2295742285186ecb7ff7c4634d31bdc8.exe

General
Target

2295742285186ecb7ff7c4634d31bdc8.exe

Filesize

1MB

Completed

08-04-2021 07:33

Score
8 /10
MD5

2295742285186ecb7ff7c4634d31bdc8

SHA1

f76643300796393b1e616f7e2d925644faae5caf

SHA256

0cd1346813ea66e5ecb353180f0f01d9b2e53b230ccb5aece10e4366d632df25

Malware Config
Signatures 16

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
  • Executes dropped EXE
    servs.exeservs.tmp

    Reported IOCs

    pidprocess
    916servs.exe
    1752servs.tmp
  • Loads dropped DLL
    2295742285186ecb7ff7c4634d31bdc8.exeservs.exe

    Reported IOCs

    pidprocess
    10562295742285186ecb7ff7c4634d31bdc8.exe
    916servs.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Suspicious use of SetThreadContext
    2295742285186ecb7ff7c4634d31bdc8.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2008 set thread context of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Delays execution with timeout.exe
    timeout.exe

    Tags

    Reported IOCs

    pidprocess
    1360timeout.exe
  • Modifies Internet Explorer settings
    iexplore.exeIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowseriexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoomiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestioniexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d011b8da492cd701iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01614B01-983D-11EB-9DE0-42BBC6EE9B6F} = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000088af0e747e0f3140b04904a9ef560f690000000002000000000010660000000100002000000058ea354c2dc9fc96ba3879079bc3de95f808e4196a8f86d83c85b65a47cdfc57000000000e8000000002000020000000825b2c43cef5ad65fd4668006e2c55e03a500673a7db5ba4ee913fbf868d78ba200000001e5c4088fcf0fe16fb922f6e3459636284ed6d09b7fa522ee4f0e5c79c1611c940000000e4350f5ad98b774388f298f068ab100e6a3487077789cbddeb245a1e35ba28b984252de9dd18a4f64134b33e98e65a3a9412a3bf4acbc9d507947cffebe7aa06iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPUiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbariexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000088af0e747e0f3140b04904a9ef560f6900000000020000000000106600000001000020000000721f579f99a02c5f5ac047e7b56a0c494c8ad13208028a5814a5b6d39c3818cb000000000e8000000002000020000000fd4733959482fb02419a6129e588f54fc92405dd174c0f8d4b25d8ac6c7d5bbc90000000fdbcfc6adb48ca835676f9b8b5946b7f6325cb813c2725cde15c92cf6444e75738ad9e93980b252f41bc8a0128dc99de94439fc606d73415ea874c701967e865622abd035fb004af066c4ae897d5589ffc5f8d6f00ae57db40c012913d86bbf31b3b61245c483fbf83407de6573e90cad5ed437829a9086039a43af670bdc65c30614c089e4b9c3a969a721daf3a83fd400000006bdb5b84011b6b251b6acf8d71c099a40769d096a1c97a03006ec559dca9f812f8973286fa37428774775540d1c44ad594250628e1e8f7f4a60759469d96a8b3iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "324632312"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliFormsiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetupiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNamesiexplore.exe
  • Modifies system certificate store
    2295742285186ecb7ff7c4634d31bdc8.exe

    TTPs

    Install Root CertificateModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a2295742285186ecb7ff7c4634d31bdc8.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a2295742285186ecb7ff7c4634d31bdc8.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC252295742285186ecb7ff7c4634d31bdc8.exe
  • Suspicious behavior: EnumeratesProcesses
    2295742285186ecb7ff7c4634d31bdc8.exeservs.tmp

    Reported IOCs

    pidprocess
    10562295742285186ecb7ff7c4634d31bdc8.exe
    1752servs.tmp
    1752servs.tmp
  • Suspicious use of AdjustPrivilegeToken
    2295742285186ecb7ff7c4634d31bdc8.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege10562295742285186ecb7ff7c4634d31bdc8.exe
  • Suspicious use of FindShellTrayWindow
    servs.tmpiexplore.exe

    Reported IOCs

    pidprocess
    1752servs.tmp
    324iexplore.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXE

