Analysis
-
max time kernel
151s -
max time network
107s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 18:46
Static task
static1
Behavioral task
behavioral1
Sample
b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe
Resource
win10v20210408
redlineservhelpersmokeloaderxmrig777777backdoordiscoveryevasioninfostealerminerpersistencespywarestealersuricatatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe
-
Size
234KB
-
MD5
8fc231b273bce371d521d8ce5283aa6a
-
SHA1
4edb2f91be0120c3fa3fad07e295b1cd3bbd381b
-
SHA256
b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5
-
SHA512
5299b8c987407efbadfb41f088b498cfb1d508d5f5a1f8d28bc608184d6270e2995a8bfbc0401d8e012adf54e06ee5f9f7e2fb465bd22a36ea47f688e8333c28
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
777777
C2
193.56.146.60:18243
Extracted
Family
redline
C2
87.251.71.44:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral1/memory/408-168-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/408-169-0x000000000041C5D2-mapping.dmp family_redline behavioral1/memory/2712-202-0x0000000004940000-0x000000000497A000-memory.dmp family_redline behavioral1/memory/2712-204-0x0000000007110000-0x0000000007149000-memory.dmp family_redline -
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Nirsoft 3 IoCs
resource yara_rule behavioral1/files/0x000100000001ab5a-143.dat Nirsoft behavioral1/files/0x000100000001ab5a-144.dat Nirsoft behavioral1/files/0x000100000001ab5a-146.dat Nirsoft -
Executes dropped EXE 9 IoCs
pid Process 2472 EA2C.exe 2684 F2D8.exe 3148 AdvancedRun.exe 3692 AdvancedRun.exe 3044 CF8.exe 2708 F2D8.exe 408 F2D8.exe 2712 1640.exe 5080 disksyncer.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
Deletes itself 1 IoCs
pid Process 3024 Process not Found -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk disksyncer.exe -
Loads dropped DLL 13 IoCs
pid Process 3044 CF8.exe 3044 CF8.exe 3800 MsiExec.exe 3800 MsiExec.exe 4384 MsiExec.exe 4384 MsiExec.exe 4384 MsiExec.exe 4384 MsiExec.exe 4384 MsiExec.exe 4384 MsiExec.exe 3044 CF8.exe 5080 disksyncer.exe 5080 disksyncer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet F2D8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" F2D8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" F2D8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths F2D8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\F2D8.exe = "0" F2D8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" F2D8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features F2D8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions F2D8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection F2D8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" F2D8.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: CF8.exe File opened (read-only) \??\W: CF8.exe File opened (read-only) \??\X: CF8.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: CF8.exe File opened (read-only) \??\T: CF8.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: CF8.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: CF8.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: CF8.exe File opened (read-only) \??\N: CF8.exe File opened (read-only) \??\R: CF8.exe File opened (read-only) \??\S: CF8.exe File opened (read-only) \??\E: CF8.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: CF8.exe File opened (read-only) \??\U: CF8.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: CF8.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: CF8.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: CF8.exe File opened (read-only) \??\P: CF8.exe File opened (read-only) \??\Y: CF8.exe File opened (read-only) \??\L: CF8.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: CF8.exe File opened (read-only) \??\O: CF8.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rdpclip.exe powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe 2684 F2D8.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 664 set thread context of 840 664 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe 68 PID 2684 set thread context of 408 2684 F2D8.exe 84 -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\Installer\23696.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3FC1.tmp msiexec.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\Installer\MSI3CA2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI43AB.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\Installer\MSI4178.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\Installer\MSI4E5B.tmp msiexec.exe File created C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\Installer\23696.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI39F2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3E59.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{00CE1E75-E04C-4F83-824D-20B2297C955F} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4420 reg.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 CF8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 CF8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 CF8.