Overview
overview
10Static
static
100f56c5738a...f08901
linux_amd64
0f56c5738a...f08901
linux_mipsel
0f56c5738a...f08901
linux_mips
219156c025...f0.exe
windows7_x64
10219156c025...f0.exe
windows10_x64
102a0f53dd66...03.exe
windows7_x64
102a0f53dd66...03.exe
windows10_x64
1036ef5e0db1...a0.exe
windows7_x64
1036ef5e0db1...a0.exe
windows10_x64
104072fc745a...65.exe
windows7_x64
104072fc745a...65.exe
windows10_x64
1042c8ded976...95.exe
windows7_x64
1042c8ded976...95.exe
windows10_x64
1052969fae09...5d.rtf
windows7_x64
1052969fae09...5d.rtf
windows10_x64
10571de4698e...31.exe
windows7_x64
10571de4698e...31.exe
windows10_x64
1057bb59a2c4...52.rtf
windows7_x64
1057bb59a2c4...52.rtf
windows10_x64
10662fbe23c8...0a.exe
windows7_x64
10662fbe23c8...0a.exe
windows10_x64
1070d5a71e82...91.dll
windows7_x64
170d5a71e82...91.dll
windows10_x64
171d384c258...86.exe
windows7_x64
1071d384c258...86.exe
windows10_x64
1079745c2263...9d.exe
windows7_x64
1079745c2263...9d.exe
windows10_x64
1083c46c1972...c3.exe
windows7_x64
1083c46c1972...c3.exe
windows10_x64
108cecb6b01a...d0.exe
windows7_x64
108cecb6b01a...d0.exe
windows10_x64
10a3feb5265e...66.exe
windows7_x64
10Analysis
-
max time kernel
150s -
max time network
182s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30-07-2021 15:26
Behavioral task
behavioral1
Sample
0f56c5738ae435abeac7a0928a5de2ff5d4082370c43f257a4c0589212f08901
Resource
ubuntu-amd64
linux_amd64
Behavioral task
behavioral2
Sample
0f56c5738ae435abeac7a0928a5de2ff5d4082370c43f257a4c0589212f08901
Resource
debian9-mipsel
linux_mipsel
Behavioral task
behavioral3
Sample
0f56c5738ae435abeac7a0928a5de2ff5d4082370c43f257a4c0589212f08901
Resource
debian9-mipsbe
linux_mips
Behavioral task
behavioral4
Sample
219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral5
Sample
219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral6
Sample
2a0f53dd66eff57c82fcad2fff75d7ac63f6f4d764ec27fe862e6b3f01a21c03.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral7
Sample
2a0f53dd66eff57c82fcad2fff75d7ac63f6f4d764ec27fe862e6b3f01a21c03.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral8
Sample
36ef5e0db18469267810503ba4fd099e59007c3f10f718bccffdc93e87a853a0.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral9
Sample
36ef5e0db18469267810503ba4fd099e59007c3f10f718bccffdc93e87a853a0.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral10
Sample
4072fc745ae1b976bfff8fdfdebdac6db5e33bb4f63507b4d56ab67b98c6db65.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral11
Sample
4072fc745ae1b976bfff8fdfdebdac6db5e33bb4f63507b4d56ab67b98c6db65.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral12
Sample
42c8ded976a7c9f295888220d4d2fc273535f1fa15e6e25cfceaf454188f7895.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral13
Sample
42c8ded976a7c9f295888220d4d2fc273535f1fa15e6e25cfceaf454188f7895.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral14
Sample
52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d.rtf
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral15
Sample
52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d.rtf
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral16
Sample
571de4698edff95c328d3521b11e800a3b9659ad55281dd7729b2ce2210ac931.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral17
Sample
571de4698edff95c328d3521b11e800a3b9659ad55281dd7729b2ce2210ac931.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral18
Sample
57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752.rtf
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral19
Sample
57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752.rtf
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral20
Sample
662fbe23c87844a881ca233876ff75ee05ddf2ac0a1b5546fb5bc7603474860a.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral21
Sample
662fbe23c87844a881ca233876ff75ee05ddf2ac0a1b5546fb5bc7603474860a.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral22
Sample
70d5a71e821c8024fa2d5fb8a389390acc1289b88745fad61b6536cab0bd5191.dll
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral23
Sample
70d5a71e821c8024fa2d5fb8a389390acc1289b88745fad61b6536cab0bd5191.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral24
Sample
71d384c258d0d2cfbeeda66a1ba67085b347d934a3484e0df3fc06a684085386.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral25
Sample
71d384c258d0d2cfbeeda66a1ba67085b347d934a3484e0df3fc06a684085386.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral26
Sample
79745c2263c8abe5b916e39e577652c029b5b586e7ccb39ee63ed0fc1568c39d.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral27
Sample
79745c2263c8abe5b916e39e577652c029b5b586e7ccb39ee63ed0fc1568c39d.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral28
Sample
83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral29
Sample
83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral30
Sample
8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral31
Sample
8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral32
Sample
a3feb5265e6d02710f04ff618e966e9da9ba8fc8dc5692d6f7633fe0a3037b66.exe
Resource
win7v20210410
windows7_x64
General
-
Target
83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe
-
Size
708KB
-
MD5
b2a93feb45e2d76bdfc83c623a14d5bf
-
SHA1
f39c5e92adb9ba4602d8973cc286ab265f11d137
-
SHA256
83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3
-
SHA512
db93fcade10ff3b4291d6337acdb9a675e178154d98c1feb5f5c63e814edd08a37cfcab0140a6e0b84e5013127a93c8c4c4249c5d669a148fb0caf65575c66a5
Malware Config
Extracted
vidar
39.7
517
https://shpak125.tumblr.com/
-
profile_id
517
Signatures
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer 4 IoCs