    Reported IOCs

    pidprocess
    324iexplore.exe
    324iexplore.exe
    556IEXPLORE.EXE
    556IEXPLORE.EXE
    556IEXPLORE.EXE
    556IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    2295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exeservs.exeservs.tmpiexplore.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2008 wrote to memory of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
    PID 2008 wrote to memory of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
    PID 2008 wrote to memory of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
    PID 2008 wrote to memory of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
    PID 2008 wrote to memory of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
    PID 2008 wrote to memory of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
    PID 2008 wrote to memory of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
    PID 2008 wrote to memory of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
    PID 2008 wrote to memory of 105620082295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exe
    PID 1056 wrote to memory of 91610562295742285186ecb7ff7c4634d31bdc8.exeservs.exe
    PID 1056 wrote to memory of 91610562295742285186ecb7ff7c4634d31bdc8.exeservs.exe
    PID 1056 wrote to memory of 91610562295742285186ecb7ff7c4634d31bdc8.exeservs.exe
    PID 1056 wrote to memory of 91610562295742285186ecb7ff7c4634d31bdc8.exeservs.exe
    PID 1056 wrote to memory of 91610562295742285186ecb7ff7c4634d31bdc8.exeservs.exe
    PID 1056 wrote to memory of 91610562295742285186ecb7ff7c4634d31bdc8.exeservs.exe
    PID 1056 wrote to memory of 91610562295742285186ecb7ff7c4634d31bdc8.exeservs.exe
    PID 1056 wrote to memory of 32410562295742285186ecb7ff7c4634d31bdc8.exeiexplore.exe
    PID 1056 wrote to memory of 32410562295742285186ecb7ff7c4634d31bdc8.exeiexplore.exe
    PID 1056 wrote to memory of 32410562295742285186ecb7ff7c4634d31bdc8.exeiexplore.exe
    PID 1056 wrote to memory of 32410562295742285186ecb7ff7c4634d31bdc8.exeiexplore.exe
    PID 916 wrote to memory of 1752916servs.exeservs.tmp
    PID 916 wrote to memory of 1752916servs.exeservs.tmp
    PID 916 wrote to memory of 1752916servs.exeservs.tmp
    PID 916 wrote to memory of 1752916servs.exeservs.tmp
    PID 916 wrote to memory of 1752916servs.exeservs.tmp
    PID 916 wrote to memory of 1752916servs.exeservs.tmp
    PID 916 wrote to memory of 1752916servs.exeservs.tmp
    PID 1752 wrote to memory of 12161752servs.tmpcmd.exe
    PID 1752 wrote to memory of 12161752servs.tmpcmd.exe
    PID 1752 wrote to memory of 12161752servs.tmpcmd.exe
    PID 1752 wrote to memory of 12161752servs.tmpcmd.exe
    PID 324 wrote to memory of 556324iexplore.exeIEXPLORE.EXE
    PID 324 wrote to memory of 556324iexplore.exeIEXPLORE.EXE
    PID 324 wrote to memory of 556324iexplore.exeIEXPLORE.EXE
    PID 324 wrote to memory of 556324iexplore.exeIEXPLORE.EXE
    PID 1216 wrote to memory of 13601216cmd.exetimeout.exe
    PID 1216 wrote to memory of 13601216cmd.exetimeout.exe
    PID 1216 wrote to memory of 13601216cmd.exetimeout.exe
Processes 8
  • C:\Users\Admin\AppData\Local\Temp\2295742285186ecb7ff7c4634d31bdc8.exe
    "C:\Users\Admin\AppData\Local\Temp\2295742285186ecb7ff7c4634d31bdc8.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Users\Admin\AppData\Local\Temp\2295742285186ecb7ff7c4634d31bdc8.exe
      "{path}"
      Loads dropped DLL
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Users\Admin\AppData\Local\Temp\servs.exe
        "C:\Users\Admin\AppData\Local\Temp\servs.exe"
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        PID:916
        • C:\Users\Admin\AppData\Local\Temp\is-9KFLL.tmp\servs.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-9KFLL.tmp\servs.tmp" /SL5="$60130,10541093,724480,C:\Users\Admin\AppData\Local\Temp\servs.exe"
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of FindShellTrayWindow
          Suspicious use of WriteProcessMemory
          PID:1752
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\uacwev.bat""
            Suspicious use of WriteProcessMemory
            PID:1216
            • C:\Windows\system32\timeout.exe
              TIMEOUT /T 8
              Delays execution with timeout.exe
              PID:1360
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1x8vh7
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        PID:324
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:324 CREDAT:275457 /prefetch:2
          Modifies Internet Explorer settings
          Suspicious use of SetWindowsHookEx
          PID:556
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Persistence
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • C:\ProgramData\pass.exe

