Analysis
-
max time kernel
156s -
max time network
155s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-09-2021 14:53
Static task
static1
Behavioral task
behavioral1
Sample
e98e80b300af28043252190b020ee173.exe
Resource
win7v20210408
chinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e98e80b300af28043252190b020ee173.exe
Resource
win10-en-20210920
chinese_generic_botnetredlinesmokeloaderblisskarmabackdoorbotnetdiscoveryinfostealerpersistencespywarestealertrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
e98e80b300af28043252190b020ee173.exe
-
Size
139KB
-
MD5
e98e80b300af28043252190b020ee173
-
SHA1
df38365f73543166e8fb859908f0b3dbc9b6e64e
-
SHA256
ebcecaf7cc142a2954b15d4390e5275aed5a7c8f70a7c777c0288b5f3c2312ac
-
SHA512
11d40f6529dd546cdf97c73183393418e728a64320cb1345d43056f002e469ab16eae64eb4b628b195234cf07843cb2e7fb659d46598c3de951d73d1b680b762
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
installszxc
C2
138.124.186.2:27999
Extracted
Family
redline
Botnet
z0rm1onbuild
C2
45.156.21.209:56326
Extracted
Family
raccoon
Botnet
b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7
Attributes
-
url4cnc
https://t.me/hcdrom1
rc4.plain
rc4.plain
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
redline
Botnet
Bliss
C2
185.237.98.178:62607
Extracted
Family
redline
Botnet
karma
C2
94.103.9.133:39323
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
resource yara_rule behavioral1/files/0x00030000000130ce-94.dat family_redline behavioral1/files/0x00030000000130ce-96.dat family_redline behavioral1/files/0x00030000000130ce-97.dat family_redline behavioral1/memory/1016-100-0x0000000000170000-0x000000000018E000-memory.dmp family_redline behavioral1/memory/2176-139-0x0000000002120000-0x0000000002143000-memory.dmp family_redline behavioral1/memory/2176-140-0x0000000002330000-0x0000000002352000-memory.dmp family_redline behavioral1/memory/2132-148-0x0000000001E10000-0x0000000001E2F000-memory.dmp family_redline behavioral1/memory/2132-149-0x0000000001E80000-0x0000000001E9E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Chinese Botnet Payload 1 IoCs
resource yara_rule behavioral1/memory/2204-160-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
pid Process 268 721.exe 572 EEF.exe 1628 721.exe 1864 19A9.exe 1016 1D81.exe 1640 Stub.exe 1816 2D2B.exe 428 33F0.exe 1680 394E.exe 1608 3E1F.exe 1696 4551.exe 2132 SindonsWelfare_2021-09-26_15-02.exe 2176 SolanumsYoghurt_2021-09-26_14-52.exe 2204 fbf.exe 2808 Uuuocai.exe 2888 Uuuocai.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 33F0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 33F0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion EEF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion EEF.exe -
Deletes itself 1 IoCs
pid Process 1208 Process not Found -
Loads dropped DLL 2 IoCs
pid Process 268 721.exe 1864 19A9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x00050000000130ca-68.dat themida behavioral1/memory/572-77-0x0000000000CB0000-0x0000000000CB1000-memory.dmp themida behavioral1/files/0x00040000000130d1-113.dat themida behavioral1/memory/428-116-0x0000000001130000-0x0000000001131000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 33F0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA EEF.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: fbf.exe File opened (read-only) \??\U: fbf.exe File opened (read-only) \??\F: fbf.exe File opened (read-only) \??\H: fbf.exe File opened (read-only) \??\J: fbf.exe File opened (read-only) \??\W: fbf.exe File opened (read-only) \??\Y: fbf.exe File opened (read-only) \??\B: fbf.exe File opened (read-only) \??\M: fbf.exe File opened (read-only) \??\R: fbf.exe File opened (read-only) \??\V: fbf.exe File opened (read-only) \??\X: fbf.exe File opened (read-only) \??\I: fbf.exe File opened (read-only) \??\K: fbf.exe File opened (read-only) \??\T: fbf.exe File opened (read-only) \??\N: fbf.exe File opened (read-only) \??\O: fbf.exe File opened (read-only) \??\P: fbf.exe File opened (read-only) \??\S: fbf.exe File opened (read-only) \??\Z: fbf.exe File opened (read-only) \??\E: fbf.exe File opened (read-only) \??\G: fbf.exe File opened (read-only) \??\L: fbf.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Uuuocai.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Uuuocai.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 572 EEF.exe 428 33F0.