fd7e1fcd0fb79403a5920a87f69df1e19c437088193db4a7c2eee5d070335465

Analysis

max time kernel
60s
max time network
59s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FN.Rage_loader.exe
Size 1.1MB
Sample260816-ejb8fszvg1
SHA256 fd7e1fcd0fb79403a5920a87f69df1e19c437088193db4a7c2eee5d070335465
MD5 5e06b0cd164435b7b00e811f9b5d58a7
SHA1 3534ac9b07f3cda269d3cb084887effd90dfe1bb
SHA512 22ad701f114575c160de4b4f5e194a01d6db9532fc6b907924015b62ecf44fc2a01448f6743e38a87c061f9241f84c4e5abab7c4ec09bf4c94ba5ad32ae65a3e
SSDEEP 24576:PFOa5HZBi99Ck2EEW9pmjIaHNx56wTxNqnNuGKFuesdQEB3s:tlGqk2RfH77cn3GEB3s
TLSH
T1E645AD1362A405FAD56BC078D466E317FA76781913209ECB53E09A242F737D27EFA312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
2312	fn.rage_loader.exe
5812	icsys.icn.exe
5052	explorer.exe
720	spoolsv.exe
4376	svchost.exe
292	spoolsv.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	FN.Rage_loader.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6000	sc.exe
4748	sc.exe
4548	sc.exe
6112	sc.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4380	cmd.exe
5764	cmd.exe
468	cmd.exe
1712	cmd.exe
1896	cmd.exe
896	cmd.exe
2932	cmd.exe
2580	cmd.exe
3496	cmd.exe
3836	cmd.exe
5192	cmd.exe
3188	cmd.exe
5356	cmd.exe
1200	cmd.exe
612	cmd.exe
3360	cmd.exe
2908	cmd.exe
5692	cmd.exe
5188	cmd.exe
4744	cmd.exe
3004	cmd.exe
1384	cmd.exe
2444	cmd.exe
5956	cmd.exe
3236	cmd.exe
932	cmd.exe
5892	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FN.Rage_loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Kills process with taskkill 17 IoCs

