Analysis
-
max time kernel
156s -
max time network
159s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-08-2021 09:47
Static task
static1
Behavioral task
behavioral1
Sample
2cbfec5cd3f0662c2715c07cb5137bc9.exe
Resource
win7v20210408
raccoonsmokeloaderd02c5d65069fc7ce1993e7c52edf0c9c4c195c81fe582536ec580228180f270f7cb80a867860e010backdoordiscoveryevasionpersistencespywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2cbfec5cd3f0662c2715c07cb5137bc9.exe
Resource
win10v20210408
buranraccoonsmokeloaderd02c5d65069fc7ce1993e7c52edf0c9c4c195c81backdoordiscoveryevasionpersistenceransomwarespywarestealerthemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
2cbfec5cd3f0662c2715c07cb5137bc9.exe
-
Size
139KB
-
MD5
2cbfec5cd3f0662c2715c07cb5137bc9
-
SHA1
d9d8cbb7e646d492aaff3280898b79bb764eabf9
-
SHA256
7a0413cd0a25ed760cf3e17c60ce915b28c0472a658ba910d76435c19213dfac
-
SHA512
80450e2cd7d059cfa9f2d752f2b4d4a9d642006879a5900f102e622eadede260db97103b55ceaa408896ac87f9e82a76b87f7d34328756bdd9b57d219e0ff7fc
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Extracted
Family
raccoon
Botnet
d02c5d65069fc7ce1993e7c52edf0c9c4c195c81
Attributes
-
url4cnc
https://telete.in/open3entershift
rc4.plain
rc4.plain
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
pid Process 1476 4EBC.exe 544 4FA7.exe 864 AE6A.exe 1840 AF94.exe 1580 B12A.exe 572 TrustedInstaller.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AE6A.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AE6A.exe -
Deletes itself 1 IoCs
pid Process 1220 Process not Found -
Loads dropped DLL 16 IoCs
pid Process 544 4FA7.exe 544 4FA7.exe 544 4FA7.exe 544 4FA7.exe 544 4FA7.exe 544 4FA7.exe 544 4FA7.exe 1580 B12A.exe 1840 AF94.exe 1840 AF94.exe 1580 B12A.exe 1580 B12A.exe 1580 B12A.exe 1580 B12A.exe 1580 B12A.exe 1580 B12A.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x00050000000130d2-82.dat themida behavioral1/memory/864-93-0x0000000000830000-0x0000000000831000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run AF94.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\TrustedInstaller.exe\" -start" AF94.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AE6A.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 geoiptool.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 864 AE6A.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1784 set thread context of 1176 1784 2cbfec5cd3f0662c2715c07cb5137bc9.exe 26 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2cbfec5cd3f0662c2715c07cb5137bc9.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2cbfec5cd3f0662c2715c07cb5137bc9.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2cbfec5cd3f0662c2715c07cb5137bc9.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 AF94.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e AF94.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e AF94.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 4FA7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 4FA7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1176 2cbfec5cd3f0662c2715c07cb5137bc9.exe 1176 2cbfec5cd3f0662c2715c07cb5137bc9.exe 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1220 Process not Found -
Suspicious behavior: MapViewOfSection 13 IoCs
pid Process 1176 2cbfec5cd3f0662c2715c07cb5137bc9.exe 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 1220 Process not Found Token: SeShutdownPrivilege 1220 Process not Found Token: SeDebugPrivilege 1840 AF94.exe Token: SeDebugPrivilege 1840 AF94.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1476 4EBC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1784 wrote to memory of 1176 1784 2cbfec5cd3f0662c2715c07cb5137bc9.exe 26 PID 1784 wrote to memory of 1176 1784 2cbfec5cd3f0662c2715c07cb5137bc9.exe 26 PID 1784 wrote to memory of 1176 1784 2cbfec5cd3f0662c2715c07cb5137bc9.exe 26 PID 1784 wrote to memory of 1176 1784 2cbfec5cd3f0662c2715c07cb5137bc9.exe 26 PID 1784 wrote to memory of 1176 1784 2cbfec5cd3f0662c2715c07cb5137bc9.exe 26 PID 1784 wrote to memory of 1176 1784 2cbfec5cd3f0662c2715c07cb5137bc9.exe 26 PID 1784 wrote to memory of 1176 1784 2cbfec5cd3f0662c2715c07cb5137bc9.exe 26 PID 1220 wrote to memory of 1476 1220 Process not Found 30 PID 1220 wrote to memory of 1476 1220 Process not Found 30 PID 1220 wrote to memory of 1476 1220 Process not Found 30 PID 1220 wrote to memory of 1476 1220 Process not Found 30 PID 1220 wrote to memory of 544 1220 Process