Analysis
-
max time kernel
151s -
max time network
103s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 16:16
Static task
static1
Behavioral task
behavioral1
Sample
c30c528c3c3d33903c598ef03b799e58.exe
Resource
win7-en-20210920
gozi_rm3raccoonredlinesmokeloadertofseexmrig5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d45k superstarspectrumbackdoorbankerdiscoveryevasioninfostealerminerpersistencespywarestealersuricatatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c30c528c3c3d33903c598ef03b799e58.exe
Resource
win10v20210408
raccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d45k superstarspectrumbackdoordiscoveryinfostealerspywarestealersuricatatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
c30c528c3c3d33903c598ef03b799e58.exe
-
Size
222KB
-
MD5
c30c528c3c3d33903c598ef03b799e58
-
SHA1
8551c666ae37a03fd61cded18a9d3227c745d0cd
-
SHA256
85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6
-
SHA512
70c46d9a53a895131ad3d1a35dfb682637ff75a61d909a66de7bf4abe6b7dc20aa106538b97adda89dcba977e81c3e3bdb5aa69f808f7d484f20c42f11988d18
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
redline
Botnet
5k superstar
C2
narlelalik.xyz:12509
Extracted
Family
redline
Botnet
Spectrum
C2
190.2.145.73:16827
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral2/memory/748-163-0x0000000002270000-0x000000000228F000-memory.dmp family_redline behavioral2/memory/748-171-0x0000000002420000-0x000000000243E000-memory.dmp family_redline behavioral2/memory/1808-173-0x0000000002330000-0x000000000234F000-memory.dmp family_redline behavioral2/memory/1808-175-0x00000000023E0000-0x00000000023FE000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
pid Process 4868 D155.exe 992 DD3C.exe 748 E59A.exe 1808 F182.exe 2972 disksyncer.exe -
Deletes itself 1 IoCs
pid Process 2900 Process not Found -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk disksyncer.exe -
Loads dropped DLL 18 IoCs
pid Process 4868 D155.exe 4868 D155.exe 2872 MsiExec.exe 2872 MsiExec.exe 992 DD3C.exe 1504 MsiExec.exe 1504 MsiExec.exe 1504 MsiExec.exe 1504 MsiExec.exe 1504 MsiExec.exe 1504 MsiExec.exe 4868 D155.exe 992 DD3C.exe 992 DD3C.exe 992 DD3C.exe 992 DD3C.exe 2972 disksyncer.exe 2972 disksyncer.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: D155.exe File opened (read-only) \??\K: D155.exe File opened (read-only) \??\Q: D155.exe File opened (read-only) \??\T: D155.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: D155.exe File opened (read-only) \??\F: D155.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: D155.exe File opened (read-only) \??\P: D155.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: D155.exe File opened (read-only) \??\G: D155.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: D155.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: D155.exe File opened (read-only) \??\V: D155.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: D155.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: D155.exe File opened (read-only) \??\R: D155.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: D155.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: D155.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: D155.exe File opened (read-only) \??\U: D155.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: D155.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4796 set thread context of 4820 4796 c30c528c3c3d33903c598ef03b799e58.exe 68 -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\1eb93.msi msiexec.exe File opened for modification C:\Windows\Installer\1eb93.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEF8B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF2D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF49E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF8B8.