defense_evasion

pid	Process
6036	taskkill.exe
5316	taskkill.exe
952	taskkill.exe
4992	taskkill.exe
2380	taskkill.exe
2740	taskkill.exe
3444	taskkill.exe
1768	taskkill.exe
1912	taskkill.exe
5988	taskkill.exe
4364	taskkill.exe
4328	taskkill.exe
1576	taskkill.exe
2100	taskkill.exe
2276	taskkill.exe
464	taskkill.exe
4552	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5812	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5052	explorer.exe
4376	svchost.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	5316	taskkill.exe
Token: SeDebugPrivilege	4328	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	1912	taskkill.exe
Token: SeDebugPrivilege	2740	taskkill.exe
Token: SeDebugPrivilege	2380	taskkill.exe
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	464	taskkill.exe
Token: SeDebugPrivilege	3444	taskkill.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeDebugPrivilege	6036	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1816	FN.Rage_loader.exe
1816	FN.Rage_loader.exe
5812	icsys.icn.exe
5812	icsys.icn.exe
5052	explorer.exe
5052	explorer.exe
720	spoolsv.exe
720	spoolsv.exe
4376	svchost.exe
4376	svchost.exe
292	spoolsv.exe
292	spoolsv.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2312	1816	FN.Rage_loader.exe	89
PID 1816 wrote to memory of 5812	1816	FN.Rage_loader.exe	91
PID 5812 wrote to memory of 5052	5812	icsys.icn.exe	92
PID 2312 wrote to memory of 932	2312	fn.rage_loader.exe	93
PID 2312 wrote to memory of 2932	2312	fn.rage_loader.exe	94
PID 5052 wrote to memory of 720	5052	explorer.exe	95
PID 2932 wrote to memory of 5988	2932	cmd.exe	96
PID 720 wrote to memory of 4376	720	spoolsv.exe	97
PID 4376 wrote to memory of 292	4376	svchost.exe	99
PID 2312 wrote to memory of 5692	2312	fn.rage_loader.exe	100
PID 5692 wrote to memory of 4364	5692	cmd.exe	101
PID 2312 wrote to memory of 5356	2312	fn.rage_loader.exe	104
PID 5356 wrote to memory of 6000	5356	cmd.exe	105
PID 2312 wrote to memory of 5892	2312	fn.rage_loader.exe	106
PID 2312 wrote to memory of 5188	2312	fn.rage_loader.exe	107
PID 2312 wrote to memory of 5764	2312	fn.rage_loader.exe	108
PID 2312 wrote to memory of 4380	2312	fn.rage_loader.exe	109
PID 2312 wrote to memory of 4744	2312	fn.rage_loader.exe	110
PID 2312 wrote to memory of 1200	2312	fn.rage_loader.exe	111
PID 2312 wrote to memory of 2580	2312	fn.rage_loader.exe	112
PID 2312 wrote to memory of 3496	2312	fn.rage_loader.exe	113
PID 3496 wrote to memory of 3652	3496	cmd.exe	114
PID 5892 wrote to memory of 1576	5892	cmd.exe	115
PID 3496 wrote to memory of 3180	3496	cmd.exe	116
PID 4380 wrote to memory of 5316	4380	cmd.exe	117
PID 3496 wrote to memory of 3192	3496	cmd.exe	118
PID 5764 wrote to memory of 4328	5764	cmd.exe	119
PID 5188 wrote to memory of 4552	5188	cmd.exe	121
PID 4744 wrote to memory of 4748	4744	cmd.exe	120
PID 1200 wrote to memory of 2100	1200	cmd.exe	122
PID 2312 wrote to memory of 5192	2312	fn.rage_loader.exe	123
PID 2312 wrote to memory of 3836	2312	fn.rage_loader.exe	124
PID 2312 wrote to memory of 3360	2312	fn.rage_loader.exe	125
PID 2312 wrote to memory of 612	2312	fn.rage_loader.exe	126
PID 2312 wrote to memory of 3004	2312	fn.rage_loader.exe	127
PID 2312 wrote to memory of 468	2312	fn.rage_loader.exe	128
PID 3004 wrote to memory of 2380	3004	cmd.exe	129
PID 3836 wrote to memory of 952	3836	cmd.exe	130
PID 3360 wrote to memory of 1912	3360	cmd.exe	131
PID 5192 wrote to memory of 2740	5192	cmd.exe	132
PID 612 wrote to memory of 4548	612	cmd.exe	133
PID 2312 wrote to memory of 1384	2312	fn.rage_loader.exe	134
PID 2312 wrote to memory of 1896	2312	fn.rage_loader.exe	135
PID 2312 wrote to memory of 3236	2312	fn.rage_loader.exe	136
PID 2312 wrote to memory of 2908	2312	fn.rage_loader.exe	137
PID 2312 wrote to memory of 5956	2312	fn.rage_loader.exe	138
PID 2312 wrote to memory of 1712	2312	fn.rage_loader.exe	139
PID 2312 wrote to memory of 2444	2312	fn.rage_loader.exe	140
PID 2312 wrote to memory of 3188	2312	fn.rage_loader.exe	141
PID 1384 wrote to memory of 1768	1384	cmd.exe	142
PID 1712 wrote to memory of 2276	1712	cmd.exe	143
PID 1896 wrote to memory of 6036	1896	cmd.exe	144
PID 3236 wrote to memory of 3444	3236	cmd.exe	145
PID 2908 wrote to memory of 464	2908	cmd.exe	146
PID 5956 wrote to memory of 6112	5956	cmd.exe	147
PID 2312 wrote to memory of 896	2312	fn.rage_loader.exe	148
PID 896 wrote to memory of 4992	896	cmd.exe	149

C:\Users\Admin\AppData\Local\Temp\FN.Rage_loader.exe
"C:\Users\Admin\AppData\Local\Temp\FN.Rage_loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- \??\c:\users\admin\appdata\local\temp\fn.rage_loader.exe
  c:\users\admin\appdata\local\temp\fn.rage_loader.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color 05
    3⤵
    - Executes a command shell one-liner
    PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5356
  - - C:\Windows\system32\sc.exe
      sc stop HTTPDebuggerPro
      4⤵
      Launches sc.exe
      PID:6000
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1576
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4328
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5316
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\system32\sc.exe
      sc stop HTTPDebuggerPro
      4⤵
      Launches sc.exe
      PID:4748
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM HTTPDebuggerSvc.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2100
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "c:\users\admin\appdata\local\temp\fn.rage_loader.exe " MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "c:\users\admin\appdata\local\temp\fn.rage_loader.exe " MD5
      4⤵
      PID:3652
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:3180
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:3192
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2740
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1912
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\system32\sc.exe
      sc stop HTTPDebuggerPro
      4⤵
      Launches sc.exe
      PID:4548
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM HTTPDebuggerSvc.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1768
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:464
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\Windows\system32\sc.exe
      sc stop HTTPDebuggerPro
      4⤵
      Launches sc.exe
      PID:6112
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM HTTPDebuggerSvc.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2276
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4992
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5812
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:720
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

