Analysis
- max time kernel
151s - max time network
152s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
29/09/2021, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
3d36f877680341511604f09550d7dd20.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3d36f877680341511604f09550d7dd20.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target 3d36f877680341511604f09550d7dd20.exe
- Size 180KB
- Sample210929-dlwjfadefk
- SHA256 8e0bf87628ea9c37fd9a0ca40fbbac0bf8d219f2f514efad2f63e0ba90cf7dd4
- MD5 3d36f877680341511604f09550d7dd20
- SHA1 09efbeb35ec58e831ac58eeeac41947640d72a9d
- SHA512 fad0b7ac5e22f2a1d27305ca78297c42dd28709459ba36b74841ca5e5d21bcdfd8991881369afba2a095b88d1e7c0bec69a25a6c9be9f99d7c8f72e13f605a65
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://naghenrietti1.top/
-
http://kimballiett2.top/
-
http://xadriettany3.top/
-
http://jebeccallis4.top/
-
http://nityanneron5.top/
-
http://umayaniela6.top/
-
http://lynettaram7.top/
-
http://sadineyalas8.top/
-
http://geenaldencia9.top/
-
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
-
redline
Botnet
-
777777
C2
-
193.56.146.60:18243
Extracted
Family
-
raccoon
Botnet
-
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
resource yara_rule behavioral2/memory/960-134-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral2/memory/960-137-0x000000000041C5D2-mapping.dmp family_redline - SmokeLoader
Modular backdoor trojan in use since 2014.
- Turns off Windows Defender SpyNet reporting 2 TTPs
- suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
- suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
- suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
- Nirsoft 3 IoCs
resource yara_rule behavioral2/files/0x000400000001abbd-129.dat Nirsoft behavioral2/files/0x000400000001abbd-130.dat Nirsoft behavioral2/files/0x000400000001abbd-132.dat Nirsoft - Downloads MZ/PE file
- Executes dropped EXE 7 IoCs
pid Process 2672 F92B.exe 504 AdvancedRun.exe 3368 AdvancedRun.exe 960 F92B.exe 688 14B3.exe 3128 1CB3.exe 2612 disksyncer.exe - Deletes itself 1 IoCs
pid Process 3028 Process not Found - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk disksyncer.exe - Loads dropped DLL 18 IoCs
pid Process 688 14B3.exe 688 14B3.exe 2360 MsiExec.exe 2360 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe 688 14B3.exe 3128 1CB3.exe 2612 disksyncer.exe 3128 1CB3.exe 3128 1CB3.exe 3128 1CB3.exe 3128 1CB3.exe 2612 disksyncer.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths F92B.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet F92B.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" F92B.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features F92B.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" F92B.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions F92B.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\F92B.exe = "0" F92B.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection F92B.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" F92B.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" F92B.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: 14B3.exe File opened (read-only) \??\S: 14B3.exe File opened (read-only) \??\T: 14B3.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: 14B3.exe File opened (read-only) \??\R: 14B3.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: 14B3.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: 14B3.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: 14B3.exe File opened (read-only) \??\M: 14B3.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: 14B3.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: 14B3.exe File opened (read-only) \??\V: 14B3.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: 14B3.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: 14B3.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: 14B3.exe File opened (read-only) \??\J: 14B3.exe File opened (read-only) \??\Z: 14B3.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe 2672 F92B.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2060 set thread context of 2256 2060 3d36f877680341511604f09550d7dd20.exe 70 PID 2672 set thread context of 960 2672 F92B.exe 77 - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI2BB6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2CD1.