Analysis
-
max time kernel
70s -
max time network
152s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
13-10-2020 16:53
Static task
static1
Behavioral task
behavioral1
Sample
ed94a35c782570966aa8a65993925359.exe
Resource
win7v200722
General
-
Target
ed94a35c782570966aa8a65993925359.exe
-
Size
1.0MB
-
MD5
ed94a35c782570966aa8a65993925359
-
SHA1
9735c0c4cd4c9df7ed4e42820c9d64dd818ec982
-
SHA256
4be1e912f4b6f65dd938f0a6fa1f1d9b8d4c20fc25ac3c3189e10013c29e4dea
-
SHA512
05e5bb9ff256ccde8b341d0c265a6d6367eb1a5e459c62a5dde059b8b9947093602a162b45c2e6715277d0850f7a83d95f6510eb4a19ce36b85830e2ea2029c6
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/2176-117-0x00000000018B0000-0x00000000018B5000-memory.dmp disable_win_def C:\Windows\Temp\q4josjac.exe disable_win_def C:\Windows\temp\q4josjac.exe disable_win_def -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
ModiLoader First Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3440-182-0x00000000028D0000-0x00000000028DF000-memory.dmp modiloader_stage1 -
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
Limos.exeLimos.exeLa.exeLa.exeUgzQwLUb4F.exeMcXHU0pL1D.exe8yVXg0rpTL.exeKOM6chIsRD.exeUgzQwLUb4F.exeUgzQwLUb4F.exe8yVXg0rpTL.exeKOM6chIsRD.exeq4josjac.exepid process 492 Limos.exe 204 Limos.exe 2900 La.exe 3672 La.exe 3004 UgzQwLUb4F.exe 3440 McXHU0pL1D.exe 196 8yVXg0rpTL.exe 1172 KOM6chIsRD.exe 3452 UgzQwLUb4F.exe 68 UgzQwLUb4F.exe 2176 8yVXg0rpTL.exe 1776 KOM6chIsRD.exe 3904 q4josjac.exe -
Loads dropped DLL 9 IoCs
Processes:
Limos.exeed94a35c782570966aa8a65993925359.exepid process 204 Limos.exe 204 Limos.exe 204 Limos.exe 3820 ed94a35c782570966aa8a65993925359.exe 3820 ed94a35c782570966aa8a65993925359.exe 3820 ed94a35c782570966aa8a65993925359.exe 3820 ed94a35c782570966aa8a65993925359.exe 3820 ed94a35c782570966aa8a65993925359.exe 3820 ed94a35c782570966aa8a65993925359.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
KOM6chIsRD.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features KOM6chIsRD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" KOM6chIsRD.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
Processes:
ed94a35c782570966aa8a65993925359.exedescription ioc process File created C:\Users\Admin\AppData\LocalLow\FLesFFxEsEs\desktop.ini ed94a35c782570966aa8a65993925359.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
ed94a35c782570966aa8a65993925359.exeLimos.exeLa.exeUgzQwLUb4F.exe8yVXg0rpTL.exeKOM6chIsRD.exedescription pid process target process PID 3816 set thread context of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 492 set thread context of 204 492 Limos.exe Limos.exe PID 2900 set thread context of 3672 2900 La.exe La.exe PID 3004 set thread context of 68 3004 UgzQwLUb4F.exe UgzQwLUb4F.exe PID 196 set thread context of 2176 196 8yVXg0rpTL.exe 8yVXg0rpTL.exe PID 1172 set thread context of 1776 1172 KOM6chIsRD.exe KOM6chIsRD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Limos.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Limos.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3552 timeout.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 3900 taskkill.exe 2116 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
ed94a35c782570966aa8a65993925359.exeLimos.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings ed94a35c782570966aa8a65993925359.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings Limos.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
UgzQwLUb4F.exePowershell.exe8yVXg0rpTL.exepid process 3004 UgzQwLUb4F.exe 3004 UgzQwLUb4F.exe 2084 Powershell.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