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 840 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe 840 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 612 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 840 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2684 F2D8.exe Token: SeDebugPrivilege 3148 AdvancedRun.exe Token: SeImpersonatePrivilege 3148 AdvancedRun.exe Token: SeDebugPrivilege 3692 AdvancedRun.exe Token: SeImpersonatePrivilege 3692 AdvancedRun.exe Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeDebugPrivilege 996 powershell.exe Token: SeDebugPrivilege 1104 powershell.exe Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeSecurityPrivilege 3568 msiexec.exe Token: SeCreateTokenPrivilege 3044 CF8.exe Token: SeAssignPrimaryTokenPrivilege 3044 CF8.exe Token: SeLockMemoryPrivilege 3044 CF8.exe Token: SeIncreaseQuotaPrivilege 3044 CF8.exe Token: SeMachineAccountPrivilege 3044 CF8.exe Token: SeTcbPrivilege 3044 CF8.exe Token: SeSecurityPrivilege 3044 CF8.exe Token: SeTakeOwnershipPrivilege 3044 CF8.exe Token: SeLoadDriverPrivilege 3044 CF8.exe Token: SeSystemProfilePrivilege 3044 CF8.exe Token: SeSystemtimePrivilege 3044 CF8.exe Token: SeProfSingleProcessPrivilege 3044 CF8.exe Token: SeIncBasePriorityPrivilege 3044 CF8.exe Token: SeCreatePagefilePrivilege 3044 CF8.exe Token: SeCreatePermanentPrivilege 3044 CF8.exe Token: SeBackupPrivilege 3044 CF8.exe Token: SeRestorePrivilege 3044 CF8.exe Token: SeShutdownPrivilege 3044 CF8.exe Token: SeDebugPrivilege 3044 CF8.exe Token: SeAuditPrivilege 3044 CF8.exe Token: SeSystemEnvironmentPrivilege 3044 CF8.exe Token: SeChangeNotifyPrivilege 3044 CF8.exe Token: SeRemoteShutdownPrivilege 3044 CF8.exe Token: SeUndockPrivilege 3044 CF8.exe Token: SeSyncAgentPrivilege 3044 CF8.exe Token: SeEnableDelegationPrivilege 3044 CF8.exe Token: SeManageVolumePrivilege 3044 CF8.exe Token: SeImpersonatePrivilege 3044 CF8.exe Token: SeCreateGlobalPrivilege 3044 CF8.exe Token: SeCreateTokenPrivilege 3044 CF8.exe Token: SeAssignPrimaryTokenPrivilege 3044 CF8.exe Token: SeLockMemoryPrivilege 3044 CF8.exe Token: SeIncreaseQuotaPrivilege 3044 CF8.exe Token: SeMachineAccountPrivilege 3044 CF8.exe Token: SeTcbPrivilege 3044 CF8.exe Token: SeSecurityPrivilege 3044 CF8.exe Token: SeTakeOwnershipPrivilege 3044 CF8.exe Token: SeLoadDriverPrivilege 3044 CF8.exe Token: SeSystemProfilePrivilege 3044 CF8.exe Token: SeSystemtimePrivilege 3044 CF8.exe Token: SeProfSingleProcessPrivilege 3044 CF8.exe Token: SeIncBasePriorityPrivilege 3044 CF8.exe Token: SeCreatePagefilePrivilege 3044 CF8.exe Token: SeCreatePermanentPrivilege 3044 CF8.exe Token: SeBackupPrivilege 3044 CF8.exe Token: SeRestorePrivilege 3044 CF8.exe Token: SeShutdownPrivilege 3044 CF8.exe Token: SeDebugPrivilege 3044 CF8.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 4124 msiexec.exe 4124 msiexec.exe 3024 Process not Found 3024 Process not Found -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3024 Process not Found 3024 Process not Found 3024 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 664 wrote to memory of 840 664 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe 68 PID 664 wrote to memory of 840 664 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe 68 PID 664 wrote to memory of 840 664 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe 68 PID 664 wrote to memory of 840 664 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe 68 PID 664 wrote to memory of 840 664 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe 68 PID 664 wrote to memory of 840 664 b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe 68 PID 3024 wrote to memory of 2472 3024 Process not Found 71 PID 3024 wrote to memory of 2472 3024 Process not Found 71 PID 3024 wrote to memory of 2472 3024 Process not Found 71 PID 3024 wrote to memory of 2684 3024 Process not Found 72 PID 3024 wrote to memory of 2684 3024 Process not Found 72 PID 3024 wrote to memory of 2684 3024 Process not Found 72 PID 2684 wrote to memory of 3148 2684 F2D8.exe 73 PID 2684 wrote to memory of 3148 2684 F2D8.exe 73 PID 2684 wrote to memory of 3148 2684 F2D8.exe 73 PID 3148 wrote to memory of 3692 3148 AdvancedRun.exe 74 PID 3148 wrote to memory of 3692 3148 AdvancedRun.exe 74 PID 3148 wrote to memory of 3692 3148 AdvancedRun.exe 74 PID 3024 wrote to memory of 3044 3024 Process not Found 78 PID 3024 wrote to memory of 3044 3024 Process not Found 78 PID 3024 wrote to memory of 3044 3024 Process not Found 78 PID 2472 wrote to memory of 996 2472 EA2C.exe 79 PID 2472 wrote to memory of 996 2472 EA2C.exe 79 PID 2472 wrote to memory of 996 2472 EA2C.exe 79 PID 2684 wrote to memory of 1104 2684 F2D8.exe 81 PID 2684 wrote to memory of 1104 2684 F2D8.exe 81 PID 2684 wrote to memory of 1104 2684 F2D8.exe 81 PID 2684 wrote to memory of 2708 2684 F2D8.exe 83 PID 2684 wrote to memory of 2708 2684 F2D8.exe 83 PID 2684 wrote to memory of 2708 2684 F2D8.exe 83 PID 2684 wrote to memory of 408 2684 F2D8.exe 