv\phoneactivate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:5032
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\jHAWpXz6hl\cmstp.exeC:\Users\Admin\AppData\Roaming\Adobe\Acrobat\jHAWpXz6hl\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3888
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\2mXK\mmc.exe
- Size 1.8MB
- SHA256 ad93f7968cb25b46bbc0f95f0f825748f28dc839ce902aa2eab797282b5d212e
- MD5 2d1c151d6fa67caf0de803e575edc97f
- SHA1 8ce3a4b4df002ebdf13f6d26c2a25a33fb04fd20
- SHA512 e8c3e204a986dede5f660570f5971e30467e913e9554c167d859fbbf00509ec30eebf573bf752037ded6b7ee71286cc652c01704567fb44a81627e5edac49c7d
- SSDEEP 49152:NZ5i22kIMkaXz1so17i5AARVNP7ntX2UXMK4ZL7cy4BQQmZHrWEwlQ8+vgBA7e7z:Ol5m7e7DH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\2mXK\mmcbase.DLL
- Size 1.2MB
- SHA256 6dce887ea7ed649d12e8b2963985228da5a417b5e22830fd46e9015f8475ea9f
- MD5 68d2cc120aa87c6cc56013be03774b54
- SHA1 a8ae878f81b690ccf1838fc9621519abbad779a9
- SHA512 6752b20d67ed9d5ee03f7d7c171f38410f5a1fbb8c8fb9539623b358ab7c3d08b52151711130bc9812674b3f78d246ddf1b4227fa25a61dffb1e631abf3d17a3
- SSDEEP 24576:TVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:TV8hf6STw1ZlQauvzSq01ICe6zvm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\4IVK95ED\VERSION.dll
- Size 1.2MB
- SHA256 039145ac45a507d948ce7fea6af2ef8eb37fbc2d71411ac83a0826337741ada4
- MD5 1c684ada094a14daa3aee8c3a7d740d5
- SHA1 2f441ca772f66960ffd83d1dc8e1ea979c3c4413
- SHA512 7a12a3547e86d581679bcc7b99dc9a01d5f015379fe4f2ade6f0cee6aed1db8441fd1d6ca8a9616b9acb997db2003fcaef31ceedf1cd4b5f5ad1e147ea5eceda
- SSDEEP 24576:7VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:7V8hf6STw1ZlQauvzSq01ICe6zvm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\4IVK95ED\cmstp.exe
- Size 116KB
- SHA256 5142f9ba10100441b5ae60484a2230fdeb7dbc0d2a6c099e9e560ddb9b6baf88
- MD5 d836bcdd54fd025b600e95033f3046e5
- SHA1 c2d3892c00251841bd24ab0cf5379d327d14013a
- SHA512 35a2b36c50ea884f73404742157fff45a0c9a7df9de670cb12ddccff961fe91d580f1a250d2191fef1c360d26df97c652320460adfddf53efb204ad8a3c126cd
- SSDEEP 3072:XQv4R4TFHEJtvSKz2XZBIcSu4k27BMnxf1a1:AgRUFmtvSKzSZBIcSu4L7BMnxm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Q7NaMSv\SLC.dll
- Size 1.2MB
- SHA256 0218dc03fbcb261e5d37a1762dc2bdfea6baaf7d82d99577b214b1d0445f1013
- MD5 6061da9985542866f706018e12440fb2
- SHA1 2bf140bca2fe41eac93eda7e496b55c60b6b5643
- SHA512 7a168d9634fccf60e89fc873edf3a1c72efced0d05069126c570927acba837b8d2ed90b839a24f00fb8c33c98b4d19782d92d288b02bb8507bad592c7a4b7d1e
- SSDEEP 24576:XVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8R1:XV8hf6STw1ZlQauvzSq01ICe6zvm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Q7NaMSv\phoneactivate.exe
- Size 125KB
- SHA256 7eb805ff4278bdcb9000521e5255a4b19c1b372e9279c6bfcc83dd6ff2098f8e
- MD5 f51b804c11e1654dead59ab7ba6029e0
- SHA1 3a8a46d60fbe8ae49422403d913df253d17a9ad9
- SHA512 a0b3523b45890e3ccd07ec5587184fc3293c03f281c72ce0347243bd056e388ee2802e31aa8b8ccfca05290e6019a796e466baa7849ea620c1ff7564127cec1d
- SSDEEP 1536:39k/4babtsgXzMVsteLq1N2Dfmw9L7C0a1xG2znHXoULg6nYpmYyjFNxCYPh:P2R3QceLq/KxCxGUr06nYlO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Vxhgjnwzypxcjoh.lnk
- Size 1KB
- SHA256 68f9cebfc3590886e69c26c06223d86453ff42667bd56f725a62f9f1a5b0ccd3
- MD5 5aeff1b2d2b6f333194cadca283f324d
- SHA1 ece506dec67e9f715ebde4701f6a615d9dd71c12
- SHA512 ab749d38041ba94a6d24fa8a248be0d24aab1fe69520a1963a66c2997751386e9b401a44693d7863769b673fa19bd4023e5d6e3d51cc12bf284ab7b14df8078c
- MD5 SHA1 SHA512