danabot | 0a3c1d6736893714d0e5552795fb8ba026ba2bd3f5e34afd975b9d463c1e46fe

Analysis

max time kernel
149s
max time network
136s
platform
windows10_x64
resource
win10v20210408
submitted
21-07-2021 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de9a1e3fbb72d4a01fabee53230f2017.exe
Size

442KB
MD5

de9a1e3fbb72d4a01fabee53230f2017
SHA1

b7c3bad04551b68b408ef4eb3f9be2fab836d3db
SHA256

0a3c1d6736893714d0e5552795fb8ba026ba2bd3f5e34afd975b9d463c1e46fe
SHA512

e6f563f845c504a12aafab4dc7c773370157ac957d9de1bedf46a210c8def8bc93246cff4132efa7253ee6ee7846519ac540f65d301f7e734188a29101049b0b

Score

10^/10

danabot 4 banker discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1987

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB

rsa_privkey.plain

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 6 IoCs

Processes:

WScript.exerundll32.exeRUNDLL32.EXE

flow pid process

30 2304 WScript.exe
32 2304 WScript.exe
34 2304 WScript.exe
36 2304 WScript.exe
38 1672 rundll32.exe
39 3180 RUNDLL32.EXE
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

4.exevpn.exeSmartClock.exeughcwyiy.exe

pid process

1824 4.exe
3404 vpn.exe
2892 SmartClock.exe
2288 ughcwyiy.exe
Drops startup file 1 IoCs

Processes:

4.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 4.exe
Loads dropped DLL 3 IoCs

Processes:

de9a1e3fbb72d4a01fabee53230f2017.exerundll32.exeRUNDLL32.EXE

pid process

636 de9a1e3fbb72d4a01fabee53230f2017.exe
1672 rundll32.exe
3180 RUNDLL32.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip-api.com

flow	pid	process
30	2304	WScript.exe
32	2304	WScript.exe
34	2304	WScript.exe
36	2304	WScript.exe
38	1672	rundll32.exe
39	3180	RUNDLL32.EXE

pid	process
1824	4.exe
3404	vpn.exe
2892	SmartClock.exe
2288	ughcwyiy.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe

pid	process
636	de9a1e3fbb72d4a01fabee53230f2017.exe
1672	rundll32.exe
3180	RUNDLL32.EXE

flow	ioc
10	ip-api.com

Drops file in Program Files directory 4 IoCs

Processes:

de9a1e3fbb72d4a01fabee53230f2017.exerundll32.exe

description	ioc	process
File created	C:\Program Files (x86)\foler\olader\acppage.dll	de9a1e3fbb72d4a01fabee53230f2017.exe
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	de9a1e3fbb72d4a01fabee53230f2017.exe
File created	C:\Program Files (x86)\foler\olader\acledit.dll	de9a1e3fbb72d4a01fabee53230f2017.exe
File created	C:\PROGRA~3\Jvgzbfh.tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 27 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RUNDLL32.EXEvpn.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vpn.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vpn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	RUNDLL32.EXE

Modifies registry class 1 IoCs

Processes:

vpn.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings vpn.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	vpn.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

