raccoon | b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5

Analysis

max time kernel
152s
max time network
163s
platform
windows10_x64
resource
win10-en-20210920
submitted
14-10-2021 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
Size

256KB
MD5

e55480871748ce9135975f7e9b89eaf5
SHA1

a3b5dd90fa3f97d39424fde5680b43569c824df8
SHA256

b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5
SHA512

9f66715282c41cf0555b531332c9997f6a1295ccfdbe6b72620bedab3652c2f0269ac8bc366da5401fc35addb02cb36bc1be25deea5c18c50b43ba8037444255

Score

10^/10

raccoon redline smokeloader tofsee fbe5e97e7d069407605ee9138022aa82166657e6 backdoor discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://honawey7.top/

http://wijibui0.top/

http://hefahei6.top/

http://pipevai4.top/

http://nalirou7.top/

rc4.i32

Extracted

Family

tofsee

quadoil.ru

lakeflex.ru

Extracted

Family

raccoon

Version

1.8.2

Botnet

fbe5e97e7d069407605ee9138022aa82166657e6

Attributes

url4cnc
http://telemirror.top/stevuitreen
http://tgmirror.top/stevuitreen
http://telegatt.top/stevuitreen
http://telegka.top/stevuitreen
http://telegin.top/stevuitreen
https://t.me/stevuitreen

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4580-162-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/4580-165-0x0000000000438F0E-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Nirsoft 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe	Nirsoft

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file
Executes dropped EXE 9 IoCs

Processes:

4821.exe537C.exe4821.exe585F.exeAdvancedRun.exeAdvancedRun.exe5FF1.exe585F.exeyinahcbq.exe

pid process

4448 4821.exe
4340 537C.exe
3152 4821.exe
3720 585F.exe
520 AdvancedRun.exe
856 AdvancedRun.exe
1200 5FF1.exe
4580 585F.exe
1824 yinahcbq.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Deletes itself 1 IoCs

Processes:

pid process

3028
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4448	4821.exe
4340	537C.exe
3152	4821.exe
3720	585F.exe
520	AdvancedRun.exe
856	AdvancedRun.exe
1200	5FF1.exe
4580	585F.exe
1824	yinahcbq.exe

pid	process
3028

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

585F.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	585F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\585F.exe = "0"	585F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	585F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	585F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	585F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	585F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	585F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	585F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	585F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	585F.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

Processes:

585F.exe

pid	process
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe
3720	585F.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe4821.exe585F.exeyinahcbq.exe

description	pid	process	target process
PID 4076 set thread context of 4180	4076	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
PID 4448 set thread context of 3152	4448	4821.exe	4821.exe
PID 3720 set thread context of 4580	3720	585F.exe	585F.exe
PID 1824 set thread context of 2472	1824	yinahcbq.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1844 3720 WerFault.exe 585F.exe

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

pid	pid_target	process	target process
1844	3720	WerFault.exe	585F.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe4821.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4821.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4821.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 24db273e88fd760424edb47d450dd49d084297dce82e72baa46d34fdc48d541d6ee07b4880cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56814da8d44713ae7af644490bdbc7b2ce8925503cff28d3c74bbc4103d36fca66814dc8545773fd4f10b4c90d8f6127db9a45a3494b48d792cd79e460935f9a56f1cedc70f3252a0f40948f490b27b24ec975805c4f28d387287cc186270a4f93824dc814d7334eda85315ccbd606dffdd285dd6a4c48d541de5ad743d73a2e6367b9ec60b440dd49d642df4bd2c79908ee16d34fdc48e980fe7ad743d05bce13c4082dd116a7fa19d642df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743d042d955d24	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe

pid	process
4180	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
4180	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3028
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe4821.exe