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{00CE1E75-E04C-4F83-824D-20B2297C955F} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF606.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF711.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2BB.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c30c528c3c3d33903c598ef03b799e58.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c30c528c3c3d33903c598ef03b799e58.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c30c528c3c3d33903c598ef03b799e58.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3992 timeout.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 D155.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 D155.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 D155.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 D155.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 c30c528c3c3d33903c598ef03b799e58.exe 4820 c30c528c3c3d33903c598ef03b799e58.exe 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2900 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4820 c30c528c3c3d33903c598ef03b799e58.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4140 msiexec.exe Token: SeCreateTokenPrivilege 4868 D155.exe Token: SeAssignPrimaryTokenPrivilege 4868 D155.exe Token: SeLockMemoryPrivilege 4868 D155.exe Token: SeIncreaseQuotaPrivilege 4868 D155.exe Token: SeMachineAccountPrivilege 4868 D155.exe Token: SeTcbPrivilege 4868 D155.exe Token: SeSecurityPrivilege 4868 D155.exe Token: SeTakeOwnershipPrivilege 4868 D155.exe Token: SeLoadDriverPrivilege 4868 D155.exe Token: SeSystemProfilePrivilege 4868 D155.exe Token: SeSystemtimePrivilege 4868 D155.exe Token: SeProfSingleProcessPrivilege 4868 D155.exe Token: SeIncBasePriorityPrivilege 4868 D155.exe Token: SeCreatePagefilePrivilege 4868 D155.exe Token: SeCreatePermanentPrivilege 4868 D155.exe Token: SeBackupPrivilege 4868 D155.exe Token: SeRestorePrivilege 4868 D155.exe Token: SeShutdownPrivilege 4868 D155.exe Token: SeDebugPrivilege 4868 D155.exe Token: SeAuditPrivilege 4868 D155.exe Token: SeSystemEnvironmentPrivilege 4868 D155.exe Token: SeChangeNotifyPrivilege 4868 D155.exe Token: SeRemoteShutdownPrivilege 4868 D155.exe Token: SeUndockPrivilege 4868 D155.exe Token: SeSyncAgentPrivilege 4868 D155.exe Token: SeEnableDelegationPrivilege 4868 D155.exe Token: SeManageVolumePrivilege 4868 D155.exe Token: SeImpersonatePrivilege 4868 D155.exe Token: SeCreateGlobalPrivilege 4868 D155.exe Token: SeCreateTokenPrivilege 4868 D155.exe Token: SeAssignPrimaryTokenPrivilege 4868 D155.exe Token: SeLockMemoryPrivilege 4868 D155.exe Token: SeIncreaseQuotaPrivilege 4868 D155.exe Token: SeMachineAccountPrivilege 4868 D155.exe Token: SeTcbPrivilege 4868 D155.exe Token: SeSecurityPrivilege 4868 D155.exe Token: SeTakeOwnershipPrivilege 4868 D155.exe Token: SeLoadDriverPrivilege 4868 D155.exe Token: SeSystemProfilePrivilege 4868 D155.exe Token: SeSystemtimePrivilege 4868 D155.exe Token: SeProfSingleProcessPrivilege 4868 D155.exe Token: SeIncBasePriorityPrivilege 4868 D155.exe Token: SeCreatePagefilePrivilege 4868 D155.exe Token: SeCreatePermanentPrivilege 4868 D155.exe Token: SeBackupPrivilege 4868 D155.exe Token: SeRestorePrivilege 4868 D155.exe Token: SeShutdownPrivilege 4868 D155.exe Token: SeDebugPrivilege 4868 D155.exe Token: SeAuditPrivilege 4868 D155.exe Token: SeSystemEnvironmentPrivilege 4868 D155.exe Token: SeChangeNotifyPrivilege 4868 D155.exe Token: SeRemoteShutdownPrivilege 4868 D155.exe Token: SeUndockPrivilege 4868 D155.exe Token: SeSyncAgentPrivilege 4868 D155.exe Token: SeEnableDelegationPrivilege 4868 D155.exe Token: SeManageVolumePrivilege 4868 D155.exe Token: SeImpersonatePrivilege 4868 D155.exe Token: SeCreateGlobalPrivilege 4868 D155.exe Token: SeCreateTokenPrivilege 4868 D155.exe Token: SeAssignPrimaryTokenPrivilege 4868 D155.exe Token: SeLockMemoryPrivilege 4868 D155.exe Token: SeIncreaseQuotaPrivilege 4868 D155.exe Token: SeMachineAccountPrivilege 4868 D155.