Overview
overview
10Static
static
setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows7_x64
setup_x86_...4).exe
windows10_x64
10setup_x86_...5).exe
windows7_x64
setup_x86_...5).exe
windows10_x64
10setup_x86_...6).exe
windows7_x64
setup_x86_...6).exe
windows10_x64
10setup_x86_...7).exe
windows7_x64
10setup_x86_...7).exe
windows10_x64
setup_x86_...8).exe
windows7_x64
8setup_x86_...8).exe
windows10_x64
10setup_x86_...9).exe
windows7_x64
setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
10setup_x86_...2).exe
windows10_x64
10setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10Resubmissions
11-07-2024 05:43
240711-gej4lstgrf 1006-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
71s -
max time network
308s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
08-07-2021 08:02
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (11).exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (12).exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (13).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (14).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (15).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (16).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (17).exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (18).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (19).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (2).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия (20).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
setup_x86_x64_install - копия (21).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
setup_x86_x64_install - копия (22).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
setup_x86_x64_install - копия (23).exe
Resource
win7v20210408
Behavioral task
behavioral30
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210410
Errors
General
-
Target
setup_x86_x64_install - копия (21).exe
-
Size
3.2MB
-
MD5
3ae1c212119919e5fce71247286f8e0e
-
SHA1
97c1890ab73c539056f95eafede319df774e9d38
-
SHA256
30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
-
SHA512
5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558
Malware Config
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com
-
profile_id
706
Extracted
redline
ServAni
87.251.71.195:82
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral25/memory/1940-179-0x0000000000417F26-mapping.dmp family_redline behavioral25/memory/1940-178-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral25/memory/1940-181-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral25/memory/2588-253-0x0000000000417E9E-mapping.dmp family_redline behavioral25/memory/2680-270-0x0000000000417E82-mapping.dmp family_redline behavioral25/memory/2756-272-0x0000000000417E8A-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral25/memory/1884-174-0x0000000002250000-0x00000000022ED000-memory.dmp family_vidar behavioral25/memory/1884-177-0x0000000000400000-0x0000000000949000-memory.dmp family_vidar -
resource yara_rule behavioral25/files/0x0003000000013104-69.dat aspack_v212_v242 behavioral25/files/0x0003000000013104-71.dat aspack_v212_v242 behavioral25/files/0x0003000000013104-70.dat aspack_v212_v242 behavioral25/files/0x0003000000013104-73.dat aspack_v212_v242 behavioral25/files/0x0003000000013100-74.dat aspack_v212_v242 behavioral25/files/0x00030000000130ff-77.dat aspack_v212_v242 behavioral25/files/0x00030000000130ff-76.dat aspack_v212_v242 behavioral25/files/0x0003000000013100-75.dat aspack_v212_v242 behavioral25/files/0x0003000000013102-82.dat aspack_v212_v242 behavioral25/files/0x0003000000013102-83.dat aspack_v212_v242 behavioral25/files/0x0003000000013104-88.dat aspack_v212_v242 behavioral25/files/0x0003000000013104-87.dat aspack_v212_v242 behavioral25/files/0x0003000000013104-86.dat aspack_v212_v242 behavioral25/files/0x0003000000013104-85.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 23 IoCs
