Analysis
-
max time kernel
151s -
max time network
100s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 16:22
Static task
static1
Behavioral task
behavioral1
Sample
7687054ef76c0842a827c7249c7c5454.exe
Resource
win7-en-20210920
gozi_rm3raccoonredlinesmokeloadertofseexmrig5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d45k superstarspectrumbackdoorbankerdiscoveryevasioninfostealerminerpersistencespywarestealersuricatatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7687054ef76c0842a827c7249c7c5454.exe
Resource
win10v20210408
raccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d45k superstarspectrumbackdoordiscoveryinfostealerspywarestealersuricatatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
7687054ef76c0842a827c7249c7c5454.exe
-
Size
221KB
-
MD5
7687054ef76c0842a827c7249c7c5454
-
SHA1
da4177807371fa64acc17dfdd0fa0b6d6c39a8b7
-
SHA256
f085d79b0b46ad9eda7f2191e2e668314553251ab5d0f4936f84cd2c1afa2564
-
SHA512
2e32bfffb654c0372fc190f859152bd60136cbeb182a6f64f7f12ae46641f2b1fc498c87dd3513d015fcf9f6187ec6287cfe37660b42b474562137605452773a
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
redline
Botnet
5k superstar
C2
narlelalik.xyz:12509
Extracted
Family
redline
Botnet
Spectrum
C2
190.2.145.73:16827
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral2/memory/3164-162-0x00000000022B0000-0x00000000022CF000-memory.dmp family_redline behavioral2/memory/3164-171-0x0000000002420000-0x000000000243E000-memory.dmp family_redline behavioral2/memory/732-176-0x0000000000770000-0x000000000078F000-memory.dmp family_redline behavioral2/memory/732-178-0x0000000002370000-0x000000000238E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
pid Process 1208 C6B6.exe 1808 D2AD.exe 3164 DB69.exe 732 E6D4.exe 4232 disksyncer.exe -
Deletes itself 1 IoCs
pid Process 3020 Process not Found -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk disksyncer.exe -
Loads dropped DLL 18 IoCs
pid Process 1208 C6B6.exe 1208 C6B6.exe 1864 MsiExec.exe 1864 MsiExec.exe 1808 D2AD.exe 1144 MsiExec.exe 1144 MsiExec.exe 1144 MsiExec.exe 1144 MsiExec.exe 1144 MsiExec.exe 1144 MsiExec.exe 1208 C6B6.exe 1808 D2AD.exe 1808 D2AD.exe 1808 D2AD.exe 1808 D2AD.exe 4232 disksyncer.exe 4232 disksyncer.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: C6B6.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: C6B6.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: C6B6.exe File opened (read-only) \??\K: C6B6.exe File opened (read-only) \??\M: C6B6.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: C6B6.exe File opened (read-only) \??\O: C6B6.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: C6B6.exe File opened (read-only) \??\Z: C6B6.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: C6B6.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: C6B6.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: C6B6.exe File opened (read-only) \??\P: C6B6.exe File opened (read-only) \??\S: C6B6.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: C6B6.exe File opened (read-only) \??\L: C6B6.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: C6B6.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: C6B6.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: C6B6.exe File opened (read-only) \??\X: C6B6.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: C6B6.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 992 set thread context of 380 992 7687054ef76c0842a827c7249c7c5454.exe 68 -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{00CE1E75-E04C-4F83-824D-20B2297C955F} msiexec.exe File created C:\Windows\Installer\1e2e9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE654.