                    MD5

                    a5e2bb848405dfc3a56fc892b691b614

                    SHA1

                    7bc55828682e93191d6ee4c20e727308d0eeac6d

                    SHA256

                    ea5982c7dd3396d89d54ba0f0269b96807ab59111c22503ca5f9e593b78660f3

                    SHA512

                    0502630b436079ab2660134e6545ef18fc4b0927073b274e3fc4c706f49c417ad36ddd8f166c4a016ac0fa0065b88f75a921bee3e7029a9a5cb051a5faa7a954

                  • C:\ProgramData\uacwev.bat

                    MD5

                    ace1a6c2ea9446d1bd4b645d00bc2c46

                    SHA1

                    a9c41e189775db5a507785c1c527ff9fb7a07bd6

                    SHA256

                    2b875f4d5f0722425969fd5963fa0276a101ce63ddb91e5960f2860ab0aedbf4

                    SHA512

                    1fba8400d354a46fe3e1b19f8a4d817df1ef4c1289d42a8a2257af45838b6b468a0632b9f31239fc45de11771aa9d9fb0b803a6cda359b14c24fb05f71bddbb2

                  • C:\ProgramData\uxtheme.dll

                    MD5

                    531fcc0848cf13fa300600df16a71a87

                    SHA1

                    20bff8b5030d74afba1b4c20b5c8cc6f75011b62

                    SHA256

                    5b192bbc069b8aef74dabb1dd5459bda8ea2a64a7336db54e57afb38569ece68

                    SHA512

                    af8b8bbc666ce3c57e248acf056a3c65b2e4eea244c3c8dbb2d3765964407af93478a3d452a08862501f61994c964dd6048720742413506952395143841673e3

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                    MD5

                    61a03d15cf62612f50b74867090dbe79

                    SHA1

                    15228f34067b4b107e917bebaf17cc7c3c1280a8

                    SHA256

                    f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d

                    SHA512

                    5fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    MD5

                    c8856f1bfa55208e0e0360c5c2527192

                    SHA1

                    6f8841869425b035018714dda305c75e450cf53f

                    SHA256

                    d1653b3e1bb80efafa7a7d0c30210f0670c834e3fd57ea92636030f2e7420beb

                    SHA512

                    afb80776f2a24e7105e55c3b0777949510ed2a6fc51f2bdb847a1fc002766bf346c5bd9d38fca264695caae04d4fc4bdd6cc93a570d6f8b1f61fe1ac96fe2e8e

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    MD5

                    348a7c5122a50dd3bd13e6dff4171496

                    SHA1

                    b99a4792da15351b9e295867f8298100817cc792

                    SHA256

                    060042911e7225ae2b42a544202ff74e8f2ce7ac53ca3fd77152dce33a692d3d

                    SHA512

                    a7fdceabb00c03818dbec1519cb89d9d8ff424fa18dbd25d2a65539927be41d6257dd150f5766be608b6e56605dd870a4938a623201e38a11de92138379dfd96

                  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat

                    MD5

                    1ca2ce464873fd66b3eea4c1630f9db2

                    SHA1

                    599e6810975215a1e4e308d6228082bbbd3e1888

                    SHA256

                    4cd2f3ac29ca059d716ceecd1887c939fa9ccc728a9217c06fd25c2363b32cc8

                    SHA512

                    c417e5b87d15d3592b4d15bc5024a87c008efaa1d9901cac75a0b9e47cf883552be5119bc2c84c08e156092060bb035dcc3214ad484ce18b0098c17e1b0d9965

                  • C:\Users\Admin\AppData\Local\Temp\is-9KFLL.tmp\servs.tmp

                    MD5

                    c1b49299eb51afa1264d69fc022bb49b

                    SHA1

                    8126de1c2b2ec7d2ddd83735067aef2eefa77b37

                    SHA256

                    03b49d8261ed6fbfd23c6f1233e6c7fa131ff067d059fde696be60105286a895

                    SHA512

                    893e32f9a13c7b2b4e260c8acb6027fa3aa74c8268666012240aacbae2cbbf045b33cb256958a9ab230f0654c5452e4c3e114727e853431f63ec5d47719a9f60

                  • C:\Users\Admin\AppData\Local\Temp\servs.exe

                    MD5

                    6df7008811f88eeb253064a99c79f234

                    SHA1

                    41744103d74456cb63397841ef25945ca9e553bf

                    SHA256

                    4be7dd4ecb8434b14e36f0f747eddd8b98435e98f3d664f6206223e54d212a1a

                    SHA512

                    1f26e014ea7382c5d61c8f758d4afb428af096a10a8795bf7cfe7d1221dd73a8d56b18b033d4fe82f178dc7ce309ceaad83bf0178db300bec5f6fd42d1952482