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{00CE1E75-E04C-4F83-824D-20B2297C955F} msiexec.exe File created C:\Windows\Installer\325d8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI276F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI29D1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F73.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI382E.tmp msiexec.exe File opened for modification C:\Windows\Installer\325d8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI2E1A.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3d36f877680341511604f09550d7dd20.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3d36f877680341511604f09550d7dd20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3d36f877680341511604f09550d7dd20.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2312 timeout.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 14B3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 14B3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 14B3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 14B3.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2256 3d36f877680341511604f09550d7dd20.exe 2256 3d36f877680341511604f09550d7dd20.exe 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3028 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2256 3d36f877680341511604f09550d7dd20.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2672 F92B.exe Token: SeDebugPrivilege 504 AdvancedRun.exe Token: SeImpersonatePrivilege 504 AdvancedRun.exe Token: SeDebugPrivilege 3368 AdvancedRun.exe Token: SeImpersonatePrivilege 3368 AdvancedRun.exe Token: SeDebugPrivilege 692 powershell.exe Token: SeSecurityPrivilege 3912 msiexec.exe Token: SeCreateTokenPrivilege 688 14B3.exe Token: SeAssignPrimaryTokenPrivilege 688 14B3.exe Token: SeLockMemoryPrivilege 688 14B3.exe Token: SeIncreaseQuotaPrivilege 688 14B3.exe Token: SeMachineAccountPrivilege 688 14B3.exe Token: SeTcbPrivilege 688 14B3.exe Token: SeSecurityPrivilege 688 14B3.exe Token: SeTakeOwnershipPrivilege 688 14B3.exe Token: SeLoadDriverPrivilege 688 14B3.exe Token: SeSystemProfilePrivilege 688 14B3.exe Token: SeSystemtimePrivilege 688 14B3.exe Token: SeProfSingleProcessPrivilege 688 14B3.exe Token: SeIncBasePriorityPrivilege 688 14B3.exe Token: SeCreatePagefilePrivilege 688 14B3.exe Token: SeCreatePermanentPrivilege 688 14B3.exe Token: SeBackupPrivilege 688 14B3.exe Token: SeRestorePrivilege 688 14B3.exe Token: SeShutdownPrivilege 688 14B3.exe Token: SeDebugPrivilege 688 14B3.exe Token: SeAuditPrivilege 688 14B3.exe Token: SeSystemEnvironmentPrivilege 688 14B3.exe Token: SeChangeNotifyPrivilege 688 14B3.exe Token: SeRemoteShutdownPrivilege 688 14B3.exe Token: SeUndockPrivilege 688 14B3.exe Token: SeSyncAgentPrivilege 688 14B3.exe Token: SeEnableDelegationPrivilege 688 14B3.exe Token: SeManageVolumePrivilege 688 14B3.exe Token: SeImpersonatePrivilege 688 14B3.exe Token: SeCreateGlobalPrivilege 688 14B3.exe Token: SeCreateTokenPrivilege 688 14B3.exe Token: SeAssignPrimaryTokenPrivilege 688 14B3.exe Token: SeLockMemoryPrivilege 688 14B3.exe Token: SeIncreaseQuotaPrivilege 688 14B3.exe Token: SeMachineAccountPrivilege 688 14B3.exe Token: SeTcbPrivilege 688 14B3.exe Token: SeSecurityPrivilege 688 14B3.exe Token: SeTakeOwnershipPrivilege 688 14B3.exe Token: SeLoadDriverPrivilege 688 14B3.exe Token: SeSystemProfilePrivilege 688 14B3.exe Token: SeSystemtimePrivilege 688 14B3.exe Token: SeProfSingleProcessPrivilege 688 14B3.exe Token: SeIncBasePriorityPrivilege 688 14B3.exe Token: SeCreatePagefilePrivilege 688 14B3.exe Token: SeCreatePermanentPrivilege 688 14B3.exe Token: SeBackupPrivilege 688 14B3.exe Token: SeRestorePrivilege 688 14B3.exe Token: SeShutdownPrivilege 688 14B3.exe Token: SeDebugPrivilege 688 14B3.exe Token: SeAuditPrivilege 688 14B3.exe Token: SeSystemEnvironmentPrivilege 688 14B3.exe Token: SeChangeNotifyPrivilege 688 14B3.exe Token: SeRemoteShutdownPrivilege 688 14B3.exe Token: SeUndockPrivilege 688 14B3.exe Token: SeSyncAgentPrivilege 688 14B3.exe Token: SeEnableDelegationPrivilege 688 14B3.exe Token: SeManageVolumePrivilege 688 14B3.exe Token: SeImpersonatePrivilege 688 14B3.