RUNDLL32.EXEWScript.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\48D3F95A4169F76AFA9F21C7D73BD5363F022809\Blob = 03000000010000001400000048d3f95a4169f76afa9f21c7d73bd5363f02280920000000010000009902000030820295308201fea0030201020208296be8d3677cef1a300d06092a864886f70d01010b050030653137303506035504030c2e5379386d616e74656320456e7465727072697365204d6f62696c6520526f6f7420666f72204d6963726f736f6674311d301b060355040a0c1453796d616e74656320436f72706f726174696f6e310b3009060355040613025553301e170d3139303732323136313531305a170d3233303732313136313531305a30653137303506035504030c2e5379386d616e74656320456e7465727072697365204d6f62696c6520526f6f7420666f72204d6963726f736f6674311d301b060355040a0c1453796d616e74656320436f72706f726174696f6e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100d6be8d0479baccab9c31ca0317c3a88eef1275f123851d90c5ada318430e176c31c6fdd117f1c34333c0417adc6bfa089ac1f1a7a50e1caab633da5f689812a520eb24f0909fe9762fd81e3c8d9a86191439632d77a1db15fbe35fe32a84213e8f8d6879bad47f3242b4b87f7a652352171c7f4e31bf7901df9c427e620ad9250203010001a34e304c300f0603551d130101ff040530030101ff30390603551d1104323030822e5379386d616e74656320456e7465727072697365204d6f62696c6520526f6f7420666f72204d6963726f736f6674300d06092a864886f70d01010b0500038181008345d52b0c0962cd3d7539e8a2e1308f5304ac3ec811a228e9ce97a234008255d1dfe00601182b9be9bd98fbcc20011653e35a0500b7dbdfcda918158623bc7cb1ba1f1025f5d565f262559b573c7f3d4c08196a9513b238e6e46140ea1c64eb8bb5cfcabeea0197741295288cf86253671922901add0053470eba22b9fdd1c5	RUNDLL32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\48D3F95A4169F76AFA9F21C7D73BD5363F022809	RUNDLL32.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

SmartClock.exe

pid process

2892 SmartClock.exe

pid	process
2892	SmartClock.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

RUNDLL32.EXEpowershell.exepowershell.exe

pid	process
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RUNDLL32.EXEpowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3180 RUNDLL32.EXE
Token: SeDebugPrivilege 3632 powershell.exe
Token: SeDebugPrivilege 3404 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RUNDLL32.EXE

pid process

3180 RUNDLL32.EXE

description	pid	process
Token: SeDebugPrivilege	3180	RUNDLL32.EXE
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

de9a1e3fbb72d4a01fabee53230f2017.exe4.exevpn.exeughcwyiy.exerundll32.exeRUNDLL32.EXEpowershell.exe

description	pid	process	target process
PID 636 wrote to memory of 1824	636	de9a1e3fbb72d4a01fabee53230f2017.exe	4.exe
PID 636 wrote to memory of 1824	636	de9a1e3fbb72d4a01fabee53230f2017.exe	4.exe
PID 636 wrote to memory of 1824	636	de9a1e3fbb72d4a01fabee53230f2017.exe	4.exe
PID 636 wrote to memory of 3404	636	de9a1e3fbb72d4a01fabee53230f2017.exe	vpn.exe
PID 636 wrote to memory of 3404	636	de9a1e3fbb72d4a01fabee53230f2017.exe	vpn.exe
PID 636 wrote to memory of 3404	636	de9a1e3fbb72d4a01fabee53230f2017.exe	vpn.exe
PID 1824 wrote to memory of 2892	1824	4.exe	SmartClock.exe
PID 1824 wrote to memory of 2892	1824	4.exe	SmartClock.exe
PID 1824 wrote to memory of 2892	1824	4.exe	SmartClock.exe
PID 3404 wrote to memory of 2288	3404	vpn.exe	ughcwyiy.exe
PID 3404 wrote to memory of 2288	3404	vpn.exe	ughcwyiy.exe
PID 3404 wrote to memory of 2288	3404	vpn.exe	ughcwyiy.exe
PID 3404 wrote to memory of 2068	3404	vpn.exe	WScript.exe
PID 3404 wrote to memory of 2068	3404	vpn.exe	WScript.exe
PID 3404 wrote to memory of 2068	3404	vpn.exe	WScript.exe
PID 2288 wrote to memory of 1672	2288	ughcwyiy.exe	rundll32.exe
PID 2288 wrote to memory of 1672	2288	ughcwyiy.exe	rundll32.exe
PID 2288 wrote to memory of 1672	2288	ughcwyiy.exe	rundll32.exe
PID 3404 wrote to memory of 2304	3404	vpn.exe	WScript.exe
PID 3404 wrote to memory of 2304	3404	vpn.exe	WScript.exe
PID 3404 wrote to memory of 2304	3404	vpn.exe	WScript.exe
PID 1672 wrote to memory of 3180	1672	rundll32.exe	RUNDLL32.EXE
PID 1672 wrote to memory of 3180	1672	rundll32.exe	RUNDLL32.EXE
PID 1672 wrote to memory of 3180	1672	rundll32.exe	RUNDLL32.EXE
PID 3180 wrote to memory of 3632	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 3632	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 3632	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 3404	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 3404	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 3404	3180	RUNDLL32.EXE	powershell.exe
PID 3404 wrote to memory of 1168	3404	powershell.exe	nslookup.exe
PID 3404 wrote to memory of 1168	3404	powershell.exe	nslookup.exe
PID 3404 wrote to memory of 1168	3404	powershell.exe	nslookup.exe
PID 3180 wrote to memory of 3380	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 3380	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 3380	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 3276	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 3276	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 3276	3180	RUNDLL32.EXE	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\de9a1e3fbb72d4a01fabee53230f2017.exe
"C:\Users\Admin\AppData\Local\Temp\de9a1e3fbb72d4a01fabee53230f2017.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
  "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
    "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    PID:2892
- C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
  "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Users\Admin\AppData\Local\Temp\ughcwyiy.exe
    "C:\Users\Admin\AppData\Local\Temp\ughcwyiy.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\UGHCWY~1.TMP,S C:\Users\Admin\AppData\Local\Temp\ughcwyiy.exe
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\UGHCWY~1.TMP,GREIdg==
        5⤵
        Blocklisted process makes network request
        Loads dropped DLL
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3180
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpF2AE.tmp.ps1"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp1309.tmp.ps1"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\SysWOW64\nslookup.exe
        