resource yara_rule behavioral28/memory/1740-83-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar behavioral28/memory/1740-84-0x000000000046B76D-mapping.dmp family_vidar behavioral28/memory/1300-87-0x0000000001C50000-0x0000000001CEE000-memory.dmp family_vidar behavioral28/memory/1740-88-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 1300 build2.exe 1740 build2.exe 1072 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe -
Loads dropped DLL 6 IoCs
pid Process 1124 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 1124 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 1740 build2.exe 1740 build2.exe 1740 build2.exe 1740 build2.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 540 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b46544cb-1721-4c10-9f1b-6501dc4a3d75\\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe\" --AutoStart" 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.2ip.ua 14 api.2ip.ua 5 api.2ip.ua -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1884 set thread context of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1600 set thread context of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1300 set thread context of 1740 1300 build2.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1400 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 452 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 1124 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 1124 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 1740 build2.exe 1740 build2.exe 1740 build2.exe 1740 build2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 452 taskkill.exe -
Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1884 wrote to memory of 1264 1884 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 29 PID 1264 wrote to memory of 540 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 32 PID 1264 wrote to memory of 540 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 32 PID 1264 wrote to memory of 540 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 32 PID 1264 wrote to memory of 540 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 32 PID 1264 wrote to memory of 1600 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 33 PID 1264 wrote to memory of 1600 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 33 PID 1264 wrote to memory of 1600 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 33 PID 1264 wrote to memory of 1600 1264 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 33 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1600 wrote to memory of 1124 1600 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 34 PID 1124 wrote to memory of 1300 1124 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 36 PID 1124 wrote to memory of 1300 1124 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 36 PID 1124 wrote to memory of 1300 1124 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 36 PID 1124 wrote to memory of 1300 1124 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe 36 PID 1300 wrote to memory of 1740 1300 build2.exe 37 PID 1300 wrote to memory of 1740 1300 build2.exe 37 PID 1300 wrote to memory of 1740 1300 build2.exe 37 PID 1300 wrote to memory of 1740 1300 build2.exe 37 PID 1300 wrote to memory of 1740 1300 build2.exe 37 PID 1300 wrote to memory of 1740 1300 build2.exe 37 PID 1300 wrote to memory of 1740 1300 build2.exe 37 PID 1300 wrote to memory of 1740 1300 build2.exe 37 PID 1300 wrote to memory of 1740 1300 build2.exe 37 PID 1740 wrote to memory of 1556 1740 build2.exe 39 PID 1740 wrote to memory of 1556 1740 build2.exe 39 PID 1740 wrote to memory of 1556 1740 build2.exe 39 PID 1740 wrote to memory of 1556 1740 build2.exe 39 PID 1556 wrote to memory of 452 1556 cmd.exe 41 PID 1556 wrote to memory of 452 1556 cmd.exe 41 PID 1556 wrote to memory of 452 1556 cmd.exe 41 PID 1556 wrote to memory of 452 1556 cmd.exe 41 PID 1556 wrote to memory of 1400 1556 cmd.exe 43 PID 1556 wrote to memory of 1400 1556 cmd.exe 43 PID 1556 wrote to memory of 1400 1556 cmd.exe 43 PID 1556 wrote to memory of 1400 1556 cmd.exe 43 PID 592 wrote to memory of 1072 592 taskeng.exe 45 PID 592 wrote to memory of 1072 592 taskeng.exe 45 PID 592 wrote to memory of 1072 592 taskeng.exe 45 PID 592 wrote to memory of 1072 592 taskeng.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe"C:\Users\Admin\AppData\Local\Temp\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe"C:\Users\Admin\AppData\Local\Temp\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\b46544cb-1721-4c10-9f1b-6501dc4a3d75" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:540
-
-
C:\Users\Admin\AppData\Local\Temp\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe"C:\Users\Admin\AppData\Local\Temp\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe"C:\Users\Admin\AppData\Local\Temp\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\0dc040fd-d0ca-44dd-bdf9-02f2844c67ef\build2.exe"C:\Users\Admin\AppData\Local\0dc040fd-d0ca-44dd-bdf9-02f2844c67ef\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\0dc040fd-d0ca-44dd-bdf9-02f2844c67ef\build2.exe"C:\Users\Admin\AppData\Local\0dc040fd-d0ca-44dd-bdf9-02f2844c67ef\build2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\0dc040fd-d0ca-44dd-bdf9-02f2844c67ef\build2.exe" & del C:\ProgramData\*.dll & exit7⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:452
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:1400
-
-
-
-
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {EF2636DA-2E7B-4604-BE1B-3AF3965780C7} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\b46544cb-1721-4c10-9f1b-6501dc4a3d75\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exeC:\Users\Admin\AppData\Local\b46544cb-1721-4c10-9f1b-6501dc4a3d75\83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe --Task2⤵
- Executes dropped EXE
PID:1072
-