Analysis
- max time kernel
98s - max time network
123s - platform
windows7_x64 - resource
win7 - submitted
25/06/2020, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe
- Size 7.9MB
- Sample200625-n58nwalyvx
- SHA256 aeb1bfcef382789091e72e2d6cae6e471123d0e8e7a5f39c64abf5a3d9a4eaa8
- MD5 78632f99e8fd64fca5e8cf7ae613c674
- SHA1 91ec27976c60b44a9807bf713ef97ad3ad92dd1b
- SHA512 921b58d21fbef6484cb79d3b8cc5cdefd88f53317f9a1f9b667512b8ae09d7cea69bed20440b0887e38f1228b06f174b5cc5be927db99f51bf9f13daa45a3b64
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
danabot
C2
-
92.204.160.126
-
37.120.145.243
-
195.133.147.230
-
185.227.138.52
rsa_pubkey.plain
Signatures
- Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
resource yara_rule behavioral1/files/0x00060000000131cd-56.dat family_danabot behavioral1/files/0x00060000000131cd-57.dat family_danabot behavioral1/files/0x00060000000131cd-61.dat family_danabot behavioral1/files/0x00060000000131cd-62.dat family_danabot behavioral1/files/0x00060000000131cd-63.dat family_danabot behavioral1/files/0x00060000000131cd-64.dat family_danabot - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Blocklisted process makes network request 10 IoCs
flow pid Process 37 596 rundll32.exe 38 596 rundll32.exe 39 596 rundll32.exe 40 596 rundll32.exe 41 596 rundll32.exe 42 596 rundll32.exe 43 596 rundll32.exe 44 596 rundll32.exe 45 596 rundll32.exe 46 596 rundll32.exe - Executes dropped EXE 6 IoCs
pid Process 1620 1_protected.exe 1532 2_protected.exe 1860 dfgdfg.exe 536 trhgdf.exe 1536 rthgf.exe 1476 SmartClock.exe -
resource yara_rule behavioral1/files/0x00050000000131d6-89.dat vmprotect behavioral1/files/0x00050000000131d6-91.dat vmprotect behavioral1/files/0x00050000000131d6-93.dat vmprotect behavioral1/files/0x00050000000131d9-94.dat vmprotect behavioral1/files/0x00050000000131d9-96.dat vmprotect behavioral1/files/0x00050000000131d9-98.dat vmprotect behavioral1/files/0x00050000000131d9-100.dat vmprotect - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion trhgdf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion trhgdf.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk rthgf.exe - Loads dropped DLL 13 IoCs
pid Process 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 752 regsvr32.exe 596 rundll32.exe 596 rundll32.exe 596 rundll32.exe 596 rundll32.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1536 rthgf.exe 1536 rthgf.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x00040000000131cc-66.dat themida behavioral1/files/0x00040000000131cc-68.dat themida behavioral1/files/0x00040000000131cc-70.dat themida - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA trhgdf.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip-api.com 9 ip-api.com - Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1620 1_protected.exe 1532 2_protected.exe 1620 1_protected.exe 1532 2_protected.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 536 trhgdf.exe 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2_protected.exe - Delays execution with timeout.exe 4 IoCs
pid Process 860 timeout.exe 1768 timeout.exe 1676 timeout.exe 2024 timeout.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1476 SmartClock.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1536 rthgf.exe 1476 SmartClock.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1620 1_protected.exe 1532 2_protected.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 1620 1_protected.exe 1532 2_protected.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1420 wrote to memory of 1620 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 24 PID 1420 wrote to memory of 1620 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 24 PID 1420 wrote to memory of 1620 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 24 PID 1420 wrote to memory of 1620 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 24 PID 1420 wrote to memory of 1620 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 24 PID 1420 wrote to memory of 1620 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 24 PID 1420 wrote to memory of 1620 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 24 PID 1420 wrote to memory of 1532 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 25 PID 1420 wrote to memory of 1532 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 25 PID 1420 wrote to memory of 1532 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 25 PID 1420 wrote to memory of 1532 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 25 PID 1420 wrote to memory of 1532 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 25 PID 1420 wrote to memory of 1532 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 25 PID 1420 wrote to memory of 1532 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 25 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1620 wrote to memory of 1972 1620 1_protected.exe 28 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1972 wrote to memory of 2024 1972 cmd.exe 30 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1532 wrote to memory of 1496 1532 2_protected.exe 31 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1496 wrote to memory of 860 1496 cmd.exe 33 PID 1420 wrote to memory of 1860 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 34 PID 1420 wrote to memory of 1860 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 34 PID 1420 wrote to memory of 1860 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 34 PID 1420 wrote to memory of 1860 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 34 PID 1420 wrote to memory of 1860 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 34 PID 1420 wrote to memory of 1860 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 34 PID 1420 wrote to memory of 1860 1420 SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe 34 PID 1860 wrote to memory of 752 1860 dfgdfg.exe 36 PID 1860 wrote to memory of 752 1860 dfgdfg.exe 36 PID 1860 wrote to memory of 752 1860 dfgdfg.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Packed.Enigma.EY.4634.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\ProgramData\sde\1_protected.exeC:\ProgramData\sde\1_protected.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\ProgramData\EIKf23RV & timeout 2 & del /f /q "C:\ProgramData\sde\1_protected.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
PID:2024
-
-
-
-
C:\ProgramData\sde\2_protected.exeC:\ProgramData\sde\2_protected.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\ProgramData\NUpU62jUB & timeout 3 & del /f /q "C:\ProgramData\sde\2_protected.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:860
-
-
-
-
C:\Users\Admin\AppData\Roaming\dfgdfg.exedfgdfg.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\dfgdfg.dll f1 C:\Users\Admin\AppData\Roaming\dfgdfg.exe@18603⤵
- Loads dropped DLL
PID:752 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\dfgdfg.dll,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:596
-
-
-
-
C:\Users\Admin\AppData\Roaming\trhgdf.exetrhgdf.exe2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:536 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\ProgramData\vuyahxnmkkwag & timeout 2 & del /f /q "C:\Users\Admin\AppData\Roaming\trhgdf.exe"3⤵PID:1220
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
PID:1768
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\ProgramData\vuyahxnmkkwag & timeout 2 & del /f /q "C:\Users\Admin\AppData\Roaming\trhgdf.exe"3⤵PID:332
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
PID:1676
-
-
-
-
C:\Users\Admin\AppData\Roaming\rthgf.exerthgf.exe2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:1476
-
-