        "C:\Windows\system32\nslookup.exe" -type=any localhost
        7⤵
        
        PID:1168
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        6⤵
        
        PID:3380
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
        6⤵
        
        PID:3276
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ohtkhixjso.vbs"
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efxuiopjs.vbs"
    3⤵
    - Blocklisted process makes network request
    - Modifies system certificate store
    PID:2304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Jvgzbfh.tmp

MD5
bbf0cc3f730ca83be014722696956267

SHA1
b4c8822a67d708da1cbb60e5285ccdc9b00b8f61

SHA256
da2edd3aca68dbf630edf299e9ff0b1d38c66f9c649530af771ea5e6538ca149

SHA512
cf278195eebaf23165542ab3aa4b0d72dc519890ed8187233dcc98a1989d73c16f805a1640291e31d2ddb325ce296ab8dddb61b99663f8b86abe9013dea22e85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5
47eebe401625bbc55e75dbfb72e9e89a

SHA1
db3b2135942d2532c59b9788253638eb77e5995e

SHA256
f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3

SHA512
590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
41fa62a01c166864d2eabf35fcfae409

SHA1
8819be9289afbe7abf9295bd970bc090fab3cb94

SHA256
63d559a6e7df8359b689a7efd2bef11a33b6a345499093625fe14586783bbc76

SHA512
8a41907be0732ffe61deb66186fc7783dadfaebc908484a8d756de8f29569c0526b59d7947bca209a2e1432e5a01967b606651cfd32e3e342aa06e14be2fa445

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe

MD5
0e6d7e62faedce395b8085c567bb846b

SHA1
fbe0b111cc601bc68dc324085d0b89d638189d98

SHA256
fdffc0be815c57615e37f49cbed111dfc9449071041a2836e7d69b110c7bdfdf

SHA512
022087868ed8b4f9dea1d76a14b821350692d35d32100bcd6608c661a077431d665dd610b346bd8a565c6f0e86c6a240abe796593b9aac64882555aee7a47dc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe

MD5
0e6d7e62faedce395b8085c567bb846b

SHA1
fbe0b111cc601bc68dc324085d0b89d638189d98

SHA256
fdffc0be815c57615e37f49cbed111dfc9449071041a2836e7d69b110c7bdfdf

SHA512
022087868ed8b4f9dea1d76a14b821350692d35d32100bcd6608c661a077431d665dd610b346bd8a565c6f0e86c6a240abe796593b9aac64882555aee7a47dc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe

MD5
4c378f599a8970479566727dbd830cb9

SHA1
e1a5c9e28775f5d01f5e2bd0e8ba867f5e6c0e8d

SHA256
f7bff342c5b9c9f5260dcfad39f4efb34219a303a8fde835a5ce657b9f593c10

SHA512
b01b466e8e802c6e1eb8a9992459fd6c8c4447a854ea7a7001410665cf42eeebba06365a1dd6268ef0f31a01246eb912a17a0f63f47dad3018a8518ddd7ce0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe

MD5
4c378f599a8970479566727dbd830cb9

SHA1
e1a5c9e28775f5d01f5e2bd0e8ba867f5e6c0e8d

SHA256
f7bff342c5b9c9f5260dcfad39f4efb34219a303a8fde835a5ce657b9f593c10

SHA512
b01b466e8e802c6e1eb8a9992459fd6c8c4447a854ea7a7001410665cf42eeebba06365a1dd6268ef0f31a01246eb912a17a0f63f47dad3018a8518ddd7ce0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\UGHCWY~1.TMP

MD5
00ff83979f4cc5eaf1aa08e4cd33edc6

SHA1
5f6a6d4d1b34b7f5a46591fe027092c6cc9b3194

SHA256
f04c14adc92fcb5c10a00484e705397b5597930c7915cd5a1147b4c742f439da

SHA512
64d6158cf9c9c1004bc53391b676e8b8c29264fc6756e47cc13fbc1049a9c58a43af871e4426d9650eb2f447b8599284e770df67ca6a7a2a3fbccd862d007aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\efxuiopjs.vbs

MD5
50c62c57711ef71620e82ac8be9fca71

SHA1
89f214a6744f26fca013fa7ac4eaa59bfe0e46b9

SHA256
2d2f6917ad5fd560786c9ff0222047227459c734e90119f9535d35cb3d7d3cf0

SHA512
d89906f81d0ea9da03105504d29a9edb2ac7c941c853295edbd4f948abf1c98ddf3a8ca14f2f64f8a19331915ee160dc813e4b456b13e638dbaa546aaf4ecf35

Download Submit
C:\Users\Admin\AppData\Local\Temp\ohtkhixjso.vbs

MD5
5e1a33d4ae194d8e201fd2d3b06c3546

SHA1
7d97399ad3cd9856ee0e4e176f85c4d43b5a6d0c

SHA256
f5a1f00904ffb59aea748d3c6ac32a9632f8ba4e0d4f6f373efbc8d7f90f6e28

SHA512
2e748f9867be994ab6e0597f430dd6394c27790817367967944744567a9e1e70bfaaa980b24419604d9e34dfffae23c0bcc073e21dee599c066684d0eb94dd94

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1309.tmp.ps1

MD5
68c8ee886d0b8076f40abbe9fbd521dd

SHA1
73aeb68a6db1a3717fb88bdabf4e27b649666b4c

SHA256
871b7c75349ed15d9bb9a4246272a1cc59cce6d8d2578b82fbd022fd27fd4162

SHA512
6204c1f7df068a835df1d58d16903ff6218bc3833d157849f18b7e0ff1e5ed35b0852e899a63cc7daf362c5398100cf29cda120093feb6c10100d145734f68c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp130A.tmp

MD5
1860260b2697808b80802352fe324782

SHA1
f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

SHA256
0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

SHA512
d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF2AE.tmp.ps1

MD5
ee45c38dcb7213115142eff97fe6aee5

SHA1
67776114a23ad508ced54c407c7c3c8c6e976320

SHA256
64e912f0c745dc2fb2df1c3312900bd9eb5f793da31e0a8b8a60a55f63ad73a1

SHA512
33731d4907d8408800c8b482dbcb7369e8f2b1482f8f32a656780d5d428207973e44bfba1d9ceb7a5b56dbd5c2394e6bc1f47d3db9308d588a1df8c5c16cdbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF2AF.tmp