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE7CC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE9C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEB2A.tmp msiexec.exe File opened for modification C:\Windows\Installer\1e2e9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE8F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIECA2.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF87A.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7687054ef76c0842a827c7249c7c5454.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7687054ef76c0842a827c7249c7c5454.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7687054ef76c0842a827c7249c7c5454.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4344 timeout.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 C6B6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C6B6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C6B6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C6B6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 380 7687054ef76c0842a827c7249c7c5454.exe 380 7687054ef76c0842a827c7249c7c5454.exe 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 380 7687054ef76c0842a827c7249c7c5454.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1672 msiexec.exe Token: SeCreateTokenPrivilege 1208 C6B6.exe Token: SeAssignPrimaryTokenPrivilege 1208 C6B6.exe Token: SeLockMemoryPrivilege 1208 C6B6.exe Token: SeIncreaseQuotaPrivilege 1208 C6B6.exe Token: SeMachineAccountPrivilege 1208 C6B6.exe Token: SeTcbPrivilege 1208 C6B6.exe Token: SeSecurityPrivilege 1208 C6B6.exe Token: SeTakeOwnershipPrivilege 1208 C6B6.exe Token: SeLoadDriverPrivilege 1208 C6B6.exe Token: SeSystemProfilePrivilege 1208 C6B6.exe Token: SeSystemtimePrivilege 1208 C6B6.exe Token: SeProfSingleProcessPrivilege 1208 C6B6.exe Token: SeIncBasePriorityPrivilege 1208 C6B6.exe Token: SeCreatePagefilePrivilege 1208 C6B6.exe Token: SeCreatePermanentPrivilege 1208 C6B6.exe Token: SeBackupPrivilege 1208 C6B6.exe Token: SeRestorePrivilege 1208 C6B6.exe Token: SeShutdownPrivilege 1208 C6B6.exe Token: SeDebugPrivilege 1208 C6B6.exe Token: SeAuditPrivilege 1208 C6B6.exe Token: SeSystemEnvironmentPrivilege 1208 C6B6.exe Token: SeChangeNotifyPrivilege 1208 C6B6.exe Token: SeRemoteShutdownPrivilege 1208 C6B6.exe Token: SeUndockPrivilege 1208 C6B6.exe Token: SeSyncAgentPrivilege 1208 C6B6.exe Token: SeEnableDelegationPrivilege 1208 C6B6.exe Token: SeManageVolumePrivilege 1208 C6B6.exe Token: SeImpersonatePrivilege 1208 C6B6.exe Token: SeCreateGlobalPrivilege 1208 C6B6.exe Token: SeCreateTokenPrivilege 1208 C6B6.exe Token: SeAssignPrimaryTokenPrivilege 1208 C6B6.exe Token: SeLockMemoryPrivilege 1208 C6B6.exe Token: SeIncreaseQuotaPrivilege 1208 C6B6.exe Token: SeMachineAccountPrivilege 1208 C6B6.exe Token: SeTcbPrivilege 1208 C6B6.exe Token: SeSecurityPrivilege 1208 C6B6.exe Token: SeTakeOwnershipPrivilege 1208 C6B6.exe Token: SeLoadDriverPrivilege 1208 C6B6.exe Token: SeSystemProfilePrivilege 1208 C6B6.exe Token: SeSystemtimePrivilege 1208 C6B6.exe Token: SeProfSingleProcessPrivilege 1208 C6B6.exe Token: SeIncBasePriorityPrivilege 1208 C6B6.exe Token: SeCreatePagefilePrivilege 1208 C6B6.exe Token: SeCreatePermanentPrivilege 1208 C6B6.exe Token: SeBackupPrivilege 1208 C6B6.exe Token: SeRestorePrivilege 1208 C6B6.exe Token: SeShutdownPrivilege 1208 C6B6.exe Token: SeDebugPrivilege 1208 C6B6.exe Token: SeAuditPrivilege 1208 C6B6.exe Token: SeSystemEnvironmentPrivilege 1208 C6B6.exe Token: SeChangeNotifyPrivilege 1208 C6B6.exe Token: SeRemoteShutdownPrivilege 1208 C6B6.exe Token: SeUndockPrivilege 1208 C6B6.exe Token: SeSyncAgentPrivilege 1208 C6B6.exe Token: SeEnableDelegationPrivilege 1208 C6B6.exe Token: SeManageVolumePrivilege 1208 C6B6.exe Token: SeImpersonatePrivilege 1208 C6B6.exe Token: SeCreateGlobalPrivilege 1208 C6B6.exe Token: SeCreateTokenPrivilege 1208 C6B6.exe Token: SeAssignPrimaryTokenPrivilege 1208 C6B6.exe Token: SeLockMemoryPrivilege 1208 C6B6.exe Token: SeIncreaseQuotaPrivilege 1208 C6B6.exe Token: SeMachineAccountPrivilege 1208 C6B6.