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2340 msiexec.exe 2340 msiexec.exe - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2256 2060 3d36f877680341511604f09550d7dd20.exe 70 PID 2060 wrote to memory of 2256 2060 3d36f877680341511604f09550d7dd20.exe 70 PID 2060 wrote to memory of 2256 2060 3d36f877680341511604f09550d7dd20.exe 70 PID 2060 wrote to memory of 2256 2060 3d36f877680341511604f09550d7dd20.exe 70 PID 2060 wrote to memory of 2256 2060 3d36f877680341511604f09550d7dd20.exe 70 PID 2060 wrote to memory of 2256 2060 3d36f877680341511604f09550d7dd20.exe 70 PID 3028 wrote to memory of 2672 3028 Process not Found 71 PID 3028 wrote to memory of 2672 3028 Process not Found 71 PID 3028 wrote to memory of 2672 3028 Process not Found 71 PID 2672 wrote to memory of 504 2672 F92B.exe 72 PID 2672 wrote to memory of 504 2672 F92B.exe 72 PID 2672 wrote to memory of 504 2672 F92B.exe 72 PID 504 wrote to memory of 3368 504 AdvancedRun.exe 73 PID 504 wrote to memory of 3368 504 AdvancedRun.exe 73 PID 504 wrote to memory of 3368 504 AdvancedRun.exe 73 PID 2672 wrote to memory of 692 2672 F92B.exe 75 PID 2672 wrote to memory of 692 2672 F92B.exe 75 PID 2672 wrote to memory of 692 2672 F92B.exe 75 PID 2672 wrote to memory of 960 2672 F92B.exe 77 PID 2672 wrote to memory of 960 2672 F92B.exe 77 PID 2672 wrote to memory of 960 2672 F92B.exe 77 PID 2672 wrote to memory of 960 2672 F92B.exe 77 PID 2672 wrote to memory of 960 2672 F92B.exe 77 PID 2672 wrote to memory of 960 2672 F92B.exe 77 PID 2672 wrote to memory of 960 2672 F92B.exe 77 PID 2672 wrote to memory of 960 2672 F92B.exe 77 PID 3028 wrote to memory of 688 3028 Process not Found 79 PID 3028 wrote to memory of 688 3028 Process not Found 79 PID 3028 wrote to memory of 688 3028 Process not Found 79 PID 3912 wrote to memory of 2360 3912 msiexec.exe 81 PID 3912 wrote to memory of 2360 3912 msiexec.exe 81 PID 3912 wrote to memory of 2360 3912 msiexec.exe 81 PID 3028 wrote to memory of 3128 3028 Process not Found 82 PID 3028 wrote to memory of 3128 3028 Process not Found 82 PID 3028 wrote to memory of 3128 3028 Process not Found 82 PID 688 wrote to memory of 2340 688 14B3.exe 83 PID 688 wrote to memory of 2340 688 14B3.exe 83 PID 688 wrote to memory of 2340 688 14B3.exe 83 PID 3912 wrote to memory of 2720 3912 msiexec.exe 84 PID 3912 wrote to memory of 2720 3912 msiexec.exe 84 PID 3912 wrote to memory of 2720 3912 msiexec.exe 84 PID 3912 wrote to memory of 2612 3912 msiexec.exe 86 PID 3912 wrote to memory of 2612 3912 msiexec.exe 86 PID 3912 wrote to memory of 2612 3912 msiexec.exe 86 PID 3128 wrote to memory of 1920 3128 1CB3.exe 87 PID 3128 wrote to memory of 1920 3128 1CB3.exe 87 PID 3128 wrote to memory of 1920 3128 1CB3.exe 87 PID 1920 wrote to memory of 2312 1920 cmd.exe 89 PID 1920 wrote to memory of 2312 1920 cmd.exe 89 PID 1920 wrote to memory of 2312 1920 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d36f877680341511604f09550d7dd20.exe"C:\Users\Admin\AppData\Local\Temp\3d36f877680341511604f09550d7dd20.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3d36f877680341511604f09550d7dd20.exe"C:\Users\Admin\AppData\Local\Temp\3d36f877680341511604f09550d7dd20.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2256
-
-
C:\Users\Admin\AppData\Local\Temp\F92B.exeC:\Users\Admin\AppData\Local\Temp\F92B.exe1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\be5c3f69-cf73-4aa8-b51d-c813ae159712\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\be5c3f69-cf73-4aa8-b51d-c813ae159712\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\be5c3f69-cf73-4aa8-b51d-c813ae159712\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Users\Admin\AppData\Local\Temp\be5c3f69-cf73-4aa8-b51d-c813ae159712\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\be5c3f69-cf73-4aa8-b51d-c813ae159712\AdvancedRun.exe" /SpecialRun 4101d8 5043⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3368
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\F92B.exe" -Force2⤵
- Suspicious use of AdjustPrivilegeToken
PID:692
-
-
C:\Users\Admin\AppData\Local\Temp\F92B.exe"C:\Users\Admin\AppData\Local\Temp\F92B.exe"2⤵
- Executes dropped EXE
PID:960
-
-
C:\Users\Admin\AppData\Local\Temp\14B3.exeC:\Users\Admin\AppData\Local\Temp\14B3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\14B3.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632884616 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2340
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1A74B0A8FEA8D577FCF244030F4342AA C2⤵
- Loads dropped DLL
PID:2360
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C61545F4ECE9AFDFC47D1A400B93C9E22⤵
- Loads dropped DLL
PID:2720
-
-
C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\1CB3.exeC:\Users\Admin\AppData\Local\Temp\1CB3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\1CB3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:2312
-
-