dharma | 8d6a931a8e8a65cf3a98fc2ee69ded2bd91ee03ef6677c6f653561dd4742ce17

Analysis

max time kernel
40s
max time network
142s
platform
windows10_x64
resource
win10v200722
submitted
27/08/2020, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2020-08-16_12-33-29.bin.exe
Size

182KB
MD5

31293dfcacc8dc2e1e0daca8ad83ffe4
SHA1

49d99d21ee7070f9923e53247dff9359cef66e56
SHA256

8d6a931a8e8a65cf3a98fc2ee69ded2bd91ee03ef6677c6f653561dd4742ce17
SHA512

962605b126e84500a0039b6ddcc2dd6686c942e2aa762d09ab49f97200812721c837770e116f5cb0477ce6ce145529830ef6cfafadb311944c28d388a3ee68dc

Score

10^/10

dharma smokeloader vidar backdoor persistence ransomware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://rexstat35x.xyz/statweb955/

http://dexspot2x.xyz/statweb955/

http://atxspot20x.xyz/statweb955/

http://rexspot7x.xyz/statweb955/

http://fdmail85.club/statweb955/

http://servicem977x.xyz/statweb955/

http://advertxman7x.xyz/statweb955/

http://starxpush7x.xyz/statweb955/

rc4.i32

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 6 IoCs

pid	Process
1744	D77A.exe
3304	D894.exe
3668	DF7B.exe
3360	E17F.exe
688	E326.exe
812	EEB0.exe

Deletes itself 1 IoCs

pid	Process
3044	Process not Found

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\D77A.exe	D77A.exe

Loads dropped DLL 1 IoCs

pid	Process
2408	2020-08-16_12-33-29.bin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\D77A.exe = "C:\\Windows\\System32\\D77A.exe"	D77A.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\desktop.ini	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	D77A.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1400429095-533421673-2598934218-1000\desktop.ini	D77A.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	D77A.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	api.ipify.org
43	api.ipify.org
61	ip-api.com

Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\D77A.exe	D77A.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3952 set thread context of 2408	3952	2020-08-16_12-33-29.bin.exe	72

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jfxmedia.dll	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\LICENSE.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-dialogs.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar	D77A.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\PREVIEW.GIF.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\j2pcsc.dll.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaTypewriterBold.ttf.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\sound.properties	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\core_ja.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-white_scale-200.png	D77A.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\management\jmxremote.password.template	D77A.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.bat.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	D77A.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\jfxmedia.dll.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileLargeSquare.scale-100.png	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\PREVIEW.GIF.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\LICENSE	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ko_KR.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jli.dll.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png	D77A.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.TXT.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\hprof.dll	D77A.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jsdt.dll	D77A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-150.png	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfontj2d.properties.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-black_scale-125.png	D77A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-100_contrast-white.png	D77A.exe
File created	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-file-l1-2-0.dll.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll	D77A.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	D77A.exe
File opened for modification	C:\Program Files\RevokeUse.css	D77A.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\SmallTile.scale-125.png	D77A.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200_contrast-white.png	D77A.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar	D77A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconEditMoment.scale-100.png	D77A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.id-53880B73.[telegram_@spacedatax].ROGER	D77A.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2020-08-16_12-33-29.bin.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2020-08-16_12-33-29.bin.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2020-08-16_12-33-29.bin.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
192	vssadmin.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = a2ae91889a7cd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2408	2020-08-16_12-33-29.bin.exe
2408	2020-08-16_12-33-29.bin.exe
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found