pid Process 1940 setup_installer.exe 1700 setup_install.exe 1884 arnatic_1.exe 2000 arnatic_5.exe 1868 arnatic_3.exe 1624 arnatic_2.exe 1728 arnatic_7.exe 1776 arnatic_4.exe 432 arnatic_6.exe 1568 jfiag3g_gg.exe 1940 arnatic_7.exe 1736 jfiag3g_gg.exe 1292 rPuRvTuRihPtb_oJET9vtvkF.exe 1820 gbqA1T8OpJBZiBmWghB8B4jG.exe 1724 DhvwzCCz3AxhoyZDObi6tW25.exe 960 vB8sbezv6oNOtlFM7Yl4MCsz.exe 2080 0ijsGlAKlGvbxOSwM_okWAA1.exe 2092 BBGiRcA_jAm1jQrAxPjoNvnp.exe 2124 Gh_YQCRgWCZaEyUXyA6qFIO4.exe 2104 3KeYjxhw6rq4FcHNYdRnHKr1.exe 2112 674nNeyQkxplcRyTy2VLoVZK.exe 2156 PimZbrdVCNBVbYvdjr2Od_gW.exe 2320 zeHL4LQ9Zr5Hee4izKvrOK9L.exe -
resource yara_rule behavioral25/files/0x0003000000013105-165.dat upx behavioral25/files/0x0003000000013105-164.dat upx behavioral25/files/0x0003000000013105-167.dat upx behavioral25/files/0x0003000000013105-171.dat upx behavioral25/files/0x0003000000013105-170.dat upx behavioral25/files/0x0003000000013105-169.dat upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 674nNeyQkxplcRyTy2VLoVZK.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 674nNeyQkxplcRyTy2VLoVZK.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vB8sbezv6oNOtlFM7Yl4MCsz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vB8sbezv6oNOtlFM7Yl4MCsz.exe -
Loads dropped DLL 64 IoCs
pid Process 2028 setup_x86_x64_install - копия (21).exe 1940 setup_installer.exe 1940 setup_installer.exe 1940 setup_installer.exe 1940 setup_installer.exe 1940 setup_installer.exe 1940 setup_installer.exe 1700 setup_install.exe 1700 setup_install.exe 1700 setup_install.exe 1700 setup_install.exe 1700 setup_install.exe 1700 setup_install.exe 1700 setup_install.exe 1700 setup_install.exe 560 cmd.exe 816 cmd.exe 816 cmd.exe 1912 cmd.exe 1944 cmd.exe 1944 cmd.exe 1884 arnatic_1.exe 1884 arnatic_1.exe 272 cmd.exe 1588 cmd.exe 1588 cmd.exe 1728 arnatic_7.exe 1728 arnatic_7.exe 1624 arnatic_2.exe 1624 arnatic_2.exe 1392 cmd.exe 1776 arnatic_4.exe 1776 arnatic_4.exe 432 arnatic_6.exe 432 arnatic_6.exe 1776 arnatic_4.exe 1776 arnatic_4.exe 1568 jfiag3g_gg.exe 1568 jfiag3g_gg.exe 1728 arnatic_7.exe 1624 arnatic_2.exe 1940 arnatic_7.exe 1940 arnatic_7.exe 1776 arnatic_4.exe 1776 arnatic_4.exe 1736 jfiag3g_gg.exe 1736 jfiag3g_gg.exe 432 arnatic_6.exe 432 arnatic_6.exe 432 arnatic_6.exe 432 arnatic_6.exe 1292 rPuRvTuRihPtb_oJET9vtvkF.exe 1292 rPuRvTuRihPtb_oJET9vtvkF.exe 432 arnatic_6.exe 432 arnatic_6.exe 432 arnatic_6.exe 1820 gbqA1T8OpJBZiBmWghB8B4jG.exe 1820 gbqA1T8OpJBZiBmWghB8B4jG.exe 1724 DhvwzCCz3AxhoyZDObi6tW25.exe 1724 DhvwzCCz3AxhoyZDObi6tW25.exe 960 vB8sbezv6oNOtlFM7Yl4MCsz.exe 960 vB8sbezv6oNOtlFM7Yl4MCsz.exe 432 arnatic_6.exe 432 arnatic_6.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2064 icacls.exe -
resource yara_rule behavioral25/memory/960-209-0x00000000009A0000-0x00000000009A1000-memory.dmp themida behavioral25/memory/2112-224-0x0000000000E20000-0x0000000000E21000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vB8sbezv6oNOtlFM7Yl4MCsz.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 674nNeyQkxplcRyTy2VLoVZK.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 231 api.2ip.ua 9 ip-api.com 19 ipinfo.io 20 ipinfo.io 139 checkip.amazonaws.com 220 api.2ip.ua -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 960 vB8sbezv6oNOtlFM7Yl4MCsz.exe 2112 674nNeyQkxplcRyTy2VLoVZK.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1728 set thread context of 1940 1728 arnatic_7.exe 47 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\lighteningplayer\connection.dll PimZbrdVCNBVbYvdjr2Od_gW.exe File created C:\Program Files (x86)\lighteningplayer\data_load.exe PimZbrdVCNBVbYvdjr2Od_gW.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 2740 1884 WerFault.exe 40 2120 2644 WerFault.exe 72 2524 2124 WerFault.exe 60 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe -
Kills process with taskkill 1 IoCs
