conti | 11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754

General

Target

11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
Size

517KB
MD5

4eaaf31a7ff227a52fb036ed30103c79
SHA1

eef0ee30efb1a0595a5a1633e08dcdf65a94a3c4
SHA256

11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754
SHA512

917707ea12dc5ec296e41d25797dcafdda525eaaee768137926df11699cad07f8176567ecd0969e471ebced0e00932bf3aa270a9d177de814d6c003ff7d18e73

Score

10^/10

conti ransomware spyware stealer

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.click YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- 1oCoJXb9aUiCGzFzjVs55rTrO2ucfQqV0GFhlPOS6ka81opOFBGKUQG5ZT0nLKpt ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.click

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RemoveResolve.tiff => C:\Users\Admin\Pictures\RemoveResolve.tiff.BGQHM	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\RenamePublish.png => C:\Users\Admin\Pictures\RenamePublish.png.BGQHM	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\BackupDisconnect.raw => C:\Users\Admin\Pictures\BackupDisconnect.raw.BGQHM	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\OptimizeMerge.crw => C:\Users\Admin\Pictures\OptimizeMerge.crw.BGQHM	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Users\Admin\Pictures\RemoveResolve.tiff	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\readme.txt	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Black Tie.xml	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14833_.GIF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\LICENSE	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02755U.BMP	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\readme.txt	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\OliveGreen.css	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV.HXS	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN058.XML	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\readme.txt	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR39F.GIF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Monterrey	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01221K.JPG	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR28F.GIF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\readme.txt	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OSPP.VBS	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\readme.txt	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Santarem	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\readme.txt	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02141_.WMF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\REFINED.ELM	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB3A.BDR	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45B.GIF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Init.xsn	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOML.ICO	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\readme.txt	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\SPACER.GIF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157831.WMF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\HORN.WAV	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\readme.txt	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\readme.txt	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00956_.WMF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382962.JPG	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251925.WMF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\APPLAUSE.WAV	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\SecretST.TTF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe

pid process

1840 11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe

pid	process
1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	1232	vssvc.exe
Token: SeRestorePrivilege	1232	vssvc.exe
Token: SeAuditPrivilege	1232	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1756	WMIC.exe
Token: SeSecurityPrivilege	1756	WMIC.exe
Token: SeTakeOwnershipPrivilege	1756	WMIC.exe
Token: SeLoadDriverPrivilege	1756	WMIC.exe
Token: SeSystemProfilePrivilege	1756	WMIC.exe
Token: SeSystemtimePrivilege	1756	WMIC.exe
Token: SeProfSingleProcessPrivilege	1756	WMIC.exe
Token: SeIncBasePriorityPrivilege	1756	WMIC.exe
Token: SeCreatePagefilePrivilege	1756	WMIC.exe
Token: SeBackupPrivilege	1756	WMIC.exe
Token: SeRestorePrivilege	1756	WMIC.exe
Token: SeShutdownPrivilege	1756	WMIC.exe
Token: SeDebugPrivilege	1756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1756	WMIC.exe
Token: SeRemoteShutdownPrivilege	1756	WMIC.exe
Token: SeUndockPrivilege	1756	WMIC.exe
Token: SeManageVolumePrivilege	1756	WMIC.exe
Token: 33	1756	WMIC.exe
Token: 34	1756	WMIC.exe
Token: 35	1756	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1756	WMIC.exe
Token: SeSecurityPrivilege	1756	WMIC.exe
Token: SeTakeOwnershipPrivilege	1756	WMIC.exe
Token: SeLoadDriverPrivilege	1756	WMIC.exe
Token: SeSystemProfilePrivilege	1756	WMIC.exe
Token: SeSystemtimePrivilege	1756	WMIC.exe
Token: SeProfSingleProcessPrivilege	1756	WMIC.exe
Token: SeIncBasePriorityPrivilege	1756	WMIC.exe
Token: SeCreatePagefilePrivilege	1756	WMIC.exe
Token: SeBackupPrivilege	1756	WMIC.exe
Token: SeRestorePrivilege	1756	WMIC.exe
Token: SeShutdownPrivilege	1756	WMIC.exe
Token: SeDebugPrivilege	1756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1756	WMIC.exe
Token: SeRemoteShutdownPrivilege	1756	WMIC.exe
Token: SeUndockPrivilege	1756	WMIC.exe
Token: SeManageVolumePrivilege	1756	WMIC.exe
Token: 33	1756	WMIC.exe
Token: 34	1756	WMIC.exe
Token: 35	1756	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1236	WMIC.exe
Token: SeSecurityPrivilege	1236	WMIC.exe
Token: SeTakeOwnershipPrivilege	1236	WMIC.exe
Token: SeLoadDriverPrivilege	1236	WMIC.exe
Token: SeSystemProfilePrivilege	1236	WMIC.exe
Token: SeSystemtimePrivilege	1236	WMIC.exe
Token: SeProfSingleProcessPrivilege	1236	WMIC.exe
Token: SeIncBasePriorityPrivilege	1236	WMIC.exe
Token: SeCreatePagefilePrivilege	1236	WMIC.exe
Token: SeBackupPrivilege	1236	WMIC.exe
Token: SeRestorePrivilege	1236	WMIC.exe
Token: SeShutdownPrivilege	1236	WMIC.exe
Token: SeDebugPrivilege	1236	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1236	WMIC.exe
Token: SeRemoteShutdownPrivilege	1236	WMIC.exe
Token: SeUndockPrivilege	1236	WMIC.exe
Token: SeManageVolumePrivilege	1236	WMIC.exe
Token: 33	1236	WMIC.exe
Token: 34	1236	WMIC.exe
Token: 35	1236	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1236	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1840 wrote to memory of 1356	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1356	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1356	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1356	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1356 wrote to memory of 1756	1356	cmd.exe	WMIC.exe
PID 1356 wrote to memory of 1756	1356	cmd.exe	WMIC.exe
PID 1356 wrote to memory of 1756	1356	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1676	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1676	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1676	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1676	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1676 wrote to memory of 1236	1676	cmd.exe	WMIC.exe
PID 1676 wrote to memory of 1236	1676	cmd.exe	WMIC.exe
PID 1676 wrote to memory of 1236	1676	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1652	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1652	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1652	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1652	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1652 wrote to memory of 1608	1652	cmd.exe	WMIC.exe
PID 1652 wrote to memory of 1608	1652	cmd.exe	WMIC.exe
PID 1652 wrote to memory of 1608	1652	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 668	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 668	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 668	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 668	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 668 wrote to memory of 752	668	cmd.exe	WMIC.exe
PID 668 wrote to memory of 752	668	cmd.exe	WMIC.exe
PID 668 wrote to memory of 752	668	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1768	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1768	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1768	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1768	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1768 wrote to memory of 1888	1768	cmd.exe	WMIC.exe
PID 1768 wrote to memory of 1888	1768	cmd.exe	WMIC.exe
PID 1768 wrote to memory of 1888	1768	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1648	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1648	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1648	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1648	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1648 wrote to memory of 304	1648	cmd.exe	WMIC.exe
PID 1648 wrote to memory of 304	1648	cmd.exe	WMIC.exe
PID 1648 wrote to memory of 304	1648	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1560	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1560	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1560	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1560	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1560 wrote to memory of 2000	1560	cmd.exe	WMIC.exe
PID 1560 wrote to memory of 2000	1560	cmd.exe	WMIC.exe
PID 1560 wrote to memory of 2000	1560	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1864	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1864	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1864	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1864	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1864 wrote to memory of 1828	1864	cmd.exe	WMIC.exe
PID 1864 wrote to memory of 1828	1864	cmd.exe	WMIC.exe
PID 1864 wrote to memory of 1828	1864	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1452	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1452	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1452	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1840 wrote to memory of 1452	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe
PID 1452 wrote to memory of 1508	1452	cmd.exe	WMIC.exe
PID 1452 wrote to memory of 1508	1452	cmd.exe	WMIC.exe
PID 1452 wrote to memory of 1508	1452	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1516	1840	11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample.exe"
1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete
3⤵
PID:1608

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete
3⤵
PID:752

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete
3⤵
PID:1888

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete
3⤵
PID:304

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete
3⤵
PID:2000

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete
3⤵
PID:1828

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete
3⤵
PID:1508

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete
2⤵
PID:1516

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete
3⤵
PID:1504

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete
2⤵
PID:1688

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete
3⤵
PID:864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-73-0x0000000000000000-mapping.dmp

Download
memory/668-68-0x0000000000000000-mapping.dmp

Download
memory/752-69-0x0000000000000000-mapping.dmp

Download
memory/864-83-0x0000000000000000-mapping.dmp

Download
memory/1236-65-0x0000000000000000-mapping.dmp

Download
memory/1356-62-0x0000000000000000-mapping.dmp

Download
memory/1452-78-0x0000000000000000-mapping.dmp

Download
memory/1504-81-0x0000000000000000-mapping.dmp

Download
memory/1508-79-0x0000000000000000-mapping.dmp

Download
memory/1516-80-0x0000000000000000-mapping.dmp

Download
memory/1560-74-0x0000000000000000-mapping.dmp

Download
memory/1608-67-0x0000000000000000-mapping.dmp

Download
memory/1648-72-0x0000000000000000-mapping.dmp

Download
memory/1652-66-0x0000000000000000-mapping.dmp

Download
memory/1676-64-0x0000000000000000-mapping.dmp

Download
memory/1688-82-0x0000000000000000-mapping.dmp

Download
memory/1756-63-0x0000000000000000-mapping.dmp

Download
memory/1768-70-0x0000000000000000-mapping.dmp

Download
memory/1828-77-0x0000000000000000-mapping.dmp

Download
memory/1840-60-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1840-61-0x0000000000150000-0x0000000000184000-memory.dmp

Filesize
208KB

Download
memory/1864-76-0x0000000000000000-mapping.dmp

Download
memory/1888-71-0x0000000000000000-mapping.dmp

Download
memory/2000-75-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads