Analysis
- max time kernel
150s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
document-1822227617.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document-1822227617.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target document-1822227617.xlsb
- Size 292KB
- Sample201112-bfdc6xvxbx
- SHA256 ae9d33113befb8fdfe7dfdcdb1da86cc9593f087b2af1c5c446dcb8b87da33f3
- MD5 c8cf8414838c8d9413832f6436ebe199
- SHA1 e224f6c32b7bfdcb93dc023941e8f659c7d8b447
- SHA512 3d9ea363803a5691659f44e5a84024bdd9c19c7e77c46f07f1a4c4c2c33b7ff76d055a9fd5fe477b7d7ef8544baea9e6481ff63bfccc22ef62029d1c831a87b0
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
pid Process 2832 gwqxfoii.exe 1336 B0B8.exe 584 B0B8.exe 3828 gadaz.exe 1496 gadaz.exe - Loads dropped DLL 1 IoCs
pid Process 2832 gwqxfoii.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service B0B8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gwqxfoii.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service B0B8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc gadaz.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service gadaz.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gwqxfoii.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc B0B8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 B0B8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc gadaz.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service gadaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 B0B8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc B0B8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 gadaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 gadaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gwqxfoii.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2076 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3940 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 1084 IoCs
pid Process 2832 gwqxfoii.exe 2832 gwqxfoii.exe 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 1336 B0B8.exe 1336 B0B8.exe 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 3456 explorer.exe 3456 explorer.exe 2908 Process not Found 2908 Process not Found 3456 explorer.exe 3456 explorer.exe 1988 explorer.exe 1988 explorer.exe 804 explorer.exe 804 explorer.exe 3244 explorer.exe 3244 explorer.exe 4056 explorer.exe 4056 explorer.exe 2908 Process not Found 2908 Process not Found 3056 explorer.exe 3056 explorer.exe 2548 explorer.exe 2548 explorer.exe 584 B0B8.exe 584 B0B8.exe 3456 explorer.exe 3456 explorer.exe 3456 explorer.exe 3456 explorer.exe 584 B0B8.exe 584 B0B8.exe 640 explorer.exe 640 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3828 gadaz.exe 3828 gadaz.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 3896 explorer.exe 3896 explorer.exe 640 explorer.exe 640 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 640 explorer.exe 640 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 640 explorer.exe 640 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 640 explorer.exe 640 explorer.exe 3896 explorer.exe 3896 explorer.exe 1496 gadaz.exe 1496 gadaz.exe 804 explorer.exe 804 explorer.exe 640 explorer.exe 640 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 1496 gadaz.exe 1496 gadaz.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 3128 explorer.exe 3128 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3128 explorer.exe 3128 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe 3896 explorer.exe 3896 explorer.exe 804 explorer.exe 804 explorer.exe 4056 explorer.exe 4056 explorer.exe 640 explorer.exe 640 explorer.exe 3056 explorer.exe 3056 explorer.exe - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 2832 gwqxfoii.exe 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 2908 Process not Found 3828 gadaz.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 2908 Process not Found Token: SeCreatePagefilePrivilege 2908 Process not Found Token: SeShutdownPrivilege 2908 Process not Found Token: SeCreatePagefilePrivilege 2908 Process not Found Token: SeShutdownPrivilege 2908 Process not Found Token: SeCreatePagefilePrivilege 2908 Process not Found - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE 3940 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2908 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 3940 wrote to memory of 2832 3940 EXCEL.EXE 75 PID 3940 wrote to memory of 2832 3940 EXCEL.EXE 75 PID 3940 wrote to memory of 2832 3940 EXCEL.EXE 75 PID 2908 wrote to memory of 1336 2908 Process not Found 80 PID 2908 wrote to memory of 1336 2908 Process not Found 80 PID 2908 wrote to memory of 1336 2908 Process not Found 80 PID 2908 wrote to memory of 1440 2908 Process not Found 81 PID 2908 wrote to memory of 1440 2908 Process not Found 81 PID 2908 wrote to memory of 1440 2908 Process not Found 81 PID 2908 wrote to memory of 1440 2908 Process not Found 81 PID 2908 wrote to memory of 3980 2908 Process not Found 82 PID 2908 wrote to memory of 3980 2908 Process not Found 82 PID 2908 wrote to memory of 3980 2908 Process not Found 82 PID 2908 wrote to memory of 3724 2908 Process not Found 83 PID 2908 wrote to memory of 3724 2908 Process not Found 83 PID 2908 wrote to memory of 3724 2908 Process not Found 83 PID 2908 wrote to memory of 3724 2908 Process not Found 83 PID 2908 wrote to memory of 3456 2908 