ed94a35c782570966aa8a65993925359.exeLimos.exetaskkill.exeLa.exeUgzQwLUb4F.exe8yVXg0rpTL.exePowershell.exeKOM6chIsRD.exe8yVXg0rpTL.exepowershell.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3816 ed94a35c782570966aa8a65993925359.exe Token: SeDebugPrivilege 492 Limos.exe Token: SeDebugPrivilege 3900 taskkill.exe Token: SeDebugPrivilege 2900 La.exe Token: SeDebugPrivilege 3004 UgzQwLUb4F.exe Token: SeDebugPrivilege 196 8yVXg0rpTL.exe Token: SeDebugPrivilege 2084 Powershell.exe Token: SeDebugPrivilege 1172 KOM6chIsRD.exe Token: SeDebugPrivilege 2176 8yVXg0rpTL.exe Token: SeDebugPrivilege 3484 powershell.exe Token: SeDebugPrivilege 2116 taskkill.exe Token: SeDebugPrivilege 944 powershell.exe Token: SeIncreaseQuotaPrivilege 944 powershell.exe Token: SeSecurityPrivilege 944 powershell.exe Token: SeTakeOwnershipPrivilege 944 powershell.exe Token: SeLoadDriverPrivilege 944 powershell.exe Token: SeSystemProfilePrivilege 944 powershell.exe Token: SeSystemtimePrivilege 944 powershell.exe Token: SeProfSingleProcessPrivilege 944 powershell.exe Token: SeIncBasePriorityPrivilege 944 powershell.exe Token: SeCreatePagefilePrivilege 944 powershell.exe Token: SeBackupPrivilege 944 powershell.exe Token: SeRestorePrivilege 944 powershell.exe Token: SeShutdownPrivilege 944 powershell.exe Token: SeDebugPrivilege 944 powershell.exe Token: SeSystemEnvironmentPrivilege 944 powershell.exe Token: SeRemoteShutdownPrivilege 944 powershell.exe Token: SeUndockPrivilege 944 powershell.exe Token: SeManageVolumePrivilege 944 powershell.exe Token: 33 944 powershell.exe Token: 34 944 powershell.exe Token: 35 944 powershell.exe Token: 36 944 powershell.exe Token: SeDebugPrivilege 2328 powershell.exe Token: SeDebugPrivilege 3140 powershell.exe Token: SeDebugPrivilege 3012 powershell.exe Token: SeDebugPrivilege 1016 powershell.exe Token: SeDebugPrivilege 3728 powershell.exe Token: SeDebugPrivilege 472 powershell.exe Token: SeDebugPrivilege 4124 powershell.exe Token: SeDebugPrivilege 4212 powershell.exe Token: SeDebugPrivilege 4296 powershell.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeDebugPrivilege 4532 powershell.exe Token: SeDebugPrivilege 4632 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8yVXg0rpTL.exepid process 2176 8yVXg0rpTL.exe 2176 8yVXg0rpTL.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed94a35c782570966aa8a65993925359.exeWScript.exeLimos.exeWScript.exeLimos.execmd.exeLa.exeed94a35c782570966aa8a65993925359.execmd.exeUgzQwLUb4F.exedescription pid process target process PID 3816 wrote to memory of 3932 3816 ed94a35c782570966aa8a65993925359.exe WScript.exe PID 3816 wrote to memory of 3932 3816 ed94a35c782570966aa8a65993925359.exe WScript.exe PID 3816 wrote to memory of 3932 3816 ed94a35c782570966aa8a65993925359.exe WScript.exe PID 3816 wrote to memory of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 3816 wrote to memory of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 3816 wrote to memory of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 3816 wrote to memory of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 3816 wrote to memory of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 3816 wrote to memory of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 3816 wrote to memory of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 3816 wrote to memory of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 3816 wrote to memory of 3820 3816 ed94a35c782570966aa8a65993925359.exe ed94a35c782570966aa8a65993925359.exe PID 3932 wrote to memory of 492 3932 WScript.exe Limos.exe PID 3932 wrote to memory of 492 3932 WScript.exe Limos.exe PID 3932 wrote to memory of 492 3932 WScript.exe Limos.exe PID 492 wrote to memory of 2840 492 Limos.exe WScript.exe PID 492 wrote to memory of 2840 492 Limos.exe WScript.exe PID 492 wrote to memory of 2840 492 Limos.exe WScript.exe PID 492 wrote to memory of 204 492 Limos.exe Limos.exe PID 492 wrote to memory of 204 492 Limos.exe Limos.exe PID 492 wrote to memory of 204 492 Limos.exe Limos.exe PID 492 wrote to memory of 204 492 Limos.exe Limos.exe PID 492 wrote to memory of 204 492 Limos.exe Limos.exe PID 492 wrote to memory of 204 492 Limos.exe Limos.exe PID 492 wrote to memory of 204 492 Limos.exe Limos.exe PID 492 wrote to memory of 204 492 Limos.exe Limos.exe PID 492 wrote to memory of 204 492 Limos.exe Limos.exe PID 2840 wrote to memory of 2900 2840 WScript.exe La.exe PID 2840 wrote to memory of 2900 2840 WScript.exe La.exe PID 2840 wrote to memory of 2900 2840 WScript.exe La.exe PID 204 wrote to memory of 3080 204 Limos.exe cmd.exe PID 204 wrote to memory of 3080 204 Limos.exe cmd.exe PID 204 wrote to memory of 3080 204 Limos.exe cmd.exe PID 3080 wrote to memory of 3900 3080 cmd.exe taskkill.exe PID 3080 wrote to memory of 3900 3080 cmd.exe taskkill.exe PID 3080 wrote to memory of 3900 3080 cmd.exe taskkill.exe PID 2900 wrote to memory of 3672 2900 La.exe La.exe PID 2900 wrote to memory of 3672 2900 La.exe La.exe PID 2900 wrote to memory of 3672 2900 La.exe La.exe PID 2900 wrote to memory of 3672 2900 La.exe La.exe PID 2900 wrote to memory of 3672 2900 La.exe La.exe PID 2900 wrote to memory of 3672 2900 La.exe La.exe PID 2900 wrote to memory of 3672 2900 La.exe La.exe PID 2900 wrote to memory of 3672 2900 La.exe La.exe PID 2900 wrote to memory of 3672 2900 La.exe La.exe PID 3820 wrote to memory of 3004 3820 ed94a35c782570966aa8a65993925359.exe UgzQwLUb4F.exe PID 3820 wrote to memory of 3004 3820 ed94a35c782570966aa8a65993925359.exe UgzQwLUb4F.exe PID 3820 wrote to memory of 3004 3820 ed94a35c782570966aa8a65993925359.exe UgzQwLUb4F.exe PID 3820 wrote to memory of 3440 3820 ed94a35c782570966aa8a65993925359.exe McXHU0pL1D.exe PID 3820 wrote to memory of 3440 3820 ed94a35c782570966aa8a65993925359.exe McXHU0pL1D.exe PID 3820 wrote to memory of 3440 3820 ed94a35c782570966aa8a65993925359.exe McXHU0pL1D.exe PID 3820 wrote to memory of 196 3820 ed94a35c782570966aa8a65993925359.exe 8yVXg0rpTL.exe PID 3820 wrote to memory of 196 3820 ed94a35c782570966aa8a65993925359.exe 8yVXg0rpTL.exe PID 3820 wrote to memory of 196 3820 ed94a35c782570966aa8a65993925359.exe 8yVXg0rpTL.exe PID 3820 wrote to memory of 1172 3820 ed94a35c782570966aa8a65993925359.exe KOM6chIsRD.exe PID 3820 wrote to memory of 1172 3820 ed94a35c782570966aa8a65993925359.exe KOM6chIsRD.exe PID 3820 wrote to memory of 1172 3820 ed94a35c782570966aa8a65993925359.exe KOM6chIsRD.exe PID 3820 wrote to memory of 996 3820 ed94a35c782570966aa8a65993925359.exe cmd.exe PID 3820 wrote to memory of 996 3820 ed94a35c782570966aa8a65993925359.exe cmd.exe PID 3820 wrote to memory of 996 3820 ed94a35c782570966aa8a65993925359.exe cmd.exe PID 996 wrote to memory of 3552 996 cmd.exe timeout.exe PID 996 wrote to memory of 3552 996 cmd.exe timeout.exe PID 996 wrote to memory of 3552 996 cmd.exe timeout.exe PID 3004 wrote to memory of 2084 3004 UgzQwLUb4F.exe Powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed94a35c782570966aa8a65993925359.exe"C:\Users\Admin\AppData\Local\Temp\ed94a35c782570966aa8a65993925359.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ueinyo.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Limos.exe"C:\Users\Admin\AppData\Local\Temp\Limos.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Anowoirk.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\La.exe"C:\Users\Admin\AppData\Local\Temp\La.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\La.exe"C:\Users\Admin\AppData\Local\Temp\La.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Limos.exe"C:\Users\Admin\AppData\Local\Temp\Limos.