xbinder | 72f7cd03b60b66ea7f2e5e91542c78fd33e990a673dcdfe3cc412e8295293c20

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XBinderOutput.exe
Size 713KB
Sample260626-e8ed4sgy7s
SHA256 72f7cd03b60b66ea7f2e5e91542c78fd33e990a673dcdfe3cc412e8295293c20
MD5 80b0d635a53f464267396d6c4553b61e
SHA1 d4359cfc3f6a8f677d9c1ae4dbd0184eef18e716
SHA512 bb576079cb4c9803243548e6b568cbb9b73055738f523717822445b0180bf863bbfcc304b8c55e22b48a875f7fbc1aea80c2966e1078b3d93cf61c4834f45c76
SSDEEP 12288:xi/cqxn+TX+GqQMEunwuE6uxDhewLMXCb5zBEebQnA6Mm6BwWrr/P0AmAF6wP020:xzBT+GMEunwDJRVzqA64pr8mdI
TLSH
T19DF4239E0576E135CADC863E2D72A32223DB3760F763E4FD5248D3AD95DE5028E92D01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xbinder loader

Malware Config

Extracted

Family

xbinder

Mutex

Q1hKouDwgpDa4SCtu

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
CREATIVE EAX.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
MasonClient.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Executes dropped EXE 64 IoCs