pid process

4180 b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
3152 4821.exe

pid	process
3028

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

585F.exeAdvancedRun.exeAdvancedRun.exepowershell.exeWerFault.exe585F.exe

description	pid	process
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeDebugPrivilege	3720	585F.exe
Token: SeDebugPrivilege	520	AdvancedRun.exe
Token: SeImpersonatePrivilege	520	AdvancedRun.exe
Token: SeDebugPrivilege	856	AdvancedRun.exe
Token: SeImpersonatePrivilege	856	AdvancedRun.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeRestorePrivilege	1844	WerFault.exe
Token: SeBackupPrivilege	1844	WerFault.exe
Token: SeBackupPrivilege	1844	WerFault.exe
Token: SeDebugPrivilege	1844	WerFault.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeDebugPrivilege	4580	585F.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe4821.exe585F.exeAdvancedRun.exe537C.exeyinahcbq.exe

description	pid	process	target process
PID 4076 wrote to memory of 4180	4076	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
PID 4076 wrote to memory of 4180	4076	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
PID 4076 wrote to memory of 4180	4076	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
PID 4076 wrote to memory of 4180	4076	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
PID 4076 wrote to memory of 4180	4076	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
PID 4076 wrote to memory of 4180	4076	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe	b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
PID 3028 wrote to memory of 4448	3028		4821.exe
PID 3028 wrote to memory of 4448	3028		4821.exe
PID 3028 wrote to memory of 4448	3028		4821.exe
PID 3028 wrote to memory of 4340	3028		537C.exe
PID 3028 wrote to memory of 4340	3028		537C.exe
PID 3028 wrote to memory of 4340	3028		537C.exe
PID 4448 wrote to memory of 3152	4448	4821.exe	4821.exe
PID 4448 wrote to memory of 3152	4448	4821.exe	4821.exe
PID 4448 wrote to memory of 3152	4448	4821.exe	4821.exe
PID 4448 wrote to memory of 3152	4448	4821.exe	4821.exe
PID 4448 wrote to memory of 3152	4448	4821.exe	4821.exe
PID 4448 wrote to memory of 3152	4448	4821.exe	4821.exe
PID 3028 wrote to memory of 3720	3028		585F.exe
PID 3028 wrote to memory of 3720	3028		585F.exe
PID 3028 wrote to memory of 3720	3028		585F.exe
PID 3720 wrote to memory of 520	3720	585F.exe	AdvancedRun.exe
PID 3720 wrote to memory of 520	3720	585F.exe	AdvancedRun.exe
PID 3720 wrote to memory of 520	3720	585F.exe	AdvancedRun.exe
PID 520 wrote to memory of 856	520	AdvancedRun.exe	AdvancedRun.exe
PID 520 wrote to memory of 856	520	AdvancedRun.exe	AdvancedRun.exe
PID 520 wrote to memory of 856	520	AdvancedRun.exe	AdvancedRun.exe
PID 3028 wrote to memory of 1200	3028		5FF1.exe
PID 3028 wrote to memory of 1200	3028		5FF1.exe
PID 3028 wrote to memory of 1200	3028		5FF1.exe
PID 4340 wrote to memory of 1432	4340	537C.exe	cmd.exe
PID 4340 wrote to memory of 1432	4340	537C.exe	cmd.exe
PID 4340 wrote to memory of 1432	4340	537C.exe	cmd.exe
PID 4340 wrote to memory of 1668	4340	537C.exe	cmd.exe
PID 4340 wrote to memory of 1668	4340	537C.exe	cmd.exe
PID 4340 wrote to memory of 1668	4340	537C.exe	cmd.exe
PID 4340 wrote to memory of 2204	4340	537C.exe	sc.exe
PID 4340 wrote to memory of 2204	4340	537C.exe	sc.exe
PID 4340 wrote to memory of 2204	4340	537C.exe	sc.exe
PID 4340 wrote to memory of 2736	4340	537C.exe	sc.exe
PID 4340 wrote to memory of 2736	4340	537C.exe	sc.exe
PID 4340 wrote to memory of 2736	4340	537C.exe	sc.exe
PID 3720 wrote to memory of 4132	3720	585F.exe	powershell.exe
PID 3720 wrote to memory of 4132	3720	585F.exe	powershell.exe
PID 3720 wrote to memory of 4132	3720	585F.exe	powershell.exe
PID 3720 wrote to memory of 4580	3720	585F.exe	585F.exe
PID 3720 wrote to memory of 4580	3720	585F.exe	585F.exe
PID 3720 wrote to memory of 4580	3720	585F.exe	585F.exe
PID 3720 wrote to memory of 4580	3720	585F.exe	585F.exe
PID 3720 wrote to memory of 4580	3720	585F.exe	585F.exe
PID 3720 wrote to memory of 4580	3720	585F.exe	585F.exe
PID 3720 wrote to memory of 4580	3720	585F.exe	585F.exe
PID 3720 wrote to memory of 4580	3720	585F.exe	585F.exe
PID 4340 wrote to memory of 4720	4340	537C.exe	sc.exe
PID 4340 wrote to memory of 4720	4340	537C.exe	sc.exe
PID 4340 wrote to memory of 4720	4340	537C.exe	sc.exe
PID 4340 wrote to memory of 4600	4340	537C.exe	netsh.exe
PID 4340 wrote to memory of 4600	4340	537C.exe	netsh.exe
PID 4340 wrote to memory of 4600	4340	537C.exe	netsh.exe
PID 1824 wrote to memory of 2472	1824	yinahcbq.exe	svchost.exe
PID 1824 wrote to memory of 2472	1824	yinahcbq.exe	svchost.exe
PID 1824 wrote to memory of 2472	1824	yinahcbq.exe	svchost.exe
PID 1824 wrote to memory of 2472	1824	yinahcbq.exe	svchost.exe
PID 1824 wrote to memory of 2472	1824	yinahcbq.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
"C:\Users\Admin\AppData\Local\Temp\b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4076

C:\Users\Admin\AppData\Local\Temp\b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe
"C:\Users\Admin\AppData\Local\Temp\b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4180

C:\Users\Admin\AppData\Local\Temp\4821.exe
C:\Users\Admin\AppData\Local\Temp\4821.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4448

C:\Users\Admin\AppData\Local\Temp\4821.exe
C:\Users\Admin\AppData\Local\Temp\4821.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3152

C:\Users\Admin\AppData\Local\Temp\537C.exe
C:\Users\Admin\AppData\Local\Temp\537C.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wydozddr\
2⤵
PID:1432

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yinahcbq.exe" C:\Windows\SysWOW64\wydozddr\
2⤵
PID:1668

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create wydozddr binPath= "C:\Windows\SysWOW64\wydozddr\yinahcbq.exe /d\"C:\Users\Admin\AppData\Local\Temp\537C.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:2204

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description wydozddr "wifi internet conection"
2⤵
PID:2736

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start wydozddr
2⤵
PID:4720

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:4600

C:\Users\Admin\AppData\Local\Temp\585F.exe
C:\Users\Admin\AppData\Local\Temp\585F.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720

C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520

C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe" /SpecialRun 4101d8 520
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\585F.exe" -Force
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Users\Admin\AppData\Local\Temp\585F.exe
"C:\Users\Admin\AppData\Local\Temp\585F.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 2248
2⤵
- Drops file in Windows directory
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Users\Admin\AppData\Local\Temp\5FF1.exe
C:\Users\Admin\AppData\Local\Temp\5FF1.exe
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\SysWOW64\wydozddr\yinahcbq.exe
C:\Windows\SysWOW64\wydozddr\yinahcbq.exe /d"C:\Users\Admin\AppData\Local\Temp\537C.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4821.exe
MD5
e55480871748ce9135975f7e9b89eaf5

SHA1
a3b5dd90fa3f97d39424fde5680b43569c824df8

SHA256
b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5

SHA512
9f66715282c41cf0555b531332c9997f6a1295ccfdbe6b72620bedab3652c2f0269ac8bc366da5401fc35addb02cb36bc1be25deea5c18c50b43ba8037444255

