Analysis
- max time kernel
151s - max time network
131s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/09/2021, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
5021c0258bf60f4ffe914b6955310b6c.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5021c0258bf60f4ffe914b6955310b6c.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 5021c0258bf60f4ffe914b6955310b6c.exe
- Size 128KB
- Sample210929-sdwa2afcfn
- SHA256 d14036b4ab78b2c6121138471582c33a4bf0dbd2076f4c9e640d34a994fce2d3
- MD5 5021c0258bf60f4ffe914b6955310b6c
- SHA1 dad0442eacc757ecba05d60b9c76f7e63c2d392c
- SHA512 51afba8d83a3c7d370b1e77064e7ed8d761fb0a6a2d89c3ae29561d0ae56f8a7ad01dd245a06ba1753ce21e6c75228f92ebcfd763368d7c8b131e5a01938da21
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://fiskahlilian16.top/
-
http://paishancho17.top/
-
http://ydiannetter18.top/
-
http://azarehanelle19.top/
-
http://quericeriant20.top/
rc4.i32
rc4.i32
Extracted
Family
-
redline
Botnet
-
777777
C2
-
193.56.146.60:18243
Extracted
Family
-
raccoon
Botnet
-
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
-
redline
Botnet
-
5k superstar
C2
-
narlelalik.xyz:12509
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
resource yara_rule behavioral2/memory/3116-137-0x000000000041C5D2-mapping.dmp family_redline behavioral2/memory/3116-136-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral2/memory/1192-291-0x0000000002270000-0x000000000228F000-memory.dmp family_redline behavioral2/memory/1192-293-0x0000000002310000-0x000000000232E000-memory.dmp family_redline - SmokeLoader
Modular backdoor trojan in use since 2014.
- Turns off Windows Defender SpyNet reporting 2 TTPs
- suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
- suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
- Nirsoft 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab30-128.dat Nirsoft behavioral2/files/0x000100000001ab30-129.dat Nirsoft behavioral2/files/0x000100000001ab30-131.dat Nirsoft - Downloads MZ/PE file
- Executes dropped EXE 8 IoCs
pid Process 3972 BC27.exe 712 AdvancedRun.exe 1212 AdvancedRun.exe 3116 BC27.exe 3952 E0A7.exe 2836 ED5A.exe 1192 F74E.exe 4500 disksyncer.exe - Deletes itself 1 IoCs
pid Process 3020 Process not Found - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk disksyncer.exe - Loads dropped DLL 18 IoCs
pid Process 3952 E0A7.exe 3952 E0A7.exe 1360 MsiExec.exe 1360 MsiExec.exe 4540 MsiExec.exe 4540 MsiExec.exe 2836 ED5A.exe 4540 MsiExec.exe 4540 MsiExec.exe 4540 MsiExec.exe 4540 MsiExec.exe 3952 E0A7.exe 4500 disksyncer.exe 2836 ED5A.exe 2836 ED5A.exe 2836 ED5A.exe 2836 ED5A.exe 4500 disksyncer.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection BC27.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" BC27.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" BC27.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" BC27.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features BC27.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" BC27.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths BC27.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions BC27.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\BC27.exe = "0" BC27.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet BC27.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: E0A7.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: E0A7.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: E0A7.exe File opened (read-only) \??\H: E0A7.exe File opened (read-only) \??\J: E0A7.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: E0A7.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: E0A7.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: E0A7.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: E0A7.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: E0A7.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: E0A7.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: E0A7.exe File opened (read-only) \??\R: E0A7.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: E0A7.exe File opened (read-only) \??\S: E0A7.exe File opened (read-only) \??\Z: E0A7.exe File opened (read-only) \??\X: E0A7.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\F: E0A7.exe File opened (read-only) \??\I: E0A7.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe 3972 BC27.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 656 set thread context of 824 656 5021c0258bf60f4ffe914b6955310b6c.exe 68 PID 3972 set thread context of 3116 3972 BC27.exe 75 - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIAF6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC1F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{00CE1E75-E04C-4F83-824D-20B2297C955F} msiexec.exe File opened for modification C:\Windows\Installer\MSI789.