pid	Process
6108	CREATIVE EAX.exe
2112	MasonClient.exe
3156	CREATIVE EAX.exe
5492	MasonClient.exe
4512	CREATIVE EAX.exe
6088	MasonClient.exe
3968	CREATIVE EAX.exe
2512	MasonClient.exe
3888	CREATIVE EAX.exe
4484	MasonClient.exe
4984	CREATIVE EAX.exe
5468	MasonClient.exe
3932	CREATIVE EAX.exe
3112	MasonClient.exe
3452	CREATIVE EAX.exe
1176	MasonClient.exe
1236	CREATIVE EAX.exe
3800	MasonClient.exe
5516	CREATIVE EAX.exe
1888	MasonClient.exe
4648	CREATIVE EAX.exe
5920	MasonClient.exe
5324	CREATIVE EAX.exe
2852	MasonClient.exe
6048	CREATIVE EAX.exe
5776	MasonClient.exe
5372	CREATIVE EAX.exe
2456	MasonClient.exe
1488	CREATIVE EAX.exe
576	MasonClient.exe
4896	CREATIVE EAX.exe
5696	MasonClient.exe
1996	CREATIVE EAX.exe
4920	MasonClient.exe
3856	CREATIVE EAX.exe
4456	MasonClient.exe
2320	CREATIVE EAX.exe
3148	MasonClient.exe
6032	CREATIVE EAX.exe
1248	MasonClient.exe
2672	CREATIVE EAX.exe
3112	MasonClient.exe
3960	CREATIVE EAX.exe
1928	MasonClient.exe
4632	CREATIVE EAX.exe
696	MasonClient.exe
2960	CREATIVE EAX.exe
5652	MasonClient.exe
5920	CREATIVE EAX.exe
2684	MasonClient.exe
2852	CREATIVE EAX.exe
3484	MasonClient.exe
4564	CREATIVE EAX.exe
5484	MasonClient.exe
4592	CREATIVE EAX.exe
1764	MasonClient.exe
5284	CREATIVE EAX.exe
5624	MasonClient.exe
5680	CREATIVE EAX.exe
2196	MasonClient.exe
6088	CREATIVE EAX.exe
1604	MasonClient.exe
5208	CREATIVE EAX.exe
4456	MasonClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 6108	1448	XBinderOutput.exe	89
PID 1448 wrote to memory of 2112	1448	XBinderOutput.exe	90
PID 6108 wrote to memory of 3156	6108	CREATIVE EAX.exe	94
PID 6108 wrote to memory of 5492	6108	CREATIVE EAX.exe	95
PID 3156 wrote to memory of 4512	3156	CREATIVE EAX.exe	98
PID 3156 wrote to memory of 6088	3156	CREATIVE EAX.exe	99
PID 4512 wrote to memory of 3968	4512	CREATIVE EAX.exe	102
PID 4512 wrote to memory of 2512	4512	CREATIVE EAX.exe	103
PID 3968 wrote to memory of 3888	3968	CREATIVE EAX.exe	106
PID 3968 wrote to memory of 4484	3968	CREATIVE EAX.exe	107
PID 3888 wrote to memory of 4984	3888	CREATIVE EAX.exe	110
PID 3888 wrote to memory of 5468	3888	CREATIVE EAX.exe	111
PID 4984 wrote to memory of 3932	4984	CREATIVE EAX.exe	114
PID 4984 wrote to memory of 3112	4984	CREATIVE EAX.exe	115
PID 3932 wrote to memory of 3452	3932	CREATIVE EAX.exe	118
PID 3932 wrote to memory of 1176	3932	CREATIVE EAX.exe	119
PID 3452 wrote to memory of 1236	3452	CREATIVE EAX.exe	122
PID 3452 wrote to memory of 3800	3452	CREATIVE EAX.exe	123
PID 1236 wrote to memory of 5516	1236	CREATIVE EAX.exe	126
PID 1236 wrote to memory of 1888	1236	CREATIVE EAX.exe	127
PID 5516 wrote to memory of 4648	5516	CREATIVE EAX.exe	130
PID 5516 wrote to memory of 5920	5516	CREATIVE EAX.exe	131
PID 4648 wrote to memory of 5324	4648	CREATIVE EAX.exe	134
PID 4648 wrote to memory of 2852	4648	CREATIVE EAX.exe	135
PID 5324 wrote to memory of 6048	5324	CREATIVE EAX.exe	138
PID 5324 wrote to memory of 5776	5324	CREATIVE EAX.exe	139
PID 6048 wrote to memory of 5372	6048	CREATIVE EAX.exe	142
PID 6048 wrote to memory of 2456	6048	CREATIVE EAX.exe	143
PID 5372 wrote to memory of 1488	5372	CREATIVE EAX.exe	146
PID 5372 wrote to memory of 576	5372	CREATIVE EAX.exe	147
PID 1488 wrote to memory of 4896	1488	CREATIVE EAX.exe	150
PID 1488 wrote to memory of 5696	1488	CREATIVE EAX.exe	151
PID 4896 wrote to memory of 1996	4896	CREATIVE EAX.exe	154
PID 4896 wrote to memory of 4920	4896	CREATIVE EAX.exe	155
PID 1996 wrote to memory of 3856	1996	CREATIVE EAX.exe	158
PID 1996 wrote to memory of 4456	1996	CREATIVE EAX.exe	159
PID 3856 wrote to memory of 2320	3856	CREATIVE EAX.exe	162
PID 3856 wrote to memory of 3148	3856	CREATIVE EAX.exe	163
PID 2320 wrote to memory of 6032	2320	CREATIVE EAX.exe	166
PID 2320 wrote to memory of 1248	2320	CREATIVE EAX.exe	167
PID 6032 wrote to memory of 2672	6032	CREATIVE EAX.exe	170
PID 6032 wrote to memory of 3112	6032	CREATIVE EAX.exe	171
PID 2672 wrote to memory of 3960	2672	CREATIVE EAX.exe	174
PID 2672 wrote to memory of 1928	2672	CREATIVE EAX.exe	175
PID 3960 wrote to memory of 4632	3960	CREATIVE EAX.exe	178
PID 3960 wrote to memory of 696	3960	CREATIVE EAX.exe	179
PID 4632 wrote to memory of 2960	4632	CREATIVE EAX.exe	182
PID 4632 wrote to memory of 5652	4632	CREATIVE EAX.exe	183
PID 2960 wrote to memory of 5920	2960	CREATIVE EAX.exe	186
PID 2960 wrote to memory of 2684	2960	CREATIVE EAX.exe	187
PID 5920 wrote to memory of 2852	5920	CREATIVE EAX.exe	190
PID 5920 wrote to memory of 3484	5920	CREATIVE EAX.exe	191
PID 2852 wrote to memory of 4564	2852	CREATIVE EAX.exe	194
PID 2852 wrote to memory of 5484	2852	CREATIVE EAX.exe	195
PID 4564 wrote to memory of 4592	4564	CREATIVE EAX.exe	198
PID 4564 wrote to memory of 1764	4564	CREATIVE EAX.exe	199
PID 4592 wrote to memory of 5284	4592	CREATIVE EAX.exe	202
PID 4592 wrote to memory of 5624	4592	CREATIVE EAX.exe	203
PID 5284 wrote to memory of 5680	5284	CREATIVE EAX.exe	206
PID 5284 wrote to memory of 2196	5284	CREATIVE EAX.exe	207
PID 5680 wrote to memory of 6088	5680	CREATIVE EAX.exe	210
PID 5680 wrote to memory of 1604	5680	CREATIVE EAX.exe	211
PID 6088 wrote to memory of 5208	6088	CREATIVE EAX.exe	214
PID 6088 wrote to memory of 4456	6088	CREATIVE EAX.exe	215