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 740 msiexec.exe 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 740 msiexec.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4820 4796 c30c528c3c3d33903c598ef03b799e58.exe 68 PID 4796 wrote to memory of 4820 4796 c30c528c3c3d33903c598ef03b799e58.exe 68 PID 4796 wrote to memory of 4820 4796 c30c528c3c3d33903c598ef03b799e58.exe 68 PID 4796 wrote to memory of 4820 4796 c30c528c3c3d33903c598ef03b799e58.exe 68 PID 4796 wrote to memory of 4820 4796 c30c528c3c3d33903c598ef03b799e58.exe 68 PID 4796 wrote to memory of 4820 4796 c30c528c3c3d33903c598ef03b799e58.exe 68 PID 2900 wrote to memory of 4868 2900 Process not Found 69 PID 2900 wrote to memory of 4868 2900 Process not Found 69 PID 2900 wrote to memory of 4868 2900 Process not Found 69 PID 2900 wrote to memory of 992 2900 Process not Found 72 PID 2900 wrote to memory of 992 2900 Process not Found 72 PID 2900 wrote to memory of 992 2900 Process not Found 72 PID 4140 wrote to memory of 2872 4140 msiexec.exe 75 PID 4140 wrote to memory of 2872 4140 msiexec.exe 75 PID 4140 wrote to memory of 2872 4140 msiexec.exe 75 PID 2900 wrote to memory of 748 2900 Process not Found 76 PID 2900 wrote to memory of 748 2900 Process not Found 76 PID 2900 wrote to memory of 748 2900 Process not Found 76 PID 4868 wrote to memory of 740 4868 D155.exe 77 PID 4868 wrote to memory of 740 4868 D155.exe 77 PID 4868 wrote to memory of 740 4868 D155.exe 77 PID 4140 wrote to memory of 1504 4140 msiexec.exe 81 PID 4140 wrote to memory of 1504 4140 msiexec.exe 81 PID 4140 wrote to memory of 1504 4140 msiexec.exe 81 PID 2900 wrote to memory of 1808 2900 Process not Found 82 PID 2900 wrote to memory of 1808 2900 Process not Found 82 PID 2900 wrote to memory of 1808 2900 Process not Found 82 PID 4140 wrote to memory of 2972 4140 msiexec.exe 84 PID 4140 wrote to memory of 2972 4140 msiexec.exe 84 PID 4140 wrote to memory of 2972 4140 msiexec.exe 84 PID 992 wrote to memory of 2756 992 DD3C.exe 85 PID 992 wrote to memory of 2756 992 DD3C.exe 85 PID 992 wrote to memory of 2756 992 DD3C.exe 85 PID 2756 wrote to memory of 3992 2756 cmd.exe 87 PID 2756 wrote to memory of 3992 2756 cmd.exe 87 PID 2756 wrote to memory of 3992 2756 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c30c528c3c3d33903c598ef03b799e58.exe"C:\Users\Admin\AppData\Local\Temp\c30c528c3c3d33903c598ef03b799e58.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\c30c528c3c3d33903c598ef03b799e58.exe"C:\Users\Admin\AppData\Local\Temp\c30c528c3c3d33903c598ef03b799e58.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4820
-
-
C:\Users\Admin\AppData\Local\Temp\D155.exeC:\Users\Admin\AppData\Local\Temp\D155.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\D155.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632939281 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:740
-
-
C:\Users\Admin\AppData\Local\Temp\DD3C.exeC:\Users\Admin\AppData\Local\Temp\DD3C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\DD3C.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:3992
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 68A3D530BA46C36A289A1AF316A688DE C2⤵
- Loads dropped DLL
PID:2872
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 27499773E77E17BDC3455E75A6455C812⤵
- Loads dropped DLL
PID:1504
-
-
C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
PID:2972
-
-
C:\Users\Admin\AppData\Local\Temp\E59A.exeC:\Users\Admin\AppData\Local\Temp\E59A.exe1⤵
- Executes dropped EXE
PID:748
-
C:\Users\Admin\AppData\Local\Temp\F182.exeC:\Users\Admin\AppData\Local\Temp\F182.exe1⤵
- Executes dropped EXE
PID:1808