Overview
overview
10Static
static
3dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows11_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
10Analysis
-
max time kernel
1806s -
max time network
1609s -
platform
windows11_x64 -
resource
win11 -
submitted
26-09-2021 14:45
Static task
static1
Behavioral task
behavioral1
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7-ja-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealersuricatathemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7-de-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win11
arkeiraccoonredlinesmokeloaderinstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerspywarestealersuricatathemidatrojan
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blisskarmabackdoorbotnetdiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-ja-20210920
arkeiraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7f6d7183c9e82d2a9b81e6c0608450aa66cefb51finstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-de-20210920
arkeiraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7f6d7183c9e82d2a9b81e6c0608450aa66cefb51finstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
3dd4ba94c558b54ba1fe639566cbc368.exe
-
Size
237KB
-
MD5
3dd4ba94c558b54ba1fe639566cbc368
-
SHA1
8c44f1c918c3d2fd48694e8af653e473be3e02c1
-
SHA256
c75b223b462ba88c62c1c8d848a845e7aeacc0ec0c96a7ecf1644e782accdd52
-
SHA512
58e828507bd3be52ea340ed835c3dc06a655db0a067c746ef65e7382d2b09eb5e7d6847dc679b89539826b598749e60ddf62859e25930b8e586acc11228bb1fa
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
installszxc
C2
138.124.186.2:27999
Extracted
Family
redline
Botnet
z0rm1onbuild
C2
45.156.21.209:56326
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
resource yara_rule behavioral4/files/0x0011000000007768-211.dat family_redline behavioral4/files/0x0011000000007768-212.dat family_redline behavioral4/memory/4088-222-0x00000000013E0000-0x00000000013FE000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
description pid Process procid_target PID 2100 created 4688 2100 WerFault.exe 99 PID 1616 created 4740 1616 WerFault.exe 107 PID 1692 created 1468 1692 WerFault.exe 118 PID 2004 created 2608 2004 WerFault.exe 122 PID 1888 created 3080 1888 WerFault.exe 120 -
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
Arkei Stealer Payload 1 IoCs
resource yara_rule behavioral4/memory/1012-286-0x0000000000400000-0x000000000044D000-memory.dmp family_arkei -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 15 IoCs
pid Process 1668 D909.exe 2460 E157.exe 3716 D909.exe 4500 EDEB.exe 4088 F222.exe 4888 Stub.exe 4688 FC35.exe 2424 B69.exe 752 1722.exe 4740 1F51.exe 1012 28E7.exe 4836 31E1.exe 1468 SindonsWelfare_2021-09-26_15-02.exe 3080 SolanumsYoghurt_2021-09-26_14-52.exe 2608 fbf.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion E157.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1722.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1722.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion E157.exe -
Loads dropped DLL 4 IoCs
pid Process 2424 B69.exe 1012 28E7.exe 2424 B69.exe 2424 B69.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral4/files/0x0004000000000549-181.dat themida behavioral4/files/0x0004000000000549-182.dat themida behavioral4/memory/2460-187-0x0000000000D20000-0x0000000000D21000-memory.dmp themida behavioral4/files/0x0004000000027ba4-254.dat themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA E157.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1722.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2460 E157.exe 752 1722.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4148 set thread context of 4808 4148 3dd4ba94c558b54ba1fe639566cbc368.exe 77 PID 1668 set thread context of 3716 1668 D909.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
pid pid_target Process procid_target 2340 4688 WerFault.exe 99 1460 4740 WerFault.exe 107 5112 1468 WerFault.exe 118 2216 2608 WerFault.exe 122 1164 3080 WerFault.exe 120 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D909.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D909.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D909.exe -
Checks processor information in registry 2 TTPs 37 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 28E7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 28E7.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 2200 timeout.exe 768 timeout.exe -
Enumerates system info in registry 2 TTPs 10 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4808 3dd4ba94c558b54ba1fe639566cbc368.exe 4808 3dd4ba94c558b54ba1fe639566cbc368.exe 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3232 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4808 3dd4ba94c558b54ba1fe639566cbc368.exe 3716 D909.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeDebugPrivilege 4500 EDEB.exe Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeDebugPrivilege 4088 F222.exe Token: 33 4088 F222.exe Token: SeIncBasePriorityPrivilege 4088 F222.exe Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeDebugPrivilege 2460 E157.exe Token: SeRestorePrivilege 2340 WerFault.exe Token: SeBackupPrivilege 2340 WerFault.exe Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeDebugPrivilege 4888 Stub.exe Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeDebugPrivilege 752 1722.exe Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4148 wrote to memory of 4808 4148 3dd4ba94c558b54ba1fe639566cbc368.exe 77 PID 4148 wrote to memory of 4808 4148 3dd4ba94c558b54ba1fe639566cbc368.exe 77 PID 4148 wrote to memory of 4808 4148 3dd4ba94c558b54ba1fe639566cbc368.exe 77 PID 4148 wrote to memory of 4808 4148 3dd4ba94c558b54ba1fe639566cbc368.exe 77 PID 4148 wrote to memory of 4808 4148 3dd4ba94c558b54ba1fe639566cbc368.exe 77 PID 4148 wrote to memory of 4808 4148 3dd4ba94c558b54ba1fe639566cbc368.exe 77 PID 3232 wrote to memory of 1668 3232 Process not Found 91 PID 3232 