C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
  "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
    "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
      "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        33⤵
        Executes dropped EXE
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        34⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        35⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        36⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        37⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        38⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        39⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        40⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        41⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        42⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        43⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        44⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        45⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        46⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        47⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        48⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        49⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        50⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        51⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        52⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        53⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        54⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        55⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        56⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        57⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        58⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        59⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        60⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        61⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        62⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        63⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        64⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        65⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        66⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        67⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        68⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        69⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        69⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        68⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        67⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        66⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        65⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        64⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        63⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        62⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        61⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        60⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        59⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        58⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        57⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        56⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        55⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        54⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        53⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        52⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        51⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        50⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        49⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        48⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        47⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        46⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        45⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        44⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        43⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        42⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        41⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        40⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        39⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        38⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        37⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        36⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        35⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        34⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        33⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        32⤵
        Executes dropped EXE
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        31⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        30⤵
        Executes dropped EXE
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        29⤵
        Executes dropped EXE
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        28⤵
        Executes dropped EXE
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        27⤵
        Executes dropped EXE
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        26⤵
        Executes dropped EXE
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        25⤵
        Executes dropped EXE
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        24⤵
        Executes dropped EXE
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        23⤵
        Executes dropped EXE
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        22⤵
        Executes dropped EXE
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        21⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        20⤵
        Executes dropped EXE
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        19⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        18⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        17⤵
        Executes dropped EXE
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        16⤵
        Executes dropped EXE
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        15⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        14⤵
        Executes dropped EXE
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        13⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        12⤵
        Executes dropped EXE
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        11⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        10⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        9⤵
        Executes dropped EXE
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        8⤵
        Executes dropped EXE
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        7⤵
        Executes dropped EXE
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        6⤵
        Executes dropped EXE
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        5⤵
        Executes dropped EXE
        
        PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
      4⤵
      Executes dropped EXE
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
    3⤵
    - Executes dropped EXE
    PID:5492
- C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
  "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CREATIVE EAX.exe

Path C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
Size 632KB
SHA256 338bef4348c77f34db476ea973a1deaa627e7f9c53a40a60094ffa10d54e9ca7
MD5 3ff315c4f90baa778075aa75bfcd2e84
SHA1 aa494e6e9bae394d94e912b7101cd2659854e10d
SHA512 286e1bee7bee95622f40c7dc02c46640bbb93671b165ee732fa6067c379252d40bcc7d80869faa07d20f5fec52dd24a7c104d91cf00cd9c19503d93b32568146
SSDEEP 12288:BrP/i/u+x1+LXAIyQMEgnkuE6gxLheYrMNmp5H5EeBQdA6M66Bsorr/J0emMFZ0K:BjjFrA6MEgnkRHR/HMA6CFrc6
TLSH
T171D4238F0172A536C6CC4B7E1DB3E32113DB7754F7A2E4FD5284C2AAA5DE5028F92A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonClient.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
Size 50KB
SHA256 5980ae2154b0400bd97f7b7214f41963149de798756581b54002b38151a31233
MD5 e34f2e75ab9da7810a20c75bceab4416
SHA1 6aeb05c71b545c7971bad1756102a57864deb6b1
SHA512 dd0d7a8e8d24d71d0253ee2b6baa4fbb45141ff5e96f23ad748a5f5f50ad5eae09275fc2bcd4d340f614ce77bf4fee3ffae7222b9cce5b2321db58eeaee47777
SSDEEP 768:NP/PARYjyUSMM4SARAb+XhS0bomNXhBOV0esG:NPXxHMH3b+XhZBDOVAG
TLSH
T1E933E74CFBE40129D5BE6AF12D73621983B079939516C50F7CD402CB2B6BB884A90EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1448-0-0x00007FFA3C22F000-0x00007FFA3C230000-memory.dmp

Download

memory/1448-1-0x0000000000DA0000-0x0000000000E58000-memory.dmp

Download

memory/1448-2-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/1448-3-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/1448-5-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/1448-24-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/2112-21-0x0000000000960000-0x0000000000972000-memory.dmp

Download

memory/2112-23-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/2112-25-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/2112-26-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/6108-22-0x0000000000BC0000-0x0000000000C62000-memory.dmp

Download

memory/6108-27-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/6108-28-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/6108-38-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads