Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 18:03
Static task
static1
Behavioral task
behavioral1
Sample
85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe
Resource
win7-en-20210920
gozi_rm3redlinesmokeloadertofseexmrigbackdoorbankerdiscoveryevasioninfostealerminerpersistencespywarestealersuricatatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe
-
Size
222KB
-
MD5
c30c528c3c3d33903c598ef03b799e58
-
SHA1
8551c666ae37a03fd61cded18a9d3227c745d0cd
-
SHA256
85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6
-
SHA512
70c46d9a53a895131ad3d1a35dfb682637ff75a61d909a66de7bf4abe6b7dc20aa106538b97adda89dcba977e81c3e3bdb5aa69f808f7d484f20c42f11988d18
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 1008 8B33.exe 3568 97D7.exe 3876 disksyncer.exe -
Deletes itself 1 IoCs
pid Process 3024 Process not Found -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk disksyncer.exe -
Loads dropped DLL 13 IoCs
pid Process 1008 8B33.exe 1008 8B33.exe 1212 MsiExec.exe 1212 MsiExec.exe 2360 MsiExec.exe 2360 MsiExec.exe 2360 MsiExec.exe 2360 MsiExec.exe 2360 MsiExec.exe 2360 MsiExec.exe 1008 8B33.exe 3876 disksyncer.exe 3876 disksyncer.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: 8B33.exe File opened (read-only) \??\V: 8B33.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: 8B33.exe File opened (read-only) \??\H: 8B33.exe File opened (read-only) \??\I: 8B33.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: 8B33.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: 8B33.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: 8B33.exe File opened (read-only) \??\O: 8B33.exe File opened (read-only) \??\R: 8B33.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: 8B33.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: 8B33.exe File opened (read-only) \??\J: 8B33.exe File opened (read-only) \??\L: 8B33.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: 8B33.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: 8B33.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: 8B33.exe File opened (read-only) \??\Q: 8B33.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: 8B33.exe File opened (read-only) \??\S: 8B33.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: 8B33.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4000 set thread context of 3880 4000 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe 68 -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIB70B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\1aed8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB36C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB459.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB62F.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{00CE1E75-E04C-4F83-824D-20B2297C955F} msiexec.exe File opened for modification C:\Windows\Installer\MSIBE9E.tmp msiexec.exe File opened for modification C:\Windows\Installer\1aed8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB3FA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB515.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 8B33.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 8B33.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 8B33.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 8B33.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3880 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe 3880 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3880 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 584 msiexec.exe Token: SeCreateTokenPrivilege 1008 8B33.exe Token: SeAssignPrimaryTokenPrivilege 1008 8B33.exe Token: SeLockMemoryPrivilege 1008 8B33.exe Token: SeIncreaseQuotaPrivilege 1008 8B33.exe Token: SeMachineAccountPrivilege 1008 8B33.exe Token: SeTcbPrivilege 1008 8B33.exe Token: SeSecurityPrivilege 1008 8B33.exe Token: SeTakeOwnershipPrivilege 1008 8B33.exe Token: SeLoadDriverPrivilege 1008 8B33.exe Token: SeSystemProfilePrivilege 1008 8B33.exe Token: SeSystemtimePrivilege 1008 8B33.exe Token: SeProfSingleProcessPrivilege 1008 8B33.exe Token: SeIncBasePriorityPrivilege 1008 8B33.exe Token: SeCreatePagefilePrivilege 1008 8B33.exe Token: SeCreatePermanentPrivilege 1008 8B33.exe Token: SeBackupPrivilege 1008 8B33.exe Token: SeRestorePrivilege 1008 8B33.exe Token: SeShutdownPrivilege 1008 8B33.exe Token: SeDebugPrivilege 1008 8B33.exe Token: SeAuditPrivilege 1008 8B33.exe Token: SeSystemEnvironmentPrivilege 1008 