pid Process 1120 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 arnatic_6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a arnatic_6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a arnatic_6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 arnatic_6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 arnatic_6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1624 arnatic_2.exe 1624 arnatic_2.exe 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1736 jfiag3g_gg.exe 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1220 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1624 arnatic_2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1220 Process not Found Token: SeShutdownPrivilege 1220 Process not Found -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1940 2028 setup_x86_x64_install - копия (21).exe 26 PID 2028 wrote to memory of 1940 2028 setup_x86_x64_install - копия (21).exe 26 PID 2028 wrote to memory of 1940 2028 setup_x86_x64_install - копия (21).exe 26 PID 2028 wrote to memory of 1940 2028 setup_x86_x64_install - копия (21).exe 26 PID 2028 wrote to memory of 1940 2028 setup_x86_x64_install - копия (21).exe 26 PID 2028 wrote to memory of 1940 2028 setup_x86_x64_install - копия (21).exe 26 PID 2028 wrote to memory of 1940 2028 setup_x86_x64_install - копия (21).exe 26 PID 1940 wrote to memory of 1700 1940 setup_installer.exe 27 PID 1940 wrote to memory of 1700 1940 setup_installer.exe 27 PID 1940 wrote to memory of 1700 1940 setup_installer.exe 27 PID 1940 wrote to memory of 1700 1940 setup_installer.exe 27 PID 1940 wrote to memory of 1700 1940 setup_installer.exe 27 PID 1940 wrote to memory of 1700 1940 setup_installer.exe 27 PID 1940 wrote to memory of 1700 1940 setup_installer.exe 27 PID 1700 wrote to memory of 816 1700 setup_install.exe 32 PID 1700 wrote to memory of 816 1700 setup_install.exe 32 PID 1700 wrote to memory of 816 1700 setup_install.exe 32 PID 1700 wrote to memory of 816 1700 setup_install.exe 32 PID 1700 wrote to memory of 816 1700 setup_install.exe 32 PID 1700 wrote to memory of 816 1700 setup_install.exe 32 PID 1700 wrote to memory of 816 1700 setup_install.exe 32 PID 1700 wrote to memory of 1944 1700 setup_install.exe 33 PID 1700 wrote to memory of 1944 1700 setup_install.exe 33 PID 1700 wrote to memory of 1944 1700 setup_install.exe 33 PID 1700 wrote to memory of 1944 1700 setup_install.exe 33 PID 1700 wrote to memory of 1944 1700 setup_install.exe 33 PID 1700 wrote to memory of 1944 1700 setup_install.exe 33 PID 1700 wrote to memory of 1944 1700 setup_install.exe 33 PID 1700 wrote to memory of 1912 1700 setup_install.exe 38 PID 1700 wrote to memory of 1912 1700 setup_install.exe 38 PID 1700 wrote to memory of 1912 1700 setup_install.exe 38 PID 1700 wrote to memory of 1912 1700 setup_install.exe 38 PID 1700 wrote to memory of 1912 1700 setup_install.exe 38 PID 1700 wrote to memory of 1912 1700 setup_install.exe 38 PID 1700 wrote to memory of 1912 1700 setup_install.exe 38 PID 1700 wrote to memory of 272 1700 setup_install.exe 37 PID 1700 wrote to memory of 272 1700 setup_install.exe 37 PID 1700 wrote to memory of 272 1700 setup_install.exe 37 PID 1700 wrote to memory of 272 1700 setup_install.exe 37 PID 1700 wrote to memory of 272 1700 setup_install.exe 37 PID 1700 wrote to memory of 272 1700 setup_install.exe 37 PID 1700 wrote to memory of 272 1700 setup_install.exe 37 PID 1700 wrote to memory of 560 1700 setup_install.exe 36 PID 1700 wrote to memory of 560 1700 setup_install.exe 36 PID 1700 wrote to memory of 560 1700 setup_install.exe 36 PID 1700 wrote to memory of 560 1700 setup_install.exe 36 PID 1700 wrote to memory of 560 1700 setup_install.exe 36 PID 1700 wrote to memory of 560 1700 setup_install.exe 36 PID 1700 wrote to memory of 560 1700 setup_install.exe 36 PID 1700 wrote to memory of 1392 1700 setup_install.exe 35 PID 1700 wrote to memory of 1392 1700 setup_install.exe 35 PID 1700 wrote to memory of 1392 1700 setup_install.exe 35 PID 1700 wrote to memory of 1392 1700 setup_install.exe 35 PID 1700 wrote to memory of 1392 1700 setup_install.exe 35 PID 1700 wrote to memory of 1392 1700 setup_install.exe 35 PID 1700 wrote to memory of 1392 1700 setup_install.exe 35 PID 1700 wrote to memory of 1588 1700 setup_install.exe 34 PID 1700 wrote to memory of 1588 1700 setup_install.exe 34 PID 1700 wrote to memory of 1588 1700 setup_install.exe 34 PID 1700 wrote to memory of 1588 1700 setup_install.exe 34 PID 1700 wrote to memory of 1588 1700 setup_install.exe 34 PID 1700 wrote to memory of 1588 1700 setup_install.exe 34 PID 1700 wrote to memory of 1588 1700 setup_install.exe 34 PID 560 wrote to memory of 2000 560 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (21).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (21).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\7zS4973B404\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4973B404\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\7zS4973B404\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 9646⤵