fn.rage_loader.exe

Path C:\Users\Admin\AppData\Local\Temp\fn.rage_loader.exe
Size 1002KB
SHA256 5c9cbf648182a03b1780f64dcf5ccda371dd45dc919f92cdf005891fd106aa08
MD5 95d118171a35a7817bc2a61a89de9364
SHA1 ee7d04697b094c88f54e3fa9241e8403745fb774
SHA512 52c1d78dbe30f9bf90c653cae99876251e4acd9579a5290bca2d9acdb6687cb0a6059fb80aed73cd4e9c76614906683ab666501aea320d650dd527b7c14796d3
SSDEEP 24576:0HZBi99Ck2EEW9pmjIaHNx56wTxNqnNuGKFuesdQEB3:0Gqk2RfH77cn3GEB3
TLSH
T14725AD4662E801E9D57BD078C567E317F7B6704813209BDB47E0CA692F63BE06EBA311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 28adac0b847e5173dab227bcf53588b86c02f8f080118280adce012b3ae56246
MD5 299d46da88dd5c0f6156b585cbdcac08
SHA1 527e89dd6d86a7da7e368164ef36858794f92f58
SHA512 f38b4f4cd6081379f6fd7aeeea9486d944b0725a51f4af61bae7fbd1dcc0b38b264a4c8f6bb773509d21de48660931f9fce695fe16a216e1685c01511ce56246
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalJ:UVqoCl/YgjxEufVU0TbTyDDalQlJ
TLSH
T151D3F913EE506C7AD912C9F17CA1DB6EBA155E390BA05D0372A2FB112A72103B6F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 185aebcfc1b64e9befe3c6e93309437f9d4ea179d30615d161fdf16b672c9f37
MD5 a3d4f1fec06a8fe9f822b84d1725fb2b
SHA1 c38f3cd31dc9054f8f25f8854f2a673d0a000fbc
SHA512 a0ec253a032e3ea57581fd17dc54177326f030165eec245e8167c2a81fca7320c2fe723ee83200f5b5b7a6228ecee7b066b24302ca540f9646b4fc21e07016f9
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalJ:UVqoCl/YgjxEufVU0TbTyDDalQlJ
TLSH
T121D30833BE505D3FD912C5F16CA4C7AAB9265E3A1FD2AD1B22A2B700257510376F122F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 da0e42f132695ca0aae0bb9d1ae82da64bcd82bbe0efbb661c09580e750cdab7
MD5 9822b816a75d0f3f70ffe7231be6e20e
SHA1 db52b883667c019a27ec3986f4224f82da29aed0
SHA512 c75b2c516616b3c1c95ab99aa21ed14eb0c41c119c58c32d56e7ca7e14fd748d5f468908c54e66d5f90f6c26a518a778d408a29d4a347baf21cfaae10f2724f2
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalQl144444444444444444444444444444444444v:UsLqdufVUNDak4444444444444444448
TLSH
T19FD30A23BE249C3ED53189F078A5EA6AFE115E361FA0AC077356BB0425B150772F924F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 d2a985d6bf1b9e4e39398d691b5838ed5198e9d6a3fb6d380e94a747e4f87453
MD5 0a657a71e3bdfe1444ff1aab85adb3e4
SHA1 ffb4b58c4da468c3acdbd2a1aab925ac49868ddc
SHA512 ef27226a8350b2ea766b42f1d942fbbb32f08faf4e316d231e931dc4ed1afe91041c2a6475155b6d48cb762bc8ad558e7e114c30ecb03d56eea92ee7deabc3d6
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalQlKdddddddddddddddddddddddddddddddddddX:UsLqdufVUNDa3
TLSH
T13BD3D827BA14AC3FC85189F478B9E65EB6225F6517D06E2B7293FB112AB110371F420F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/292-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/464-65-0x00000226A79E0000-0x00000226A7C21000-memory.dmp

Download

memory/720-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/952-59-0x000001F1A80A0000-0x000001F1A82E1000-memory.dmp

Download

memory/1576-54-0x0000015F20400000-0x0000015F20641000-memory.dmp

Download

memory/1768-67-0x00000223B2A60000-0x00000223B2CA1000-memory.dmp

Download

memory/1816-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1816-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1912-62-0x0000029260AE0000-0x0000029260D21000-memory.dmp

Download

memory/2100-58-0x00000290BC020000-0x00000290BC261000-memory.dmp

Download

memory/2276-63-0x000001E700F00000-0x000001E701141000-memory.dmp

Download

memory/2380-60-0x000002B000DF0000-0x000002B001031000-memory.dmp

Download

memory/2740-61-0x000002BDC0E40000-0x000002BDC1081000-memory.dmp

Download

memory/3444-64-0x00000264E1BE0000-0x00000264E1E21000-memory.dmp

Download

memory/4328-57-0x000001BA18B50000-0x000001BA18D91000-memory.dmp

Download

memory/4364-53-0x000001FC94050000-0x000001FC94291000-memory.dmp

Download

memory/4552-56-0x000001CCBD700000-0x000001CCBD941000-memory.dmp

Download

memory/4992-68-0x000001F2AB760000-0x000001F2AB9A1000-memory.dmp

Download

memory/5316-55-0x00000238FEE80000-0x00000238FF0C1000-memory.dmp

Download

memory/5812-51-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5988-52-0x00000225BE5B0000-0x00000225BE7F1000-memory.dmp

Download

memory/6036-66-0x0000017F19370000-0x0000017F195B1000-memory.dmp

Download