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3CE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9AC.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI12B9.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\20083.msi msiexec.exe File opened for modification C:\Windows\Installer\20083.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID78.tmp msiexec.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3320 3972 WerFault.exe 69 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5021c0258bf60f4ffe914b6955310b6c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5021c0258bf60f4ffe914b6955310b6c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5021c0258bf60f4ffe914b6955310b6c.exe - Delays execution with timeout.exe 1 IoCs
pid Process 5088 timeout.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 E0A7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 E0A7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 E0A7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 E0A7.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 824 5021c0258bf60f4ffe914b6955310b6c.exe 824 5021c0258bf60f4ffe914b6955310b6c.exe 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 824 5021c0258bf60f4ffe914b6955310b6c.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3972 BC27.exe Token: SeDebugPrivilege 712 AdvancedRun.exe Token: SeImpersonatePrivilege 712 AdvancedRun.exe Token: SeDebugPrivilege 1212 AdvancedRun.exe Token: SeImpersonatePrivilege 1212 AdvancedRun.exe Token: SeDebugPrivilege 1316 powershell.exe Token: SeRestorePrivilege 3320 WerFault.exe Token: SeBackupPrivilege 3320 WerFault.exe Token: SeBackupPrivilege 3320 WerFault.exe Token: SeDebugPrivilege 3320 WerFault.exe Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeSecurityPrivilege 2272 msiexec.exe Token: SeCreateTokenPrivilege 3952 E0A7.exe Token: SeAssignPrimaryTokenPrivilege 3952 E0A7.exe Token: SeLockMemoryPrivilege 3952 E0A7.exe Token: SeIncreaseQuotaPrivilege 3952 E0A7.exe Token: SeMachineAccountPrivilege 3952 E0A7.exe Token: SeTcbPrivilege 3952 E0A7.exe Token: SeSecurityPrivilege 3952 E0A7.exe Token: SeTakeOwnershipPrivilege 3952 E0A7.exe Token: SeLoadDriverPrivilege 3952 E0A7.exe Token: SeSystemProfilePrivilege 3952 E0A7.exe Token: SeSystemtimePrivilege 3952 E0A7.exe Token: SeProfSingleProcessPrivilege 3952 E0A7.exe Token: SeIncBasePriorityPrivilege 3952 E0A7.exe Token: SeCreatePagefilePrivilege 3952 E0A7.exe Token: SeCreatePermanentPrivilege 3952 E0A7.exe Token: SeBackupPrivilege 3952 E0A7.exe Token: SeRestorePrivilege 3952 E0A7.exe Token: SeShutdownPrivilege 3952 E0A7.exe Token: SeDebugPrivilege 3952 E0A7.exe Token: SeAuditPrivilege 3952 E0A7.exe Token: SeSystemEnvironmentPrivilege 3952 E0A7.exe Token: SeChangeNotifyPrivilege 3952 E0A7.exe Token: SeRemoteShutdownPrivilege 3952 E0A7.exe Token: SeUndockPrivilege 3952 E0A7.exe Token: SeSyncAgentPrivilege 3952 E0A7.exe Token: SeEnableDelegationPrivilege 3952 E0A7.exe Token: SeManageVolumePrivilege 3952 E0A7.exe Token: SeImpersonatePrivilege 3952 E0A7.exe Token: SeCreateGlobalPrivilege 3952 E0A7.exe Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeCreateTokenPrivilege 3952 E0A7.exe Token: SeAssignPrimaryTokenPrivilege 3952 E0A7.exe Token: SeLockMemoryPrivilege 3952 E0A7.exe Token: SeIncreaseQuotaPrivilege 3952 E0A7.exe Token: SeMachineAccountPrivilege 3952 E0A7.exe Token: SeTcbPrivilege 3952 E0A7.exe Token: SeSecurityPrivilege 3952 E0A7.exe Token: SeTakeOwnershipPrivilege 3952 E0A7.exe Token: SeLoadDriverPrivilege 3952 E0A7.exe Token: SeSystemProfilePrivilege 3952 E0A7.exe Token: SeSystemtimePrivilege 3952 E0A7.exe Token: SeProfSingleProcessPrivilege 3952 E0A7.exe Token: SeIncBasePriorityPrivilege 3952 E0A7.exe Token: SeCreatePagefilePrivilege 3952 E0A7.exe Token: SeCreatePermanentPrivilege 3952 E0A7.exe Token: SeBackupPrivilege 3952 E0A7.exe Token: SeRestorePrivilege 3952 E0A7.exe Token: SeShutdownPrivilege 3952 E0A7.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 2824 msiexec.exe 2824 msiexec.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3020 Process not Found 3020 Process not Found - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 656 wrote to memory of 824 656 5021c0258bf60f4ffe914b6955310b6c.exe 68 PID 656 wrote to memory of 824 656 5021c0258bf60f4ffe914b6955310b6c.exe 68 PID 656 wrote to memory of 824 656 5021c0258bf60f4ffe914b6955310b6c.exe 68 PID 656 wrote to memory of 824 656 5021c0258bf60f4ffe914b6955310b6c.exe 68 PID 656 wrote to memory of 824 656 5021c0258bf60f4ffe914b6955310b6c.exe 68 PID 656 wrote to memory of 824 656 5021c0258bf60f4ffe914b6955310b6c.exe 68 PID 3020 wrote to memory of 3972 3020 Process not Found 69 PID 3020 wrote to memory of 3972 3020 Process not Found 69 PID 3020 wrote to memory of 3972 3020 Process not Found 69 PID 3972 wrote to memory of 712 3972 BC27.exe 70 PID 3972 wrote to memory of 712 3972 BC27.exe 70 PID 3972 wrote to memory of 712 3972 BC27.exe 70 PID 712 wrote to memory of 1212 712 AdvancedRun.exe 71 PID 712 wrote to memory of 1212 712 AdvancedRun.exe 71 PID 712 wrote to memory of 1212 712 AdvancedRun.exe 71 PID 3972 wrote to memory of 1316 3972 BC27.exe 73 PID 3972 wrote to memory of 1316 3972 BC27.exe 73 PID 3972 wrote to memory of 1316 3972 BC27.exe 73 PID 3972 wrote to memory of 3116 3972 BC27.exe 75 PID 3972 wrote to memory of 3116 3972 BC27.exe 75 PID 3972 wrote to memory of 3116 3972 BC27.exe 75 PID 3972 wrote to memory of 3116 3972 BC27.exe 75 PID 3972 wrote to memory of 3116 3972 BC27.exe 75 PID 3972 wrote to memory of 3116 3972 BC27.exe 75 PID 3972 wrote to memory of 3116 3972 BC27.exe 75 PID 3972 wrote to memory of 3116 3972 BC27.exe 75 PID 3020 wrote to memory of 3952 3020 Process not Found 81 PID 3020 wrote to memory of 3952 3020 Process not Found 81 PID 3020 wrote to memory of 3952 3020 Process not Found 81 PID 3020 wrote to memory of 2836 3020 Process not Found 84 PID 3020 wrote to memory of 2836 3020 Process not Found 84 PID 3020 wrote to memory of 2836 3020 Process not Found 84 PID 2272 wrote to memory of 1360 2272 msiexec.exe 85 PID 2272 wrote to memory of 1360 2272 msiexec.exe 85 PID 2272 wrote to memory of 1360 2272 msiexec.exe 85 PID 3952 wrote to memory of 2824 3952 E0A7.exe 88 PID 3952 wrote to memory of 2824 3952 E0A7.exe 88 PID 3952 wrote to memory of 2824 3952 E0A7.exe 88 PID 3020 wrote to memory of 1192 3020 Process not Found 87 PID 3020 wrote to memory of 1192 3020 Process not Found 87 PID 3020 wrote to memory of 1192 3020 Process not Found 87 PID 2272 wrote to memory of 4540 2272 msiexec.exe 90 PID 2272 wrote to memory of 4540 2272 msiexec.exe 90 PID 2272 wrote to memory of 4540 2272 msiexec.exe 90 PID 2272 wrote to memory of 4500 2272 msiexec.exe 91 PID 2272 wrote to memory of 4500 2272 msiexec.exe 91 PID 2272 wrote to memory of 4500 2272 msiexec.exe 91 PID 2836 wrote to memory of 5100 2836 ED5A.exe 92 PID 2836 wrote to memory of 5100 2836 ED5A.exe 92 PID 2836 wrote to memory of 5100 2836 ED5A.exe 92 PID 5100 wrote to memory of 5088 5100 cmd.exe 94 PID 5100 wrote to memory of 5088 5100 cmd.exe 94 PID 5100 wrote to memory of 5088 5100 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\5021c0258bf60f4ffe914b6955310b6c.exe"C:\Users\Admin\AppData\Local\Temp\5021c0258bf60f4ffe914b6955310b6c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5021c0258bf60f4ffe914b6955310b6c.exe"C:\Users\Admin\AppData\Local\Temp\5021c0258bf60f4ffe914b6955310b6c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:824
-
-
C:\Users\Admin\AppData\Local\Temp\BC27.exeC:\Users\Admin\AppData\Local\Temp\BC27.exe1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\c7d99855-c081-4abd-b53f-87ff5735101a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\c7d99855-c081-4abd-b53f-87ff5735101a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c7d99855-c081-4abd-b53f-87ff5735101a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\c7d99855-c081-4abd-b53f-87ff5735101a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\c7d99855-c081-4abd-b53f-87ff5735101a\AdvancedRun.exe" /SpecialRun 4101d8 7123⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BC27.exe" -Force2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
C:\Users\Admin\AppData\Local\Temp\BC27.exe"C:\Users\Admin\AppData\Local\Temp\BC27.exe"2⤵
- Executes dropped EXE
PID:3116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 22002⤵
- Drops file in Windows directory
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3320
-
-
C:\Users\Admin\AppData\Local\Temp\E0A7.exeC:\Users\Admin\AppData\Local\Temp\E0A7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\E0A7.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632934791 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2824
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 596AD0DCF372BF06787B40BEC6B3EF47 C2⤵
- Loads dropped DLL
PID:1360
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B8C92CBC57E75E05508A437EFA0FB4AF2⤵
- Loads dropped DLL
PID:4540
-
-
C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
PID:4500
-
-
C:\Users\Admin\AppData\Local\Temp\ED5A.exeC:\Users\Admin\AppData\Local\Temp\ED5A.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\ED5A.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:5088
-
-
-
C:\Users\Admin\AppData\Local\Temp\F74E.exeC:\Users\Admin\AppData\Local\Temp\F74E.exe1⤵
- Executes dropped EXE
PID:1192