not Found 31 PID 1220 wrote to memory of 544 1220 Process not Found 31 PID 1220 wrote to memory of 544 1220 Process not Found 31 PID 1220 wrote to memory of 544 1220 Process not Found 31 PID 1220 wrote to memory of 864 1220 Process not Found 33 PID 1220 wrote to memory of 864 1220 Process not Found 33 PID 1220 wrote to memory of 864 1220 Process not Found 33 PID 1220 wrote to memory of 864 1220 Process not Found 33 PID 1220 wrote to memory of 864 1220 Process not Found 33 PID 1220 wrote to memory of 864 1220 Process not Found 33 PID 1220 wrote to memory of 864 1220 Process not Found 33 PID 1220 wrote to memory of 1840 1220 Process not Found 35 PID 1220 wrote to memory of 1840 1220 Process not Found 35 PID 1220 wrote to memory of 1840 1220 Process not Found 35 PID 1220 wrote to memory of 1840 1220 Process not Found 35 PID 1220 wrote to memory of 1580 1220 Process not Found 36 PID 1220 wrote to memory of 1580 1220 Process not Found 36 PID 1220 wrote to memory of 1580 1220 Process not Found 36 PID 1220 wrote to memory of 1580 1220 Process not Found 36 PID 1220 wrote to memory of 1388 1220 Process not Found 37 PID 1220 wrote to memory of 1388 1220 Process not Found 37 PID 1220 wrote to memory of 1388 1220 Process not Found 37 PID 1220 wrote to memory of 1388 1220 Process not Found 37 PID 1220 wrote to memory of 1388 1220 Process not Found 37 PID 1220 wrote to memory of 1344 1220 Process not Found 38 PID 1220 wrote to memory of 1344 1220 Process not Found 38 PID 1220 wrote to memory of 1344 1220 Process not Found 38 PID 1220 wrote to memory of 1344 1220 Process not Found 38 PID 1220 wrote to memory of 1900 1220 Process not Found 39 PID 1220 wrote to memory of 1900 1220 Process not Found 39 PID 1220 wrote to memory of 1900 1220 Process not Found 39 PID 1220 wrote to memory of 1900 1220 Process not Found 39 PID 1220 wrote to memory of 1900 1220 Process not Found 39 PID 1220 wrote to memory of 1468 1220 Process not Found 41 PID 1220 wrote to memory of 1468 1220 Process not Found 41 PID 1220 wrote to memory of 1468 1220 Process not Found 41 PID 1220 wrote to memory of 1468 1220 Process not Found 41 PID 1220 wrote to memory of 1064 1220 Process not Found 42 PID 1220 wrote to memory of 1064 1220 Process not Found 42 PID 1220 wrote to memory of 1064 1220 Process not Found 42 PID 1220 wrote to memory of 1064 1220 Process not Found 42 PID 1220 wrote to memory of 1064 1220 Process not Found 42 PID 1840 wrote to memory of 572 1840 AF94.exe 43 PID 1840 wrote to memory of 572 1840 AF94.exe 43 PID 1840 wrote to memory of 572 1840 AF94.exe 43 PID 1840 wrote to memory of 572 1840 AF94.exe 43 PID 1840 wrote to memory of 1508 1840 AF94.exe 44 PID 1840 wrote to memory of 1508 1840 AF94.exe 44 PID 1840 wrote to memory of 1508 1840 AF94.exe 44 PID 1840 wrote to memory of 1508 1840 AF94.exe 44 PID 1840 wrote to memory of 1508 1840 AF94.exe 44 PID 1840 wrote to memory of 1508 1840 AF94.exe 44 PID 1840 wrote to memory of 1508 1840 AF94.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cbfec5cd3f0662c2715c07cb5137bc9.exe"C:\Users\Admin\AppData\Local\Temp\2cbfec5cd3f0662c2715c07cb5137bc9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\2cbfec5cd3f0662c2715c07cb5137bc9.exe"C:\Users\Admin\AppData\Local\Temp\2cbfec5cd3f0662c2715c07cb5137bc9.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1176
-
-
C:\Users\Admin\AppData\Local\Temp\4EBC.exeC:\Users\Admin\AppData\Local\Temp\4EBC.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1476
-
C:\Users\Admin\AppData\Local\Temp\4FA7.exeC:\Users\Admin\AppData\Local\Temp\4FA7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:544
-
C:\Users\Admin\AppData\Local\Temp\AE6A.exeC:\Users\Admin\AppData\Local\Temp\AE6A.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:864
-
C:\Users\Admin\AppData\Local\Temp\AF94.exeC:\Users\Admin\AppData\Local\Temp\AF94.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -start2⤵
- Executes dropped EXE
PID:572
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵PID:1508
-
-
C:\Users\Admin\AppData\Local\Temp\B12A.exeC:\Users\Admin\AppData\Local\Temp\B12A.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1388
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1344
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1900
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1468
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1064
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:968