- Program crash
PID:2740
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\7zS4973B404\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\7zS4973B404\arnatic_7.exearnatic_7.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\7zS4973B404\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS4973B404\arnatic_7.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\7zS4973B404\arnatic_6.exearnatic_6.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:432 -
C:\Users\Admin\Documents\rPuRvTuRihPtb_oJET9vtvkF.exe"C:\Users\Admin\Documents\rPuRvTuRihPtb_oJET9vtvkF.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\Documents\rPuRvTuRihPtb_oJET9vtvkF.exeC:\Users\Admin\Documents\rPuRvTuRihPtb_oJET9vtvkF.exe7⤵PID:2756
-
-
-
C:\Users\Admin\Documents\gbqA1T8OpJBZiBmWghB8B4jG.exe"C:\Users\Admin\Documents\gbqA1T8OpJBZiBmWghB8B4jG.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820
-
-
C:\Users\Admin\Documents\vB8sbezv6oNOtlFM7Yl4MCsz.exe"C:\Users\Admin\Documents\vB8sbezv6oNOtlFM7Yl4MCsz.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:960
-
-
C:\Users\Admin\Documents\DhvwzCCz3AxhoyZDObi6tW25.exe"C:\Users\Admin\Documents\DhvwzCCz3AxhoyZDObi6tW25.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\Documents\DhvwzCCz3AxhoyZDObi6tW25.exe"C:\Users\Admin\Documents\DhvwzCCz3AxhoyZDObi6tW25.exe"7⤵PID:2552
-
-
-
C:\Users\Admin\Documents\0ijsGlAKlGvbxOSwM_okWAA1.exe"C:\Users\Admin\Documents\0ijsGlAKlGvbxOSwM_okWAA1.exe"6⤵
- Executes dropped EXE
PID:2080 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"7⤵PID:2516
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"8⤵PID:2384
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2384.0.854913302\217432932" -parentBuildID 20200403170909 -prefsHandle 1104 -prefMapHandle 1096 -prefsLen 1 -prefMapSize 219622 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2384 "\\.\pipe\gecko-crash-server-pipe.2384" 1244 gpu9⤵PID:1896
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2384.3.1439818086\982536951" -childID 1 -isForBrowser -prefsHandle 4624 -prefMapHandle 4620 -prefsLen 156 -prefMapSize 219622 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2384 "\\.\pipe\gecko-crash-server-pipe.2384" 4636 tab9⤵PID:3520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2384.13.1481790632\1517126666" -childID 2 -isForBrowser -prefsHandle 3556 -prefMapHandle 3492 -prefsLen 7393 -prefMapSize 219622 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2384 "\\.\pipe\gecko-crash-server-pipe.2384" 4420 tab9⤵PID:3832
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2384.20.1941097575\1504394080" -childID 3 -isForBrowser -prefsHandle 3068 -prefMapHandle 3368 -prefsLen 8816 -prefMapSize 219622 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2384 "\\.\pipe\gecko-crash-server-pipe.2384" 2240 tab9⤵PID:2224
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"7⤵PID:1640
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef17d4f50,0x7fef17d4f60,0x7fef17d4f708⤵PID:2724
-
-
-
-
C:\Users\Admin\Documents\BBGiRcA_jAm1jQrAxPjoNvnp.exe"C:\Users\Admin\Documents\BBGiRcA_jAm1jQrAxPjoNvnp.exe"6⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\Documents\BBGiRcA_jAm1jQrAxPjoNvnp.exeC:\Users\Admin\Documents\BBGiRcA_jAm1jQrAxPjoNvnp.exe7⤵PID:2588
-
-
-
C:\Users\Admin\Documents\3KeYjxhw6rq4FcHNYdRnHKr1.exe"C:\Users\Admin\Documents\3KeYjxhw6rq4FcHNYdRnHKr1.exe"6⤵
- Executes dropped EXE
PID:2104
-
-
C:\Users\Admin\Documents\674nNeyQkxplcRyTy2VLoVZK.exe"C:\Users\Admin\Documents\674nNeyQkxplcRyTy2VLoVZK.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2112