Suspicious behavior: MapViewOfSection 13 IoCs

pid	Process
2408	2020-08-16_12-33-29.bin.exe
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2188	svchost.exe
Token: SeCreatePagefilePrivilege	2188	svchost.exe
Token: SeBackupPrivilege	2784	vssvc.exe
Token: SeRestorePrivilege	2784	vssvc.exe
Token: SeAuditPrivilege	2784	vssvc.exe
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2408	3952	2020-08-16_12-33-29.bin.exe	72
PID 3952 wrote to memory of 2408	3952	2020-08-16_12-33-29.bin.exe	72
PID 3952 wrote to memory of 2408	3952	2020-08-16_12-33-29.bin.exe	72
PID 3952 wrote to memory of 2408	3952	2020-08-16_12-33-29.bin.exe	72
PID 3952 wrote to memory of 2408	3952	2020-08-16_12-33-29.bin.exe	72
PID 3952 wrote to memory of 2408	3952	2020-08-16_12-33-29.bin.exe	72
PID 3044 wrote to memory of 1744	3044	Process not Found	76
PID 3044 wrote to memory of 1744	3044	Process not Found	76
PID 3044 wrote to memory of 1744	3044	Process not Found	76
PID 3044 wrote to memory of 3304	3044	Process not Found	77
PID 3044 wrote to memory of 3304	3044	Process not Found	77
PID 3044 wrote to memory of 3304	3044	Process not Found	77
PID 1744 wrote to memory of 1588	1744	D77A.exe	78
PID 1744 wrote to memory of 1588	1744	D77A.exe	78
PID 1588 wrote to memory of 2544	1588	cmd.exe	80
PID 1588 wrote to memory of 2544	1588	cmd.exe	80
PID 1588 wrote to memory of 192	1588	cmd.exe	81
PID 1588 wrote to memory of 192	1588	cmd.exe	81
PID 3044 wrote to memory of 3668	3044	Process not Found	84
PID 3044 wrote to memory of 3668	3044	Process not Found	84
PID 3044 wrote to memory of 3360	3044	Process not Found	85
PID 3044 wrote to memory of 3360	3044	Process not Found	85
PID 3044 wrote to memory of 3360	3044	Process not Found	85
PID 3044 wrote to memory of 688	3044	Process not Found	86
PID 3044 wrote to memory of 688	3044	Process not Found	86
PID 3044 wrote to memory of 688	3044	Process not Found	86
PID 3044 wrote to memory of 812	3044	Process not Found	87
PID 3044 wrote to memory of 812	3044	Process not Found	87
PID 3044 wrote to memory of 812	3044	Process not Found	87
PID 3044 wrote to memory of 3772	3044	Process not Found	88
PID 3044 wrote to memory of 3772	3044	Process not Found	88
PID 3044 wrote to memory of 3772	3044	Process not Found	88
PID 3044 wrote to memory of 3772	3044	Process not Found	88
PID 3044 wrote to memory of 2636	3044	Process not Found	89
PID 3044 wrote to memory of 2636	3044	Process not Found	89
PID 3044 wrote to memory of 2636	3044	Process not Found	89
PID 3044 wrote to memory of 3944	3044	Process not Found	90
PID 3044 wrote to memory of 3944	3044	Process not Found	90
PID 3044 wrote to memory of 3944	3044	Process not Found	90
PID 3044 wrote to memory of 3944	3044	Process not Found	90
PID 3044 wrote to memory of 3224	3044	Process not Found	91
PID 3044 wrote to memory of 3224	3044	Process not Found	91
PID 3044 wrote to memory of 3224	3044	Process not Found	91
PID 3044 wrote to memory of 3224	3044	Process not Found	91
PID 3044 wrote to memory of 2892	3044	Process not Found	92
PID 3044 wrote to memory of 2892	3044	Process not Found	92
PID 3044 wrote to memory of 2892	3044	Process not Found	92
PID 3044 wrote to memory of 2892	3044	Process not Found	92
PID 3044 wrote to memory of 2120	3044	Process not Found	93
PID 3044 wrote to memory of 2120	3044	Process not Found	93
PID 3044 wrote to memory of 2120	3044	Process not Found	93
PID 812 wrote to memory of 4076	812	EEB0.exe	94
PID 812 wrote to memory of 4076	812	EEB0.exe	94
PID 812 wrote to memory of 4076	812	EEB0.exe	94

C:\Users\Admin\AppData\Local\Temp\2020-08-16_12-33-29.bin.exe
"C:\Users\Admin\AppData\Local\Temp\2020-08-16_12-33-29.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\2020-08-16_12-33-29.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\2020-08-16_12-33-29.bin.exe"
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Users\Admin\AppData\Local\Temp\D77A.exe
C:\Users\Admin\AppData\Local\Temp\D77A.exe
1⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:2544
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:192

C:\Users\Admin\AppData\Local\Temp\D894.exe
C:\Users\Admin\AppData\Local\Temp\D894.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Users\Admin\AppData\Local\Temp\DF7B.exe
C:\Users\Admin\AppData\Local\Temp\DF7B.exe
1⤵
- Executes dropped EXE
PID:3668

C:\Users\Admin\AppData\Local\Temp\E17F.exe
C:\Users\Admin\AppData\Local\Temp\E17F.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Users\Admin\AppData\Local\Temp\E326.exe
C:\Users\Admin\AppData\Local\Temp\E326.exe
1⤵
- Executes dropped EXE
PID:688

C:\Users\Admin\AppData\Local\Temp\EEB0.exe
C:\Users\Admin\AppData\Local\Temp\EEB0.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\swap.cmd" "
  2⤵
  PID:4076

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3772

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2636

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3944

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3224

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2892

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Connection Proxy

T1090

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Connection Proxy

T1090

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/688-29-0x0000000003643000-0x0000000003644000-memory.dmp

Filesize
4KB

Download
memory/688-30-0x0000000003930000-0x0000000003931000-memory.dmp

Filesize
4KB

Download
memory/1744-13-0x0000000003393000-0x0000000003394000-memory.dmp

Filesize
4KB

Download
memory/1744-14-0x00000000037E0000-0x00000000037E1000-memory.dmp

Filesize
4KB

Download
memory/2120-145-0x0000000000CC0000-0x0000000000CC9000-memory.dmp

Filesize
36KB

Download
memory/2120-142-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

Filesize
56KB

Download
memory/2408-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2636-42-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

Filesize
48KB

Download
memory/2636-44-0x0000000000DC0000-0x0000000000DC7000-memory.dmp

Filesize
28KB

Download
memory/2892-112-0x0000000000310000-0x000000000031B000-memory.dmp

Filesize
44KB

Download
memory/2892-114-0x0000000000320000-0x0000000000327000-memory.dmp

Filesize
28KB

Download
memory/3044-64-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-84-0x0000000001030000-0x0000000001034000-memory.dmp

Filesize
16KB

Download
memory/3044-43-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-39-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-45-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-46-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-47-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-36-0x0000000000BC0000-0x0000000000BCC000-memory.dmp

Filesize
48KB

Download
memory/3044-50-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-49-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-51-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-52-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-53-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-54-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-56-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-155-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-58-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-60-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-61-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-62-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-152-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-63-0x0000000001030000-0x0000000001034000-memory.dmp

Filesize
16KB

Download
memory/3044-66-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-6-0x0000000000B90000-0x0000000000BA6000-memory.dmp

Filesize
88KB

Download
memory/3044-67-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-147-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-69-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-71-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-72-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-73-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-74-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-75-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-76-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-77-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-78-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-79-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-81-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-82-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-83-0x0000000001030000-0x0000000001034000-memory.dmp

Filesize
16KB

Download
memory/3044-41-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-85-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-144-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-87-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-88-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-89-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-140-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-137-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-93-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-95-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-97-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-104-0x0000000001030000-0x0000000001034000-memory.dmp

Filesize
16KB

Download
memory/3044-102-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-105-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-33-0x0000000005640000-0x00000000056B5000-memory.dmp

Filesize
468KB

Download
memory/3044-108-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-110-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-130-0x0000000001030000-0x0000000001034000-memory.dmp

Filesize
16KB

Download
memory/3044-132-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-116-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-118-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-121-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-125-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3044-128-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

Filesize
28KB

Download
memory/3224-92-0x0000000000F70000-0x0000000000F7A000-memory.dmp

Filesize
40KB

Download
memory/3224-90-0x0000000000F60000-0x0000000000F6B000-memory.dmp

Filesize
44KB

Download
memory/3304-18-0x0000000003890000-0x0000000003891000-memory.dmp

Filesize
4KB

Download
memory/3772-57-0x0000000001020000-0x000000000108B000-memory.dmp

Filesize
428KB

Download
memory/3944-68-0x00000000004D0000-0x00000000004D9000-memory.dmp

Filesize
36KB

Download
memory/3952-1-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/3952-0-0x000000000351C000-0x000000000351D000-memory.dmp

Filesize
4KB

Download
memory/3952-2-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download