Overview
overview
10Static
static
3dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows11_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
10Analysis
-
max time kernel
1801s -
max time network
1795s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-09-2021 14:45
Static task
static1
Behavioral task
behavioral1
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7-ja-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealersuricatathemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7-de-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win11
arkeiraccoonredlinesmokeloaderinstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerspywarestealersuricatathemidatrojan
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blisskarmabackdoorbotnetdiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-ja-20210920
arkeiraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7f6d7183c9e82d2a9b81e6c0608450aa66cefb51finstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-de-20210920
arkeiraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7f6d7183c9e82d2a9b81e6c0608450aa66cefb51finstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
3dd4ba94c558b54ba1fe639566cbc368.exe
-
Size
237KB
-
MD5
3dd4ba94c558b54ba1fe639566cbc368
-
SHA1
8c44f1c918c3d2fd48694e8af653e473be3e02c1
-
SHA256
c75b223b462ba88c62c1c8d848a845e7aeacc0ec0c96a7ecf1644e782accdd52
-
SHA512
58e828507bd3be52ea340ed835c3dc06a655db0a067c746ef65e7382d2b09eb5e7d6847dc679b89539826b598749e60ddf62859e25930b8e586acc11228bb1fa
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7
Attributes
-
url4cnc
https://t.me/hcdrom1
rc4.plain
rc4.plain
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
redline
Botnet
Bliss
C2
185.237.98.178:62607
Extracted
Family
redline
Botnet
karma
C2
94.103.9.133:39323
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral5/memory/740-182-0x0000000002300000-0x0000000002323000-memory.dmp family_redline behavioral5/memory/3000-185-0x00000000022C0000-0x00000000022DF000-memory.dmp family_redline behavioral5/memory/740-184-0x00000000024C0000-0x00000000024E2000-memory.dmp family_redline behavioral5/memory/3000-192-0x0000000002380000-0x000000000239E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
Arkei Stealer Payload 1 IoCs
resource yara_rule behavioral5/memory/1776-152-0x0000000000400000-0x000000000044D000-memory.dmp family_arkei -
Chinese Botnet Payload 1 IoCs
resource yara_rule behavioral5/memory/1216-214-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
pid Process 3212 96C.exe 416 167D.exe 1124 1E2E.exe 1776 25A2.exe 744 2A65.exe 3000 SindonsWelfare_2021-09-26_15-02.exe 740 SolanumsYoghurt_2021-09-26_14-52.exe 1216 fbf.exe 2660 aghrrrv 2880 aghrrrv 2256 aghrrrv 3908 aghrrrv 3992 aghrrrv 1028 aghrrrv -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 167D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 167D.exe -
Deletes itself 1 IoCs
pid Process 3052 Process not Found -
Loads dropped DLL 8 IoCs
pid Process 3212 96C.exe 3212 96C.exe 3212 96C.exe 3212 96C.exe 3212 96C.exe 1776 25A2.exe 1776 25A2.exe 1776 25A2.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral5/files/0x000500000001ab46-129.dat themida behavioral5/memory/416-132-0x00000000010D0000-0x00000000010D1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uuuocai.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbf.exe" fbf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 167D.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: fbf.exe File opened (read-only) \??\L: fbf.exe File opened (read-only) \??\W: fbf.exe File opened (read-only) \??\Z: fbf.exe File opened (read-only) \??\I: fbf.exe File opened (read-only) \??\J: fbf.exe File opened (read-only) \??\Q: fbf.exe File opened (read-only) \??\T: fbf.exe File opened (read-only) \??\B: fbf.exe File opened (read-only) \??\E: fbf.exe File opened (read-only) \??\F: fbf.exe File opened (read-only) \??\G: fbf.exe File opened (read-only) \??\U: fbf.exe File opened (read-only) \??\V: fbf.exe File opened (read-only) \??\X: fbf.exe File opened (read-only) \??\Y: fbf.exe File opened (read-only) \??\N: fbf.exe File opened (read-only) \??\O: fbf.exe File opened (read-only) \??\P: fbf.exe File opened (read-only) \??\S: fbf.exe File opened (read-only) \??\K: fbf.exe File opened (read-only) \??\M: fbf.exe File opened (read-only) \??\R: fbf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 416 167D.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 808 set thread context of 1004 808 3dd4ba94c558b54ba1fe639566cbc368.exe 68 PID 2660 set thread context of 2880 2660 aghrrrv 95 PID 2256 set thread context of 3908 2256 aghrrrv 97 PID 3992 set thread context of 1028 3992 aghrrrv 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1148 1776 WerFault.exe 80 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aghrrrv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aghrrrv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aghrrrv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aghrrrv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aghrrrv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aghrrrv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aghrrrv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aghrrrv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aghrrrv -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz fbf.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3772 timeout.