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 204 & erase C:\Users\Admin\AppData\Local\Temp\Limos.exe & RD /S /Q C:\\ProgramData\\443384934123450\\* & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 2046⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ed94a35c782570966aa8a65993925359.exe"C:\Users\Admin\AppData\Local\Temp\ed94a35c782570966aa8a65993925359.exe"2⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe"C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ddvlc.exe"'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe"C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe"C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\McXHU0pL1D.exe"C:\Users\Admin\AppData\Local\Temp\McXHU0pL1D.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8yVXg0rpTL.exe"C:\Users\Admin\AppData\Local\Temp\8yVXg0rpTL.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8yVXg0rpTL.exe"C:\Users\Admin\AppData\Local\Temp\8yVXg0rpTL.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\pakudjrl.inf5⤵
-
C:\Users\Admin\AppData\Local\Temp\KOM6chIsRD.exe"C:\Users\Admin\AppData\Local\Temp\KOM6chIsRD.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\KOM6chIsRD.exe"C:\Users\Admin\AppData\Local\Temp\KOM6chIsRD.exe"4⤵
- Executes dropped EXE
- Windows security modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\ed94a35c782570966aa8a65993925359.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
-
C:\Windows\SysWOW64\cmd.execmd /c start C:\Windows\temp\q4josjac.exe2⤵
-
C:\Windows\temp\q4josjac.exeC:\Windows\temp\q4josjac.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 64⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 64⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 64⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 24⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cmstp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8yVXg0rpTL.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UgzQwLUb4F.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
-
C:\Users\Admin\AppData\Local\Temp\8yVXg0rpTL.exe
-
C:\Users\Admin\AppData\Local\Temp\8yVXg0rpTL.exe
-
C:\Users\Admin\AppData\Local\Temp\8yVXg0rpTL.exe
-
C:\Users\Admin\AppData\Local\Temp\Anowoirk.vbs
-
C:\Users\Admin\AppData\Local\Temp\KOM6chIsRD.exe
-
C:\Users\Admin\AppData\Local\Temp\KOM6chIsRD.exe
-
C:\Users\Admin\AppData\Local\Temp\KOM6chIsRD.exe
-
C:\Users\Admin\AppData\Local\Temp\La.exe
-
C:\Users\Admin\AppData\Local\Temp\La.exe
-
C:\Users\Admin\AppData\Local\Temp\La.exe
-
C:\Users\Admin\AppData\Local\Temp\Limos.exe
-
C:\Users\Admin\AppData\Local\Temp\Limos.exe
-
C:\Users\Admin\AppData\Local\Temp\Limos.exe
-
C:\Users\Admin\AppData\Local\Temp\McXHU0pL1D.exe
-
C:\Users\Admin\AppData\Local\Temp\McXHU0pL1D.exe
-
C:\Users\Admin\AppData\Local\Temp\Ueinyo.vbsMD5
4d445a65cf125b0c3134c383d7a79066
SHA196100005ae5036a97697e04ec7d186398ec106d6
SHA2564dad5471e193e9b019a086e85db7267b4afffea52238476457d29cfb33502103
SHA512867c0d512b6d30c9d77847ea7ebc7742d2543b84354aa5899aacd51f5674df85aac187046847c4dc236c9839a9908167a7d7cb4fa5b5498f9543947c80c4672f
-
C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe
-
C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe
-
C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe
-
C:\Users\Admin\AppData\Local\Temp\UgzQwLUb4F.exe
-
C:\Windows\Temp\q4josjac.exeMD5
f4b5c1ebf4966256f52c4c4ceae87fb1
SHA1ca70ec96d1a65cb2a4cbf4db46042275dc75813b
SHA25688e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03
SHA51202a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e
-
C:\Windows\temp\pakudjrl.inf
-
C:\Windows\temp\q4josjac.exeMD5
f4b5c1ebf4966256f52c4c4ceae87fb1
SHA1ca70ec96d1a65cb2a4cbf4db46042275dc75813b
SHA25688e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03
SHA51202a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e
-
\ProgramData\mozglue.dll
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\sqlite3.dll
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\freebl3.dll
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\freebl3.dll
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\mozglue.dll