MD5
c416c12d1b2b1da8c8655e393b544362

SHA1
fb1a43cd8e1c556c2d25f361f42a21293c29e447

SHA256
0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046

SHA512
cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ughcwyiy.exe

MD5
4e354c8f5394194cbb050013ca650b87

SHA1
c7ab97a847e5aa2e895b6f1a40bad44699f513f7

SHA256
03a65d601080c142ecf9f97f46b3694623ee1883b233e7c6d1ddf30c03da67b8

SHA512
48ba06eb3a11476e971cdab161f48972e88038eff44e5b29f22dd5031c296e55d393e9408170593791c0ce561d2766c60bb01e4c3feffa6b6998b7ae033bc1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ughcwyiy.exe

MD5
4e354c8f5394194cbb050013ca650b87

SHA1
c7ab97a847e5aa2e895b6f1a40bad44699f513f7

SHA256
03a65d601080c142ecf9f97f46b3694623ee1883b233e7c6d1ddf30c03da67b8

SHA512
48ba06eb3a11476e971cdab161f48972e88038eff44e5b29f22dd5031c296e55d393e9408170593791c0ce561d2766c60bb01e4c3feffa6b6998b7ae033bc1b8

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe

MD5
0e6d7e62faedce395b8085c567bb846b

SHA1
fbe0b111cc601bc68dc324085d0b89d638189d98

SHA256
fdffc0be815c57615e37f49cbed111dfc9449071041a2836e7d69b110c7bdfdf

SHA512
022087868ed8b4f9dea1d76a14b821350692d35d32100bcd6608c661a077431d665dd610b346bd8a565c6f0e86c6a240abe796593b9aac64882555aee7a47dc2

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe

MD5
0e6d7e62faedce395b8085c567bb846b

SHA1
fbe0b111cc601bc68dc324085d0b89d638189d98

SHA256
fdffc0be815c57615e37f49cbed111dfc9449071041a2836e7d69b110c7bdfdf

SHA512
022087868ed8b4f9dea1d76a14b821350692d35d32100bcd6608c661a077431d665dd610b346bd8a565c6f0e86c6a240abe796593b9aac64882555aee7a47dc2

Download Submit
\Users\Admin\AppData\Local\Temp\UGHCWY~1.TMP

MD5
00ff83979f4cc5eaf1aa08e4cd33edc6

SHA1
5f6a6d4d1b34b7f5a46591fe027092c6cc9b3194

SHA256
f04c14adc92fcb5c10a00484e705397b5597930c7915cd5a1147b4c742f439da

SHA512
64d6158cf9c9c1004bc53391b676e8b8c29264fc6756e47cc13fbc1049a9c58a43af871e4426d9650eb2f447b8599284e770df67ca6a7a2a3fbccd862d007aa6

Download Submit
\Users\Admin\AppData\Local\Temp\UGHCWY~1.TMP

MD5
00ff83979f4cc5eaf1aa08e4cd33edc6

SHA1
5f6a6d4d1b34b7f5a46591fe027092c6cc9b3194

SHA256
f04c14adc92fcb5c10a00484e705397b5597930c7915cd5a1147b4c742f439da

SHA512
64d6158cf9c9c1004bc53391b676e8b8c29264fc6756e47cc13fbc1049a9c58a43af871e4426d9650eb2f447b8599284e770df67ca6a7a2a3fbccd862d007aa6

Download Submit
\Users\Admin\AppData\Local\Temp\nse9CF2.tmp\UAC.dll

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
memory/1168-200-0x0000000000000000-mapping.dmp

Download
memory/1672-142-0x00000000053C0000-0x0000000006656000-memory.dmp

Filesize
18.6MB

Download
memory/1672-136-0x0000000000000000-mapping.dmp

Download
memory/1824-126-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/1824-124-0x0000000000980000-0x0000000000ACA000-memory.dmp