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 628 msiexec.exe 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 628 msiexec.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 992 wrote to memory of 380 992 7687054ef76c0842a827c7249c7c5454.exe 68 PID 992 wrote to memory of 380 992 7687054ef76c0842a827c7249c7c5454.exe 68 PID 992 wrote to memory of 380 992 7687054ef76c0842a827c7249c7c5454.exe 68 PID 992 wrote to memory of 380 992 7687054ef76c0842a827c7249c7c5454.exe 68 PID 992 wrote to memory of 380 992 7687054ef76c0842a827c7249c7c5454.exe 68 PID 992 wrote to memory of 380 992 7687054ef76c0842a827c7249c7c5454.exe 68 PID 3020 wrote to memory of 1208 3020 Process not Found 69 PID 3020 wrote to memory of 1208 3020 Process not Found 69 PID 3020 wrote to memory of 1208 3020 Process not Found 69 PID 3020 wrote to memory of 1808 3020 Process not Found 70 PID 3020 wrote to memory of 1808 3020 Process not Found 70 PID 3020 wrote to memory of 1808 3020 Process not Found 70 PID 1672 wrote to memory of 1864 1672 msiexec.exe 75 PID 1672 wrote to memory of 1864 1672 msiexec.exe 75 PID 1672 wrote to memory of 1864 1672 msiexec.exe 75 PID 3020 wrote to memory of 3164 3020 Process not Found 76 PID 3020 wrote to memory of 3164 3020 Process not Found 76 PID 3020 wrote to memory of 3164 3020 Process not Found 76 PID 1208 wrote to memory of 628 1208 C6B6.exe 78 PID 1208 wrote to memory of 628 1208 C6B6.exe 78 PID 1208 wrote to memory of 628 1208 C6B6.exe 78 PID 1672 wrote to memory of 1144 1672 msiexec.exe 79 PID 1672 wrote to memory of 1144 1672 msiexec.exe 79 PID 1672 wrote to memory of 1144 1672 msiexec.exe 79 PID 3020 wrote to memory of 732 3020 Process not Found 80 PID 3020 wrote to memory of 732 3020 Process not Found 80 PID 3020 wrote to memory of 732 3020 Process not Found 80 PID 1672 wrote to memory of 4232 1672 msiexec.exe 84 PID 1672 wrote to memory of 4232 1672 msiexec.exe 84 PID 1672 wrote to memory of 4232 1672 msiexec.exe 84 PID 1808 wrote to memory of 4304 1808 D2AD.exe 85 PID 1808 wrote to memory of 4304 1808 D2AD.exe 85 PID 1808 wrote to memory of 4304 1808 D2AD.exe 85 PID 4304 wrote to memory of 4344 4304 cmd.exe 87 PID 4304 wrote to memory of 4344 4304 cmd.exe 87 PID 4304 wrote to memory of 4344 4304 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7687054ef76c0842a827c7249c7c5454.exe"C:\Users\Admin\AppData\Local\Temp\7687054ef76c0842a827c7249c7c5454.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\7687054ef76c0842a827c7249c7c5454.exe"C:\Users\Admin\AppData\Local\Temp\7687054ef76c0842a827c7249c7c5454.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:380
-
-
C:\Users\Admin\AppData\Local\Temp\C6B6.exeC:\Users\Admin\AppData\Local\Temp\C6B6.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\C6B6.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632939643 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:628
-
-
C:\Users\Admin\AppData\Local\Temp\D2AD.exeC:\Users\Admin\AppData\Local\Temp\D2AD.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\D2AD.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:4344
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ACB4CDC304F65041CBFDCA8BA60AC1D5 C2⤵
- Loads dropped DLL
PID:1864
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 31690DCBD10723ADA13A69D51F14FD242⤵
- Loads dropped DLL
PID:1144
-
-
C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
PID:4232
-
-
C:\Users\Admin\AppData\Local\Temp\DB69.exeC:\Users\Admin\AppData\Local\Temp\DB69.exe1⤵
- Executes dropped EXE
PID:3164
-
C:\Users\Admin\AppData\Local\Temp\E6D4.exeC:\Users\Admin\AppData\Local\Temp\E6D4.exe1⤵
- Executes dropped EXE
PID:732