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1004 3dd4ba94c558b54ba1fe639566cbc368.exe 1004 3dd4ba94c558b54ba1fe639566cbc368.exe 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3052 Process not Found -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 1004 3dd4ba94c558b54ba1fe639566cbc368.exe 2880 aghrrrv 3908 aghrrrv 1028 aghrrrv -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeRestorePrivilege 1148 WerFault.exe Token: SeBackupPrivilege 1148 WerFault.exe Token: SeDebugPrivilege 1148 WerFault.exe Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeDebugPrivilege 416 167D.exe Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeDebugPrivilege 740 SolanumsYoghurt_2021-09-26_14-52.exe Token: SeDebugPrivilege 3000 SindonsWelfare_2021-09-26_15-02.exe Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1216 fbf.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 808 wrote to memory of 1004 808 3dd4ba94c558b54ba1fe639566cbc368.exe 68 PID 808 wrote to memory of 1004 808 3dd4ba94c558b54ba1fe639566cbc368.exe 68 PID 808 wrote to memory of 1004 808 3dd4ba94c558b54ba1fe639566cbc368.exe 68 PID 808 wrote to memory of 1004 808 3dd4ba94c558b54ba1fe639566cbc368.exe 68 PID 808 wrote to memory of 1004 808 3dd4ba94c558b54ba1fe639566cbc368.exe 68 PID 808 wrote to memory of 1004 808 3dd4ba94c558b54ba1fe639566cbc368.exe 68 PID 3052 wrote to memory of 3212 3052 Process not Found 75 PID 3052 wrote to memory of 3212 3052 Process not Found 75 PID 3052 wrote to memory of 3212 3052 Process not Found 75 PID 3052 wrote to memory of 416 3052 Process not Found 77 PID 3052 wrote to memory of 416 3052 Process not Found 77 PID 3052 wrote to memory of 416 3052 Process not Found 77 PID 3052 wrote to memory of 1124 3052 Process not Found 79 PID 3052 wrote to memory of 1124 3052 Process not Found 79 PID 3052 wrote to memory of 1124 3052 Process not Found 79 PID 3052 wrote to memory of 1776 3052 Process not Found 80 PID 3052 wrote to memory of 1776 3052 Process not Found 80 PID 3052 wrote to memory of 1776 3052 Process not Found 80 PID 3052 wrote to memory of 744 3052 Process not Found 81 PID 3052 wrote to memory of 744 3052 Process not Found 81 PID 3212 wrote to memory of 3844 3212 96C.exe 84 PID 3212 wrote to memory of 3844 3212 96C.exe 84 PID 3212 wrote to memory of 3844 3212 96C.exe 84 PID 3844 wrote to memory of 3772 3844 cmd.exe 86 PID 3844 wrote to memory of 3772 3844 cmd.exe 86 PID 3844 wrote to memory of 3772 3844 cmd.exe 86 PID 744 wrote to memory of 3000 744 2A65.exe 87 PID 744 wrote to memory of 3000 744 2A65.exe 87 PID 744 wrote to memory of 3000 744 2A65.exe 87 PID 744 wrote to memory of 740 744 2A65.exe 89 PID 744 wrote to memory of 740 744 2A65.exe 89 PID 744 wrote to memory of 740 744 2A65.exe 89 PID 744 wrote to memory of 1216 744 2A65.exe 91 PID 744 wrote to memory of 1216 744 2A65.exe 91 PID 744 wrote to memory of 1216 744 2A65.exe 91 PID 2660 wrote to memory of 2880 2660 aghrrrv 95 PID 2660 wrote to memory of 2880 2660 aghrrrv 95 PID 2660 wrote to memory of 2880 2660 aghrrrv 95 PID 2660 wrote to memory of 2880 2660 aghrrrv 95 PID 2660 wrote to memory of 2880 2660 aghrrrv 95 PID 2660 wrote to memory of 2880 2660 aghrrrv 95 PID 2256 wrote to memory of 3908 2256 aghrrrv 97 PID 2256 wrote to memory of 3908 2256 aghrrrv 97 PID 2256 wrote to memory of 3908 2256 aghrrrv 97 PID 2256 wrote to memory of 3908 2256 aghrrrv 97 PID 2256 wrote to memory of 3908 2256 aghrrrv 97 PID 2256 wrote to memory of 3908 2256 aghrrrv 97 PID 3992 wrote to memory of 1028 3992 aghrrrv 99 PID 3992 wrote to memory of 1028 3992 aghrrrv 99 PID 3992 wrote to memory of 1028 3992 aghrrrv 99 PID 3992 wrote to memory of 1028 3992 aghrrrv 99 PID 3992 wrote to memory of 1028 3992 aghrrrv 99 PID 3992 wrote to memory of 1028 3992 aghrrrv 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1004
-
-
C:\Users\Admin\AppData\Local\Temp\96C.exeC:\Users\Admin\AppData\Local\Temp\96C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\96C.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:3772
-
-
-
C:\Users\Admin\AppData\Local\Temp\167D.exeC:\Users\Admin\AppData\Local\Temp\167D.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:416
-
C:\Users\Admin\AppData\Local\Temp\1E2E.exeC:\Users\Admin\AppData\Local\Temp\1E2E.exe1⤵
- Executes dropped EXE
PID:1124
-
C:\Users\Admin\AppData\Local\Temp\25A2.exeC:\Users\Admin\AppData\Local\Temp\25A2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 13042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\2A65.exeC:\Users\Admin\AppData\Local\Temp\2A65.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:740
-
-
C:\Users\Admin\AppData\Local\Temp\fbf.exe"C:\Users\Admin\AppData\Local\Temp\fbf.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1216
-
-
C:\Users\Admin\AppData\Roaming\aghrrrvC:\Users\Admin\AppData\Roaming\aghrrrv1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Roaming\aghrrrvC:\Users\Admin\AppData\Roaming\aghrrrv2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2880
-
-
C:\Users\Admin\AppData\Roaming\aghrrrvC:\Users\Admin\AppData\Roaming\aghrrrv1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Roaming\aghrrrvC:\Users\Admin\AppData\Roaming\aghrrrv2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3908
-
-
C:\Users\Admin\AppData\Roaming\aghrrrvC:\Users\Admin\AppData\Roaming\aghrrrv1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Roaming\aghrrrvC:\Users\Admin\AppData\Roaming\aghrrrv2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1028
-