Resubmissions
09/09/2020, 09:18
200909-ev13telmdn1008/09/2020, 17:08
200908-br2a8ynnpn1008/09/2020, 17:07
200908-2bbw72ekmn1008/09/2020, 16:54
200908-qgbye23mhs1008/09/2020, 16:46
200908-p5f4c5cdzj10Analysis
- max time kernel
151s - max time network
133s - platform
windows7_x64 - resource
win7 - submitted
08/09/2020, 17:08
Static task
static1
Behavioral task
behavioral1
Sample
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
- Size 154KB
- Sample200908-br2a8ynnpn
- SHA256 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b
- MD5 91879bdd73625ac38c31fe5225310e92
- SHA1 a007b979483ee6b57b93a11340932a60f5781570
- SHA512 22678f18385ed177ed34cac52fc8667c6d6cdc2953b1818a6e530411894aa6947b04408320137af8ebd5b1d6d733f374a1d962608e0e6c234e5a43b89fe9de3c
- MD5 SHA1 SHA512
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
-
raccoon
Ransom Note
- [Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Mon Jul 6 14:33:03 2020 Launched at: 2020.09.08 - 17:07:32 GMT Bot_ID: BAE8C589-5DA1-4C62-BE46-F8D74908CB8C_Admin Running on a desktop =R=A=C=C=O=O=N= - Cookies: 0 - Passwords: 0 - Files: 0 System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.51 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: AVGLFESB - Username: Admin - Windows version: NT 6.1 - Product name: Windows 7 Professional - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 2047 MB (420 MB used) - Screen resolution: 1280x720 - Display devices: 0) Standard VGA Graphics Adapter ============
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://dkajsdjiqwdwnfj.info/
-
http://2831ujedkdajsdj.info/
-
http://928eijdksasnfss.info/
-
https://dkajsdjiqwdwnfj.info/
-
https://2831ujedkdajsdj.info/
-
https://928eijdksasnfss.info/
rc4.i32
rc4.i32
Extracted
Family
-
zloader
Botnet
-
DLLobnova
Campaign
-
02.09.2020
C2
-
https://fsakfkdsajdajskjajs.online/gate.php
-
https://fdsadjsadsdsa.online/gate.php
-
https://dlsafoslfskfsafad.online/gate.php
-
https://dsofkasfsakdsdsa.online/gate.php
-
https://dkjsjdsjdjasduiasida.online/gate.php
-
https://fqnvtmqsywublocpheas.ru/gate.php
-
https://fqnvtmqsywublocpheas.su/gate.php
-
https://fqnvtmqsywublocpheas.eu/gate.php
-
https://fqnvtmqsywublocpheas.net/gate.php
-
https://fqnvtmqsywublodscpheas.com/gate.php
rc4.plain
rsa_pubkey.plain
Signatures
- Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
yara_rule raccoon_log_file - SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 1908 BA2C.exe - Deletes itself 1 IoCs
pid Process 1312 Process not Found - Loads dropped DLL 10 IoCs
pid Process 1080 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 1872 regsvr32.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- JavaScript code in executable 1 IoCs
resource yara_rule behavioral1/files/0x000300000001321b-15.dat js - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1068 timeout.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 BA2C.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 BA2C.exe - Suspicious behavior: EnumeratesProcesses 770 IoCs
pid Process 1080 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 1080 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1080 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1312 Process not Found 1312 Process not Found 1312 Process not Found 1312 Process not Found - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1624 1312 Process not Found 28 PID 1312 wrote to memory of 1624 1312 Process not Found 28 PID 1312 wrote to memory of 1624 1312 Process not Found 28 PID 1312 wrote to memory of 1624 1312 Process not Found 28 PID 1312 wrote to memory of 1624 1312 Process not Found 28 PID 1624 wrote to memory of 1872 1624 regsvr32.exe 29 PID 1624 wrote to memory of 1872 1624 regsvr32.exe 29 PID 1624 wrote to memory of 1872 1624 regsvr32.exe 29 PID 1624 wrote to memory of 1872 1624 regsvr32.exe 29 PID 1624 wrote to memory of 1872 1624 regsvr32.exe 29 PID 1624 wrote to memory of 1872 1624 regsvr32.exe 29 PID 1624 wrote to memory of 1872 1624 regsvr32.exe 29 PID 1312 wrote to memory of 1908 1312 Process not Found 30 PID 1312 wrote to memory of 1908 1312 Process not Found 30 PID 1312 wrote to memory of 1908 1312 Process not Found 30 PID 1312 wrote to memory of 1908 1312 Process not Found 30 PID 1908 wrote to memory of 512 1908 BA2C.exe 33 PID 1908 wrote to memory of 512 1908 BA2C.exe 33 PID 1908 wrote to memory of 512 1908 BA2C.exe 33 PID 1908 wrote to memory of 512 1908 BA2C.exe 33 PID 512 wrote to memory of 1068 512 cmd.exe 35 PID 512 wrote to memory of 1068 512 cmd.exe 35 PID 512 wrote to memory of 1068 512 cmd.exe 35 PID 512 wrote to memory of 1068 512 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe"C:\Users\Admin\AppData\Local\Temp\23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1080
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\B941.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\B941.dll2⤵
- Loads dropped DLL
PID:1872
-
-
C:\Users\Admin\AppData\Local\Temp\BA2C.exeC:\Users\Admin\AppData\Local\Temp\BA2C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\BA2C.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1068
-
-