wrote to memory of 1668 3232 Process not Found 91 PID 3232 wrote to memory of 1668 3232 Process not Found 91 PID 3232 wrote to memory of 2460 3232 Process not Found 92 PID 3232 wrote to memory of 2460 3232 Process not Found 92 PID 3232 wrote to memory of 2460 3232 Process not Found 92 PID 1668 wrote to memory of 3716 1668 D909.exe 94 PID 1668 wrote to memory of 3716 1668 D909.exe 94 PID 1668 wrote to memory of 3716 1668 D909.exe 94 PID 1668 wrote to memory of 3716 1668 D909.exe 94 PID 1668 wrote to memory of 3716 1668 D909.exe 94 PID 1668 wrote to memory of 3716 1668 D909.exe 94 PID 3232 wrote to memory of 4500 3232 Process not Found 95 PID 3232 wrote to memory of 4500 3232 Process not Found 95 PID 3232 wrote to memory of 4500 3232 Process not Found 95 PID 3232 wrote to memory of 4088 3232 Process not Found 96 PID 3232 wrote to memory of 4088 3232 Process not Found 96 PID 4500 wrote to memory of 4888 4500 EDEB.exe 97 PID 4500 wrote to memory of 4888 4500 EDEB.exe 97 PID 4500 wrote to memory of 4888 4500 EDEB.exe 97 PID 3232 wrote to memory of 4688 3232 Process not Found 99 PID 3232 wrote to memory of 4688 3232 Process not Found 99 PID 3232 wrote to memory of 4688 3232 Process not Found 99 PID 2100 wrote to memory of 4688 2100 WerFault.exe 99 PID 2100 wrote to memory of 4688 2100 WerFault.exe 99 PID 3232 wrote to memory of 2424 3232 Process not Found 103 PID 3232 wrote to memory of 2424 3232 Process not Found 103 PID 3232 wrote to memory of 2424 3232 Process not Found 103 PID 3232 wrote to memory of 752 3232 Process not Found 105 PID 3232 wrote to memory of 752 3232 Process not Found 105 PID 3232 wrote to memory of 752 3232 Process not Found 105 PID 3232 wrote to memory of 4740 3232 Process not Found 107 PID 3232 wrote to memory of 4740 3232 Process not Found 107 PID 3232 wrote to memory of 4740 3232 Process not Found 107 PID 3232 wrote to memory of 1012 3232 Process not Found 108 PID 3232 wrote to memory of 1012 3232 Process not Found 108 PID 3232 wrote to memory of 1012 3232 Process not Found 108 PID 3232 wrote to memory of 4836 3232 Process not Found 109 PID 3232 wrote to memory of 4836 3232 Process not Found 109 PID 1616 wrote to memory of 4740 1616 WerFault.exe 107 PID 1616 wrote to memory of 4740 1616 WerFault.exe 107 PID 1012 wrote to memory of 1408 1012 28E7.exe 112 PID 1012 wrote to memory of 1408 1012 28E7.exe 112 PID 1012 wrote to memory of 1408 1012 28E7.exe 112 PID 1408 wrote to memory of 768 1408 cmd.exe 114 PID 1408 wrote to memory of 768 1408 cmd.exe 114 PID 1408 wrote to memory of 768 1408 cmd.exe 114 PID 2424 wrote to memory of 828 2424 B69.exe 115 PID 2424 wrote to memory of 828 2424 B69.exe 115 PID 2424 wrote to memory of 828 2424 B69.exe 115 PID 828 wrote to memory of 2200 828 cmd.exe 117 PID 828 wrote to memory of 2200 828 cmd.exe 117 PID 828 wrote to memory of 2200 828 cmd.exe 117 PID 4836 wrote to memory of 1468 4836 31E1.exe 118 PID 4836 wrote to memory of 1468 4836 31E1.exe 118 PID 4836 wrote to memory of 1468 4836 31E1.exe 118 PID 4836 wrote to memory of 3080 4836 31E1.exe 120 PID 4836 wrote to memory of 3080 4836 31E1.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4808
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:3892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\D909.exeC:\Users\Admin\AppData\Local\Temp\D909.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\D909.exeC:\Users\Admin\AppData\Local\Temp\D909.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3716
-
-
C:\Users\Admin\AppData\Local\Temp\E157.exeC:\Users\Admin\AppData\Local\Temp\E157.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
C:\Users\Admin\AppData\Local\Temp\EDEB.exeC:\Users\Admin\AppData\Local\Temp\EDEB.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\ProgramData\Stub.exe"C:\ProgramData\Stub.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\F222.exeC:\Users\Admin\AppData\Local\Temp\F222.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
C:\Users\Admin\AppData\Local\Temp\FC35.exeC:\Users\Admin\AppData\Local\Temp\FC35.exe1⤵
- Executes dropped EXE
PID:4688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 2962⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4688 -ip 46881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2100
-
C:\Users\Admin\AppData\Local\Temp\B69.exeC:\Users\Admin\AppData\Local\Temp\B69.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\B69.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:2200
-
-
-
C:\Users\Admin\AppData\Local\Temp\1722.exeC:\Users\Admin\AppData\Local\Temp\1722.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:752
-
C:\Users\Admin\AppData\Local\Temp\1F51.exeC:\Users\Admin\AppData\Local\Temp\1F51.exe1⤵
- Executes dropped EXE
PID:4740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 2962⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\28E7.exeC:\Users\Admin\AppData\Local\Temp\28E7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\28E7.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:768
-
-
-
C:\Users\Admin\AppData\Local\Temp\31E1.exeC:\Users\Admin\AppData\Local\Temp\31E1.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"2⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 3123⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5112
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"2⤵
- Executes dropped EXE
PID:3080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 2563⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1164
-
-
-
C:\Users\Admin\AppData\Local\Temp\fbf.exe"C:\Users\Admin\AppData\Local\Temp\fbf.exe"2⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 2923⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4740 -ip 47401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1468 -ip 14681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3080 -ip 30801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2608 -ip 26081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2004