-
-
C:\Users\Admin\Documents\Gh_YQCRgWCZaEyUXyA6qFIO4.exe"C:\Users\Admin\Documents\Gh_YQCRgWCZaEyUXyA6qFIO4.exe"6⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 14087⤵
- Program crash
PID:2524
-
-
-
C:\Users\Admin\Documents\PimZbrdVCNBVbYvdjr2Od_gW.exe"C:\Users\Admin\Documents\PimZbrdVCNBVbYvdjr2Od_gW.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2156 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsiF5E.tmp\tempfile.ps1"7⤵PID:1388
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsiF5E.tmp\tempfile.ps1"7⤵PID:2472
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsiF5E.tmp\tempfile.ps1"7⤵PID:2628
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsiF5E.tmp\tempfile.ps1"7⤵PID:3368
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsiF5E.tmp\tempfile.ps1"7⤵PID:3780
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsiF5E.tmp\tempfile.ps1"7⤵PID:2996
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsiF5E.tmp\tempfile.ps1"7⤵PID:2092
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵PID:2268
-
-
-
C:\Users\Admin\Documents\bhe1W3bshhtus2jkQU1MEjQ_.exe"C:\Users\Admin\Documents\bhe1W3bshhtus2jkQU1MEjQ_.exe"6⤵PID:2336
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"7⤵PID:2548
-
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"7⤵PID:2612
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl8⤵PID:3024
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵PID:2644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 2928⤵
- Program crash
PID:2120
-
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:2424
-
-
-
-
C:\Users\Admin\Documents\zeHL4LQ9Zr5Hee4izKvrOK9L.exe"C:\Users\Admin\Documents\zeHL4LQ9Zr5Hee4izKvrOK9L.exe"6⤵
- Executes dropped EXE
PID:2320
-
-
C:\Users\Admin\Documents\h59SYSHnOWQv8MvGEbLKBRHE.exe"C:\Users\Admin\Documents\h59SYSHnOWQv8MvGEbLKBRHE.exe"6⤵PID:2312
-
-
C:\Users\Admin\Documents\iFBKVWtqTErmeXwynMl43903.exe"C:\Users\Admin\Documents\iFBKVWtqTErmeXwynMl43903.exe"6⤵PID:2384
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "iFBKVWtqTErmeXwynMl43903.exe" /f & erase "C:\Users\Admin\Documents\iFBKVWtqTErmeXwynMl43903.exe" & exit7⤵PID:1832
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "iFBKVWtqTErmeXwynMl43903.exe" /f8⤵
- Kills process with taskkill
PID:1120
-
-
-
-
C:\Users\Admin\Documents\0I5rwmjieXS5DGLIGnxKDUfC.exe"C:\Users\Admin\Documents\0I5rwmjieXS5DGLIGnxKDUfC.exe"6⤵PID:2376
-
C:\Program Files (x86)\Browzar\Browzar.exe"C:\Program Files (x86)\Browzar\Browzar.exe"7⤵PID:2688
-
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"7⤵PID:2632
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"8⤵PID:2680
-
-
-
-
C:\Users\Admin\Documents\diCtYqFWrHYClfmQWG_wMLWM.exe"C:\Users\Admin\Documents\diCtYqFWrHYClfmQWG_wMLWM.exe"6⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\is-P4KUV.tmp\diCtYqFWrHYClfmQWG_wMLWM.tmp"C:\Users\Admin\AppData\Local\Temp\is-P4KUV.tmp\diCtYqFWrHYClfmQWG_wMLWM.tmp" /SL5="$B0156,28982256,486912,C:\Users\Admin\Documents\diCtYqFWrHYClfmQWG_wMLWM.exe"7⤵PID:2872
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\7zS4973B404\arnatic_5.exearnatic_5.exe5⤵
- Executes dropped EXE
PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\7zS4973B404\arnatic_4.exearnatic_4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1736
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\7zS4973B404\arnatic_3.exearnatic_3.exe5⤵
- Executes dropped EXE
PID:1868
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\95AB.exeC:\Users\Admin\AppData\Local\Temp\95AB.exe1⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\95AB.exeC:\Users\Admin\AppData\Local\Temp\95AB.exe2⤵PID:3528
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\97192cd3-6bec-4a0f-9696-c8c684f3dc07" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:2064
-
-
-
C:\Users\Admin\AppData\Local\Temp\B9EE.exeC:\Users\Admin\AppData\Local\Temp\B9EE.exe1⤵PID:2144
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Disabling Security Tools
1File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1