Filesize
1.3MB

Download
memory/1824-115-0x0000000000000000-mapping.dmp

Download
memory/2068-133-0x0000000000000000-mapping.dmp

Download
memory/2288-139-0x0000000000400000-0x0000000002C5F000-memory.dmp

Filesize
40.4MB

Download
memory/2288-135-0x00000000049E0000-0x0000000004AE1000-memory.dmp

Filesize
1.0MB

Download
memory/2288-130-0x0000000000000000-mapping.dmp

Download
memory/2304-140-0x0000000000000000-mapping.dmp

Download
memory/2892-129-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/2892-128-0x00000000008A0000-0x00000000009EA000-memory.dmp

Filesize
1.3MB

Download
memory/2892-121-0x0000000000000000-mapping.dmp

Download
memory/3180-150-0x0000000004E10000-0x00000000060A6000-memory.dmp

Filesize
18.6MB

Download
memory/3180-145-0x0000000000000000-mapping.dmp

Download
memory/3276-205-0x0000000000000000-mapping.dmp

Download
memory/3380-203-0x0000000000000000-mapping.dmp

Download
memory/3404-177-0x0000000000000000-mapping.dmp

Download
memory/3404-204-0x00000000044B3000-0x00000000044B4000-memory.dmp

Filesize
4KB

Download
memory/3404-118-0x0000000000000000-mapping.dmp

Download
memory/3404-125-0x00000000009F0000-0x0000000000A14000-memory.dmp

Filesize
144KB

Download
memory/3404-127-0x0000000000400000-0x000000000089D000-memory.dmp

Filesize
4.6MB

Download
memory/3404-191-0x00000000044B2000-0x00000000044B3000-memory.dmp

Filesize
4KB

Download
memory/3404-190-0x00000000044B0000-0x00000000044B1000-memory.dmp

Filesize
4KB

Download
memory/3404-189-0x0000000007FF0000-0x0000000007FF1000-memory.dmp

Filesize
4KB

Download
memory/3404-186-0x00000000079D0000-0x00000000079D1000-memory.dmp

Filesize
4KB

Download
memory/3632-163-0x0000000007FD0000-0x0000000007FD1000-memory.dmp

Filesize
4KB

Download
memory/3632-164-0x0000000008040000-0x0000000008041000-memory.dmp

Filesize
4KB

Download
memory/3632-154-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/3632-176-0x00000000045B3000-0x00000000045B4000-memory.dmp

Filesize
4KB

Download
memory/3632-172-0x0000000008CE0000-0x0000000008CE1000-memory.dmp

Filesize
4KB

Download
memory/3632-151-0x0000000000000000-mapping.dmp

Download
memory/3632-171-0x0000000009750000-0x0000000009751000-memory.dmp

Filesize
4KB

Download
memory/3632-166-0x00000000080F0000-0x00000000080F1000-memory.dmp

Filesize
4KB

Download
memory/3632-155-0x00000000044A0000-0x00000000044A1000-memory.dmp

Filesize
4KB

Download
memory/3632-173-0x0000000006B20000-0x0000000006B21000-memory.dmp

Filesize
4KB

Download
memory/3632-156-0x0000000006F70000-0x0000000006F71000-memory.dmp

Filesize
4KB

Download
memory/3632-162-0x0000000007810000-0x0000000007811000-memory.dmp

Filesize
4KB

Download
memory/3632-161-0x00000000078C0000-0x00000000078C1000-memory.dmp

Filesize
4KB

Download
memory/3632-160-0x0000000007780000-0x0000000007781000-memory.dmp

Filesize
4KB

Download
memory/3632-159-0x0000000007610000-0x0000000007611000-memory.dmp

Filesize
4KB

Download
memory/3632-158-0x0000000006EE0000-0x0000000006EE1000-memory.dmp

Filesize
4KB

Download
memory/3632-157-0x00000000045B2000-0x00000000045B3000-memory.dmp

Filesize
4KB

Download