84 PID 2684 wrote to memory of 408 2684 F2D8.exe 84 PID 2684 wrote to memory of 408 2684 F2D8.exe 84 PID 2684 wrote to memory of 408 2684 F2D8.exe 84 PID 2684 wrote to memory of 408 2684 F2D8.exe 84 PID 2684 wrote to memory of 408 2684 F2D8.exe 84 PID 2684 wrote to memory of 408 2684 F2D8.exe 84 PID 2684 wrote to memory of 408 2684 F2D8.exe 84 PID 3024 wrote to memory of 2712 3024 Process not Found 86 PID 3024 wrote to memory of 2712 3024 Process not Found 86 PID 3024 wrote to memory of 2712 3024 Process not Found 86 PID 3568 wrote to memory of 3800 3568 msiexec.exe 89 PID 3568 wrote to memory of 3800 3568 msiexec.exe 89 PID 3568 wrote to memory of 3800 3568 msiexec.exe 89 PID 3044 wrote to memory of 4124 3044 CF8.exe 90 PID 3044 wrote to memory of 4124 3044 CF8.exe 90 PID 3044 wrote to memory of 4124 3044 CF8.exe 90 PID 996 wrote to memory of 4308 996 powershell.exe 91 PID 996 wrote to memory of 4308 996 powershell.exe 91 PID 996 wrote to memory of 4308 996 powershell.exe 91 PID 3568 wrote to memory of 4384 3568 msiexec.exe 92 PID 3568 wrote to memory of 4384 3568 msiexec.exe 92 PID 3568 wrote to memory of 4384 3568 msiexec.exe 92 PID 4308 wrote to memory of 4468 4308 csc.exe 93 PID 4308 wrote to memory of 4468 4308 csc.exe 93 PID 4308 wrote to memory of 4468 4308 csc.exe 93 PID 3568 wrote to memory of 5080 3568 msiexec.exe 94 PID 3568 wrote to memory of 5080 3568 msiexec.exe 94 PID 3568 wrote to memory of 5080 3568 msiexec.exe 94 PID 996 wrote to memory of 4272 996 powershell.exe 95 PID 996 wrote to memory of 4272 996 powershell.exe 95 PID 996 wrote to memory of 4272 996 powershell.exe 95 PID 996 wrote to memory of 3944 996 powershell.exe 97 PID 996 wrote to memory of 3944 996 powershell.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe"C:\Users\Admin\AppData\Local\Temp\b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe"C:\Users\Admin\AppData\Local\Temp\b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\EA2C.exeC:\Users\Admin\AppData\Local\Temp\EA2C.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qrunw1ld\qrunw1ld.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C24.tmp" "c:\Users\Admin\AppData\Local\Temp\qrunw1ld\CSC2DB1E1B3E9545B4A0649E6743211DA2.TMP"4⤵PID:4468
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵PID:4272
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵PID:3944
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵PID:3868
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:1460
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:4420
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:836
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵PID:3108
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:4852
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵PID:3136
-
C:\Windows\SysWOW64\cmd.execmd /c net start rdpdr4⤵PID:2844
-
C:\Windows\SysWOW64\net.exenet start rdpdr5⤵PID:4132
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:4144
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵PID:4788
-
C:\Windows\SysWOW64\cmd.execmd /c net start TermService4⤵PID:928
-
C:\Windows\SysWOW64\net.exenet start TermService5⤵PID:5028
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:3544
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:4504
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:4528
-
-
-
C:\Users\Admin\AppData\Local\Temp\F2D8.exeC:\Users\Admin\AppData\Local\Temp\F2D8.exe1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\671d0f30-957e-4791-9a9d-7b56fcebec09\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\671d0f30-957e-4791-9a9d-7b56fcebec09\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\671d0f30-957e-4791-9a9d-7b56fcebec09\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\671d0f30-957e-4791-9a9d-7b56fcebec09\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\671d0f30-957e-4791-9a9d-7b56fcebec09\AdvancedRun.exe" /SpecialRun 4101d8 31483⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3692
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\F2D8.exe" -Force2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\F2D8.exe"C:\Users\Admin\AppData\Local\Temp\F2D8.exe"2⤵
- Executes dropped EXE
PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\F2D8.exe"C:\Users\Admin\AppData\Local\Temp\F2D8.exe"2⤵
- Executes dropped EXE
PID:408
-
-
C:\Users\Admin\AppData\Local\Temp\CF8.exeC:\Users\Admin\AppData\Local\Temp\CF8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\CF8.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632861883 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:4124
-
-
C:\Users\Admin\AppData\Local\Temp\1640.exeC:\Users\Admin\AppData\Local\Temp\1640.exe1⤵
- Executes dropped EXE
PID:2712
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3F5FA68BEDE8A777D7531A6A280F98BF C2⤵
- Loads dropped DLL
PID:3800
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 577BE9D3B008C2BCA39734990DF5C0902⤵
- Loads dropped DLL
PID:4384
-
-
C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
PID:5080
-