8B33.exe Token: SeChangeNotifyPrivilege 1008 8B33.exe Token: SeRemoteShutdownPrivilege 1008 8B33.exe Token: SeUndockPrivilege 1008 8B33.exe Token: SeSyncAgentPrivilege 1008 8B33.exe Token: SeEnableDelegationPrivilege 1008 8B33.exe Token: SeManageVolumePrivilege 1008 8B33.exe Token: SeImpersonatePrivilege 1008 8B33.exe Token: SeCreateGlobalPrivilege 1008 8B33.exe Token: SeCreateTokenPrivilege 1008 8B33.exe Token: SeAssignPrimaryTokenPrivilege 1008 8B33.exe Token: SeLockMemoryPrivilege 1008 8B33.exe Token: SeIncreaseQuotaPrivilege 1008 8B33.exe Token: SeMachineAccountPrivilege 1008 8B33.exe Token: SeTcbPrivilege 1008 8B33.exe Token: SeSecurityPrivilege 1008 8B33.exe Token: SeTakeOwnershipPrivilege 1008 8B33.exe Token: SeLoadDriverPrivilege 1008 8B33.exe Token: SeSystemProfilePrivilege 1008 8B33.exe Token: SeSystemtimePrivilege 1008 8B33.exe Token: SeProfSingleProcessPrivilege 1008 8B33.exe Token: SeIncBasePriorityPrivilege 1008 8B33.exe Token: SeCreatePagefilePrivilege 1008 8B33.exe Token: SeCreatePermanentPrivilege 1008 8B33.exe Token: SeBackupPrivilege 1008 8B33.exe Token: SeRestorePrivilege 1008 8B33.exe Token: SeShutdownPrivilege 1008 8B33.exe Token: SeDebugPrivilege 1008 8B33.exe Token: SeAuditPrivilege 1008 8B33.exe Token: SeSystemEnvironmentPrivilege 1008 8B33.exe Token: SeChangeNotifyPrivilege 1008 8B33.exe Token: SeRemoteShutdownPrivilege 1008 8B33.exe Token: SeUndockPrivilege 1008 8B33.exe Token: SeSyncAgentPrivilege 1008 8B33.exe Token: SeEnableDelegationPrivilege 1008 8B33.exe Token: SeManageVolumePrivilege 1008 8B33.exe Token: SeImpersonatePrivilege 1008 8B33.exe Token: SeCreateGlobalPrivilege 1008 8B33.exe Token: SeCreateTokenPrivilege 1008 8B33.exe Token: SeAssignPrimaryTokenPrivilege 1008 8B33.exe Token: SeLockMemoryPrivilege 1008 8B33.exe Token: SeIncreaseQuotaPrivilege 1008 8B33.exe Token: SeMachineAccountPrivilege 1008 8B33.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1564 msiexec.exe 1564 msiexec.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4000 wrote to memory of 3880 4000 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe 68 PID 4000 wrote to memory of 3880 4000 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe 68 PID 4000 wrote to memory of 3880 4000 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe 68 PID 4000 wrote to memory of 3880 4000 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe 68 PID 4000 wrote to memory of 3880 4000 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe 68 PID 4000 wrote to memory of 3880 4000 85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe 68 PID 3024 wrote to memory of 1008 3024 Process not Found 69 PID 3024 wrote to memory of 1008 3024 Process not Found 69 PID 3024 wrote to memory of 1008 3024 Process not Found 69 PID 3024 wrote to memory of 3568 3024 Process not Found 70 PID 3024 wrote to memory of 3568 3024 Process not Found 70 PID 3024 wrote to memory of 3568 3024 Process not Found 70 PID 584 wrote to memory of 1212 584 msiexec.exe 73 PID 584 wrote to memory of 1212 584 msiexec.exe 73 PID 584 wrote to memory of 1212 584 msiexec.exe 73 PID 1008 wrote to memory of 1564 1008 8B33.exe 74 PID 1008 wrote to memory of 1564 1008 8B33.exe 74 PID 1008 wrote to memory of 1564 1008 8B33.exe 74 PID 584 wrote to memory of 2360 584 msiexec.exe 75 PID 584 wrote to memory of 2360 584 msiexec.exe 75 PID 584 wrote to memory of 2360 584 msiexec.exe 75 PID 584 wrote to memory of 3876 584 msiexec.exe 76 PID 584 wrote to memory of 3876 584 msiexec.exe 76 PID 584 wrote to memory of 3876 584 msiexec.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe"C:\Users\Admin\AppData\Local\Temp\85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe"C:\Users\Admin\AppData\Local\Temp\85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3880
-
-
C:\Users\Admin\AppData\Local\Temp\8B33.exeC:\Users\Admin\AppData\Local\Temp\8B33.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\8B33.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632945720 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\97D7.exeC:\Users\Admin\AppData\Local\Temp\97D7.exe1⤵
- Executes dropped EXE
PID:3568
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 43F1E428162CBF2F55BF1898C36D77ED C2⤵
- Loads dropped DLL
PID:1212
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6A32FD9D8A74BFE48619BB9203EEE2002⤵
- Loads dropped DLL
PID:2360
-
-
C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
PID:3876
-