Process not Found 84 PID 2908 wrote to memory of 3456 2908 Process not Found 84 PID 2908 wrote to memory of 3456 2908 Process not Found 84 PID 2908 wrote to memory of 3456 2908 Process not Found 84 PID 1336 wrote to memory of 584 1336 B0B8.exe 85 PID 1336 wrote to memory of 584 1336 B0B8.exe 85 PID 1336 wrote to memory of 584 1336 B0B8.exe 85 PID 2908 wrote to memory of 1988 2908 Process not Found 86 PID 2908 wrote to memory of 1988 2908 Process not Found 86 PID 2908 wrote to memory of 1988 2908 Process not Found 86 PID 2908 wrote to memory of 1988 2908 Process not Found 86 PID 2908 wrote to memory of 804 2908 Process not Found 87 PID 2908 wrote to memory of 804 2908 Process not Found 87 PID 2908 wrote to memory of 804 2908 Process not Found 87 PID 2908 wrote to memory of 3244 2908 Process not Found 88 PID 2908 wrote to memory of 3244 2908 Process not Found 88 PID 2908 wrote to memory of 3244 2908 Process not Found 88 PID 2908 wrote to memory of 3244 2908 Process not Found 88 PID 2908 wrote to memory of 4056 2908 Process not Found 89 PID 2908 wrote to memory of 4056 2908 Process not Found 89 PID 2908 wrote to memory of 4056 2908 Process not Found 89 PID 2908 wrote to memory of 3056 2908 Process not Found 90 PID 2908 wrote to memory of 3056 2908 Process not Found 90 PID 2908 wrote to memory of 3056 2908 Process not Found 90 PID 2908 wrote to memory of 3056 2908 Process not Found 90 PID 2908 wrote to memory of 2548 2908 Process not Found 91 PID 2908 wrote to memory of 2548 2908 Process not Found 91 PID 2908 wrote to memory of 2548 2908 Process not Found 91 PID 2908 wrote to memory of 1100 2908 Process not Found 92 PID 2908 wrote to memory of 1100 2908 Process not Found 92 PID 2908 wrote to memory of 1100 2908 Process not Found 92 PID 2908 wrote to memory of 1100 2908 Process not Found 92 PID 2908 wrote to memory of 2272 2908 Process not Found 93 PID 2908 wrote to memory of 2272 2908 Process not Found 93 PID 2908 wrote to memory of 2272 2908 Process not Found 93 PID 2908 wrote to memory of 2272 2908 Process not Found 93 PID 2908 wrote to memory of 640 2908 Process not Found 94 PID 2908 wrote to memory of 640 2908 Process not Found 94 PID 2908 wrote to memory of 640 2908 Process not Found 94 PID 2908 wrote to memory of 640 2908 Process not Found 94 PID 2908 wrote to memory of 3896 2908 Process not Found 95 PID 2908 wrote to memory of 3896 2908 Process not Found 95 PID 2908 wrote to memory of 3896 2908 Process not Found 95 PID 2908 wrote to memory of 2844 2908 Process not Found 96 PID 2908 wrote to memory of 2844 2908 Process not Found 96 PID 2908 wrote to memory of 2844 2908 Process not Found 96 PID 2908 wrote to memory of 2844 2908 Process not Found 96 PID 1336 wrote to memory of 3828 1336 B0B8.exe 97 PID 1336 wrote to memory of 3828 1336 B0B8.exe 97 PID 1336 wrote to memory of 3828 1336 B0B8.exe 97 PID 1336 wrote to memory of 2076 1336 B0B8.exe 98 PID 1336 wrote to memory of 2076 1336 B0B8.exe 98 PID 1336 wrote to memory of 2076 1336 B0B8.exe 98 PID 3828 wrote to memory of 1496 3828 gadaz.exe 100 PID 3828 wrote to memory of 1496 3828 gadaz.exe 100 PID 3828 wrote to memory of 1496 3828 gadaz.exe 100 PID 3828 wrote to memory of 3128 3828 gadaz.exe 101 PID 3828 wrote to memory of 3128 3828 gadaz.exe 101 PID 3828 wrote to memory of 3128 3828 gadaz.exe 101 PID 3828 wrote to memory of 3128 3828 gadaz.exe 101
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1822227617.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\ghohtj\npnppr\gwqxfoii.exe"C:\ghohtj\npnppr\gwqxfoii.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\B0B8.exeC:\Users\Admin\AppData\Local\Temp\B0B8.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\B0B8.exeC:\Users\Admin\AppData\Local\Temp\B0B8.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:584
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Yrqyksbrqwe\gadaz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Yrqyksbrqwe\gadaz.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:3828 -
C:\Users\Admin\AppData\Roaming\Microsoft\Yrqyksbrqwe\gadaz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Yrqyksbrqwe\gadaz.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1496
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:3128
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xmpqqrll /tr "\"C:\Users\Admin\AppData\Local\Temp\B0B8.exe\" /I xmpqqrll" /SC ONCE /Z /ST 21:15 /ET 21:272⤵
- Creates scheduled task(s)
PID:2076
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1440
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3980
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3724
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3456
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1988
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:804
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3244
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4056
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3056
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2548
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1100
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2272
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:640
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3896
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2844