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\nss3.dllMD5
02cc7b8ee30056d5912de54f1bdfc219
SHA1a6923da95705fb81e368ae48f93d28522ef552fb
SHA2561989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5
SHA5120d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\softokn3.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
memory/68-90-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/68-155-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/68-92-0x00000000004253BE-mapping.dmp
-
memory/68-96-0x0000000071AD0000-0x00000000721BE000-memory.dmpFilesize
6.9MB
-
memory/196-100-0x00000000054F0000-0x000000000550D000-memory.dmpFilesize
116KB
-
memory/196-70-0x0000000000000000-mapping.dmp
-
memory/196-74-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/196-73-0x0000000071AD0000-0x00000000721BE000-memory.dmpFilesize
6.9MB
-
memory/204-24-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/204-25-0x0000000000417A8B-mapping.dmp
-
memory/204-27-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/472-205-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/472-198-0x0000000000000000-mapping.dmp
-
memory/492-15-0x0000000073480000-0x0000000073B6E000-memory.dmpFilesize
6.9MB
-
memory/492-16-0x0000000000F80000-0x0000000000F81000-memory.dmpFilesize
4KB
-
memory/492-20-0x000000000AF10000-0x000000000AF75000-memory.dmpFilesize
404KB
-
memory/492-13-0x0000000000000000-mapping.dmp
-
memory/492-18-0x00000000032C0000-0x00000000032C1000-memory.dmpFilesize
4KB
-
memory/944-156-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/944-179-0x0000028CF8280000-0x0000028CF8281000-memory.dmpFilesize
4KB
-
memory/944-153-0x0000000000000000-mapping.dmp
-
memory/944-171-0x0000028CF80D0000-0x0000028CF80D1000-memory.dmpFilesize
4KB
-
memory/996-76-0x0000000000000000-mapping.dmp
-
memory/1016-186-0x0000000000000000-mapping.dmp
-
memory/1016-202-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/1172-75-0x0000000000000000-mapping.dmp
-
memory/1172-101-0x0000000005380000-0x000000000539E000-memory.dmpFilesize
120KB
-
memory/1172-81-0x0000000071AD0000-0x00000000721BE000-memory.dmpFilesize
6.9MB
-
memory/1172-82-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1776-105-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1776-107-0x00000000004133EE-mapping.dmp
-
memory/1776-112-0x0000000071AD0000-0x00000000721BE000-memory.dmpFilesize
6.9MB
-
memory/2084-94-0x0000000004240000-0x0000000004241000-memory.dmpFilesize
4KB
-
memory/2084-174-0x0000000007E10000-0x0000000007E11000-memory.dmpFilesize
4KB
-
memory/2084-91-0x0000000071AD0000-0x00000000721BE000-memory.dmpFilesize
6.9MB
-
memory/2084-125-0x0000000007660000-0x0000000007661000-memory.dmpFilesize
4KB
-
memory/2084-140-0x0000000007D30000-0x0000000007D31000-memory.dmpFilesize
4KB
-
memory/2084-87-0x0000000000000000-mapping.dmp
-
memory/2084-120-0x0000000007380000-0x0000000007381000-memory.dmpFilesize
4KB
-
memory/2084-97-0x0000000006CE0000-0x0000000006CE1000-memory.dmpFilesize
4KB
-
memory/2084-159-0x0000000008AD0000-0x0000000008B03000-memory.dmpFilesize
204KB
-
memory/2084-122-0x0000000007560000-0x0000000007561000-memory.dmpFilesize
4KB
-
memory/2084-135-0x0000000007F40000-0x0000000007F41000-memory.dmpFilesize
4KB
-
memory/2084-109-0x0000000006C80000-0x0000000006C81000-memory.dmpFilesize
4KB
-
memory/2084-134-0x0000000007540000-0x0000000007541000-memory.dmpFilesize
4KB
-
memory/2084-176-0x0000000008E00000-0x0000000008E01000-memory.dmpFilesize
4KB
-
memory/2116-152-0x0000000000000000-mapping.dmp
-
memory/2176-106-0x00000000004135CE-mapping.dmp
-
memory/2176-104-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2176-110-0x0000000071AD0000-0x00000000721BE000-memory.dmpFilesize
6.9MB
-
memory/2176-137-0x0000000005A30000-0x0000000005A31000-memory.dmpFilesize
4KB
-
memory/2176-117-0x00000000018B0000-0x00000000018B5000-memory.dmpFilesize