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1816 set thread context of 1824 1816 e98e80b300af28043252190b020ee173.exe 25 PID 268 set thread context of 1628 268 721.exe 31 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe fbf.exe File opened for modification C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe fbf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e98e80b300af28043252190b020ee173.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 721.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 721.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 721.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e98e80b300af28043252190b020ee173.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e98e80b300af28043252190b020ee173.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz fbf.exe -
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Uuuocai.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\aa-42-f0-13-0a-82 Uuuocai.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecision = "0" Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionReason = "1" Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\aa-42-f0-13-0a-82 Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 70d95438f7b2d701 Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionReason = "1" Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Uuuocai.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = 70d95438f7b2d701 Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = 70d95438f7b2d701 Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecision = "0" Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = d0752043f7b2d701 Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Uuuocai.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82 Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82 Uuuocai.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDetectedUrl Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Uuuocai.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" Uuuocai.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Uuuocai.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} Uuuocai.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" Uuuocai.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" Uuuocai.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = d0752043f7b2d701 Uuuocai.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1824 e98e80b300af28043252190b020ee173.exe 1824 e98e80b300af28043252190b020ee173.exe 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1208 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1824 e98e80b300af28043252190b020ee173.exe 1628 721.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeDebugPrivilege 1864 19A9.exe Token: SeDebugPrivilege 1016 1D81.exe Token: 33 1016 1D81.exe Token: SeIncBasePriorityPrivilege 1016 1D81.exe Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeDebugPrivilege 572 EEF.exe Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeDebugPrivilege 1640 Stub.exe Token: SeDebugPrivilege 428 33F0.exe Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeDebugPrivilege 2176 SolanumsYoghurt_2021-09-26_14-52.exe Token: SeDebugPrivilege 2132 SindonsWelfare_2021-09-26_15-02.exe Token: SeShutdownPrivilege 1208 Process not Found -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2204 fbf.exe 2808 Uuuocai.exe 2888 Uuuocai.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1816 wrote to memory of 1824 1816 e98e80b300af28043252190b020ee173.exe 25 PID 1816 wrote to memory of 1824 1816 e98e80b300af28043252190b020ee173.exe 25 PID 1816 wrote to memory of 1824 1816 e98e80b300af28043252190b020ee173.exe 25 PID 1816 wrote to memory of 1824 1816 e98e80b300af28043252190b020ee173.exe 25 PID 1816 wrote to memory of 1824 1816 e98e80b300af28043252190b020ee173.exe 25 PID 1816 wrote to memory of 1824 1816 e98e80b300af28043252190b020ee173.exe 25 PID 1816 wrote to memory of 1824 1816 e98e80b300af28043252190b020ee173.exe 25 PID 1208 wrote to memory of 268 1208 Process not Found 28 PID 1208 wrote to memory of 268 1208 Process not Found 28 PID 1208 wrote to memory of 268 1208 Process not Found 28 PID 1208 wrote to memory of 268 1208 Process not Found 28 PID 1208 wrote to memory of 572 1208 Process not Found 29 PID 1208 wrote to memory of 572 1208 Process not Found 29 PID 1208 wrote to memory of 572 1208 Process not Found 29 PID 1208 wrote to memory of 572 1208 Process not Found 29 PID 268 wrote to memory of 1628 268 721.exe 31 PID 268 wrote to memory of 1628 268 721.exe 31 PID 268 wrote to memory of 1628 268 721.exe 31 PID 268 wrote to memory of 1628 268 721.exe 31 PID 268 wrote to memory