                  • C:\Users\Admin\AppData\Local\Temp\servs.exe

                    MD5

                    6df7008811f88eeb253064a99c79f234

                    SHA1

                    41744103d74456cb63397841ef25945ca9e553bf

                    SHA256

                    4be7dd4ecb8434b14e36f0f747eddd8b98435e98f3d664f6206223e54d212a1a

                    SHA512

                    1f26e014ea7382c5d61c8f758d4afb428af096a10a8795bf7cfe7d1221dd73a8d56b18b033d4fe82f178dc7ce309ceaad83bf0178db300bec5f6fd42d1952482

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9KKQEY5F.txt

                    MD5

                    cefbd9ed3affd582ef93f49fae716ea2

                    SHA1

                    2957b64a4dd3aa3ae6fd3585e585f0bcc36299cf

                    SHA256

                    0a5dc0685afa9b7a4f2a3fdef74ffbfa7bb83ef3d83494d3518741f3c0febd11

                    SHA512

                    82b070f70ff343469a7a96f7d71d85d5a8294f9ed753c5782234e05237873cc80c70f83b0155ffd2b6775f7a1b6e8e71dc5a2a007415ce85f917e39ba5d433c4

                  • \Users\Admin\AppData\Local\Temp\is-9KFLL.tmp\servs.tmp

                    MD5

                    c1b49299eb51afa1264d69fc022bb49b

                    SHA1

                    8126de1c2b2ec7d2ddd83735067aef2eefa77b37

                    SHA256

                    03b49d8261ed6fbfd23c6f1233e6c7fa131ff067d059fde696be60105286a895

                    SHA512

                    893e32f9a13c7b2b4e260c8acb6027fa3aa74c8268666012240aacbae2cbbf045b33cb256958a9ab230f0654c5452e4c3e114727e853431f63ec5d47719a9f60

                  • \Users\Admin\AppData\Local\Temp\servs.exe

                    MD5

                    6df7008811f88eeb253064a99c79f234

                    SHA1

                    41744103d74456cb63397841ef25945ca9e553bf

                    SHA256

                    4be7dd4ecb8434b14e36f0f747eddd8b98435e98f3d664f6206223e54d212a1a

                    SHA512

                    1f26e014ea7382c5d61c8f758d4afb428af096a10a8795bf7cfe7d1221dd73a8d56b18b033d4fe82f178dc7ce309ceaad83bf0178db300bec5f6fd42d1952482

                  • memory/324-19-0x0000000000000000-mapping.dmp

                  • memory/556-30-0x0000000000000000-mapping.dmp

                  • memory/916-18-0x0000000076641000-0x0000000076643000-memory.dmp

                  • memory/916-25-0x0000000000401000-0x00000000004A9000-memory.dmp

                  • memory/916-16-0x0000000000000000-mapping.dmp

                  • memory/1056-11-0x0000000074BA0000-0x000000007528E000-memory.dmp

                  • memory/1056-10-0x000000000041653A-mapping.dmp

                  • memory/1056-9-0x0000000000400000-0x000000000041C000-memory.dmp

                  • memory/1056-14-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

                  • memory/1056-12-0x0000000000400000-0x000000000041C000-memory.dmp

                  • memory/1216-29-0x0000000000000000-mapping.dmp

                  • memory/1360-33-0x0000000000000000-mapping.dmp

                  • memory/1752-28-0x000000006D1F1000-0x000000006D1F3000-memory.dmp

                  • memory/1752-22-0x0000000000000000-mapping.dmp

                  • memory/1752-26-0x0000000000240000-0x0000000000241000-memory.dmp

                  • memory/1932-27-0x000007FEF7B20000-0x000007FEF7D9A000-memory.dmp

                  • memory/2008-8-0x0000000002040000-0x0000000002096000-memory.dmp

                  • memory/2008-7-0x00000000057D0000-0x0000000005873000-memory.dmp

                  • memory/2008-6-0x00000000003F0000-0x00000000003F5000-memory.dmp

                  • memory/2008-5-0x0000000004C40000-0x0000000004C41000-memory.dmp

                  • memory/2008-3-0x0000000000900000-0x0000000000901000-memory.dmp

                  • memory/2008-2-0x0000000074BA0000-0x000000007528E000-memory.dmp