20KB
-
memory/2176-141-0x0000000003200000-0x0000000003201000-memory.dmpFilesize
4KB
-
memory/2304-124-0x0000000004660000-0x0000000004761000-memory.dmpFilesize
1.0MB
-
memory/2304-118-0x0000000000000000-mapping.dmp
-
memory/2328-184-0x0000000000000000-mapping.dmp
-
memory/2328-189-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/2840-21-0x0000000000000000-mapping.dmp
-
memory/2900-48-0x0000000004CE0000-0x0000000004D02000-memory.dmpFilesize
136KB
-
memory/2900-32-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2900-34-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/2900-29-0x0000000000000000-mapping.dmp
-
memory/2900-31-0x0000000072AE0000-0x00000000731CE000-memory.dmpFilesize
6.9MB
-
memory/3004-60-0x0000000000000000-mapping.dmp
-
memory/3004-63-0x0000000071AD0000-0x00000000721BE000-memory.dmpFilesize
6.9MB
-
memory/3004-64-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/3004-86-0x0000000005340000-0x0000000005367000-memory.dmpFilesize
156KB
-
memory/3012-185-0x0000000000000000-mapping.dmp
-
memory/3012-195-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/3080-46-0x0000000000000000-mapping.dmp
-
memory/3140-188-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/3140-183-0x0000000000000000-mapping.dmp
-
memory/3440-182-0x00000000028D0000-0x00000000028DF000-memory.dmpFilesize
60KB
-
memory/3440-67-0x0000000000000000-mapping.dmp
-
memory/3484-123-0x0000000071AD0000-0x00000000721BE000-memory.dmpFilesize
6.9MB
-
memory/3484-180-0x0000000009AC0000-0x0000000009AC1000-memory.dmpFilesize
4KB
-
memory/3484-190-0x00000000099A0000-0x00000000099A1000-memory.dmpFilesize
4KB
-
memory/3484-160-0x0000000009750000-0x0000000009783000-memory.dmpFilesize
204KB
-
memory/3484-119-0x0000000000000000-mapping.dmp
-
memory/3484-196-0x0000000007340000-0x0000000007341000-memory.dmpFilesize
4KB
-
memory/3552-85-0x0000000000000000-mapping.dmp
-
memory/3672-50-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3672-51-0x000000000041A684-mapping.dmp
-
memory/3672-53-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3728-194-0x0000000000000000-mapping.dmp
-
memory/3728-203-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/3780-144-0x0000000000000000-mapping.dmp
-
memory/3816-4-0x000000000B010000-0x000000000B011000-memory.dmpFilesize
4KB
-
memory/3816-3-0x00000000015A0000-0x00000000015A1000-memory.dmpFilesize
4KB
-
memory/3816-7-0x0000000002E70000-0x0000000002E7D000-memory.dmpFilesize
52KB
-
memory/3816-0-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/3816-5-0x000000000AB50000-0x000000000AC2C000-memory.dmpFilesize
880KB
-
memory/3816-1-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/3820-11-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3820-8-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3820-9-0x0000000000440102-mapping.dmp
-
memory/3900-47-0x0000000000000000-mapping.dmp
-
memory/3904-150-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/3904-149-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/3904-146-0x0000000000000000-mapping.dmp
-
memory/3904-145-0x0000000000000000-mapping.dmp
-
memory/3932-6-0x0000000000000000-mapping.dmp
-
memory/4124-210-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/4124-201-0x0000000000000000-mapping.dmp
-
memory/4212-204-0x0000000000000000-mapping.dmp
-
memory/4212-213-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/4296-207-0x0000000000000000-mapping.dmp
-
memory/4296-214-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/4408-209-0x0000000000000000-mapping.dmp
-
memory/4408-217-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/4532-212-0x0000000000000000-mapping.dmp
-
memory/4532-220-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB
-
memory/4632-215-0x0000000000000000-mapping.dmp
-
memory/4632-223-0x00007FF9A7AD0000-0x00007FF9A84BC000-memory.dmpFilesize
9.9MB