of 1628 268 721.exe 31 PID 268 wrote to memory of 1628 268 721.exe 31 PID 268 wrote to memory of 1628 268 721.exe 31 PID 1208 wrote to memory of 1864 1208 Process not Found 32 PID 1208 wrote to memory of 1864 1208 Process not Found 32 PID 1208 wrote to memory of 1864 1208 Process not Found 32 PID 1208 wrote to memory of 1864 1208 Process not Found 32 PID 1208 wrote to memory of 1016 1208 Process not Found 33 PID 1208 wrote to memory of 1016 1208 Process not Found 33 PID 1208 wrote to memory of 1016 1208 Process not Found 33 PID 1864 wrote to memory of 1640 1864 19A9.exe 34 PID 1864 wrote to memory of 1640 1864 19A9.exe 34 PID 1864 wrote to memory of 1640 1864 19A9.exe 34 PID 1864 wrote to memory of 1640 1864 19A9.exe 34 PID 1208 wrote to memory of 1816 1208 Process not Found 36 PID 1208 wrote to memory of 1816 1208 Process not Found 36 PID 1208 wrote to memory of 1816 1208 Process not Found 36 PID 1208 wrote to memory of 1816 1208 Process not Found 36 PID 1208 wrote to memory of 428 1208 Process not Found 37 PID 1208 wrote to memory of 428 1208 Process not Found 37 PID 1208 wrote to memory of 428 1208 Process not Found 37 PID 1208 wrote to memory of 428 1208 Process not Found 37 PID 1208 wrote to memory of 1680 1208 Process not Found 39 PID 1208 wrote to memory of 1680 1208 Process not Found 39 PID 1208 wrote to memory of 1680 1208 Process not Found 39 PID 1208 wrote to memory of 1680 1208 Process not Found 39 PID 1208 wrote to memory of 1608 1208 Process not Found 40 PID 1208 wrote to memory of 1608 1208 Process not Found 40 PID 1208 wrote to memory of 1608 1208 Process not Found 40 PID 1208 wrote to memory of 1608 1208 Process not Found 40 PID 1208 wrote to memory of 1696 1208 Process not Found 41 PID 1208 wrote to memory of 1696 1208 Process not Found 41 PID 1208 wrote to memory of 1696 1208 Process not Found 41 PID 1696 wrote to memory of 2132 1696 4551.exe 43 PID 1696 wrote to memory of 2132 1696 4551.exe 43 PID 1696 wrote to memory of 2132 1696 4551.exe 43 PID 1696 wrote to memory of 2132 1696 4551.exe 43 PID 1696 wrote to memory of 2176 1696 4551.exe 45 PID 1696 wrote to memory of 2176 1696 4551.exe 45 PID 1696 wrote to memory of 2176 1696 4551.exe 45 PID 1696 wrote to memory of 2176 1696 4551.exe 45 PID 1696 wrote to memory of 2204 1696 4551.exe 47 PID 1696 wrote to memory of 2204 1696 4551.exe 47 PID 1696 wrote to memory of 2204 1696 4551.exe 47 PID 1696 wrote to memory of 2204 1696 4551.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\e98e80b300af28043252190b020ee173.exe"C:\Users\Admin\AppData\Local\Temp\e98e80b300af28043252190b020ee173.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\e98e80b300af28043252190b020ee173.exe"C:\Users\Admin\AppData\Local\Temp\e98e80b300af28043252190b020ee173.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1824
-
-
C:\Users\Admin\AppData\Local\Temp\721.exeC:\Users\Admin\AppData\Local\Temp\721.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\721.exeC:\Users\Admin\AppData\Local\Temp\721.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\EEF.exeC:\Users\Admin\AppData\Local\Temp\EEF.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:572
-
C:\Users\Admin\AppData\Local\Temp\19A9.exeC:\Users\Admin\AppData\Local\Temp\19A9.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\ProgramData\Stub.exe"C:\ProgramData\Stub.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Users\Admin\AppData\Local\Temp\1D81.exeC:\Users\Admin\AppData\Local\Temp\1D81.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
C:\Users\Admin\AppData\Local\Temp\2D2B.exeC:\Users\Admin\AppData\Local\Temp\2D2B.exe1⤵
- Executes dropped EXE
PID:1816
-
C:\Users\Admin\AppData\Local\Temp\33F0.exeC:\Users\Admin\AppData\Local\Temp\33F0.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:428
-
C:\Users\Admin\AppData\Local\Temp\394E.exeC:\Users\Admin\AppData\Local\Temp\394E.exe1⤵
- Executes dropped EXE
PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3E1F.exeC:\Users\Admin\AppData\Local\Temp\3E1F.exe1⤵
- Executes dropped EXE
PID:1608
-
C:\Users\Admin\AppData\Local\Temp\4551.exeC:\Users\Admin\AppData\Local\Temp\4551.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\fbf.exe"C:\Users\Admin\AppData\Local\Temp\fbf.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2204
-
-
C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe"C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2808 -
C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe"C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2888
-