Download Submit
C:\Users\Admin\AppData\Local\Temp\4821.exe
MD5
e55480871748ce9135975f7e9b89eaf5

SHA1
a3b5dd90fa3f97d39424fde5680b43569c824df8

SHA256
b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5

SHA512
9f66715282c41cf0555b531332c9997f6a1295ccfdbe6b72620bedab3652c2f0269ac8bc366da5401fc35addb02cb36bc1be25deea5c18c50b43ba8037444255

Download Submit
C:\Users\Admin\AppData\Local\Temp\4821.exe
MD5
e55480871748ce9135975f7e9b89eaf5

SHA1
a3b5dd90fa3f97d39424fde5680b43569c824df8

SHA256
b91e19b349426d0bd81de1299ac9e639e8d1d675adc52c2619325bfb4a2836e5

SHA512
9f66715282c41cf0555b531332c9997f6a1295ccfdbe6b72620bedab3652c2f0269ac8bc366da5401fc35addb02cb36bc1be25deea5c18c50b43ba8037444255

Download Submit
C:\Users\Admin\AppData\Local\Temp\537C.exe
MD5
e67d8910ece6112354ba89ecab14c77d

SHA1
38bb3e56f6113abdca8eef13a14d751e43a313cb

SHA256
851f78fbd7eb6d3b6a6117bb45a5e5549cd0949a51271cf1fb951d6c155a340a

SHA512
9957e9a7d86dfd17bcf77c5108b162ba9743ffe228595f7f623c90f9c8ff903df85115a6c9216c2b578d26fa930fc0682dd49a114e1368eb9d464c3a1a51700d

Download Submit
C:\Users\Admin\AppData\Local\Temp\537C.exe
MD5
e67d8910ece6112354ba89ecab14c77d

SHA1
38bb3e56f6113abdca8eef13a14d751e43a313cb

SHA256
851f78fbd7eb6d3b6a6117bb45a5e5549cd0949a51271cf1fb951d6c155a340a

SHA512
9957e9a7d86dfd17bcf77c5108b162ba9743ffe228595f7f623c90f9c8ff903df85115a6c9216c2b578d26fa930fc0682dd49a114e1368eb9d464c3a1a51700d

Download Submit
C:\Users\Admin\AppData\Local\Temp\585F.exe
MD5
c7e76d26f5a8e5bf57ebe9de6cc6bc13

SHA1
545718169d24dd7f1a188e6ceb5097246837b5a0

SHA256
83e479b43300d0d042158032a321a8e9853af0436aa691ee9b8dd8b02fe4f13c

SHA512
60ec1655ec50b5426111cec13c438c59afcc998c7bc18c56b83c158a705a05d8b66f746b99fa8c3db6786af7d4624a1529f32f4c5c04917dab680bff06d42bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\585F.exe
MD5
c7e76d26f5a8e5bf57ebe9de6cc6bc13

SHA1
545718169d24dd7f1a188e6ceb5097246837b5a0

SHA256
83e479b43300d0d042158032a321a8e9853af0436aa691ee9b8dd8b02fe4f13c

SHA512
60ec1655ec50b5426111cec13c438c59afcc998c7bc18c56b83c158a705a05d8b66f746b99fa8c3db6786af7d4624a1529f32f4c5c04917dab680bff06d42bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\585F.exe
MD5
c7e76d26f5a8e5bf57ebe9de6cc6bc13

SHA1
545718169d24dd7f1a188e6ceb5097246837b5a0

SHA256
83e479b43300d0d042158032a321a8e9853af0436aa691ee9b8dd8b02fe4f13c

SHA512
60ec1655ec50b5426111cec13c438c59afcc998c7bc18c56b83c158a705a05d8b66f746b99fa8c3db6786af7d4624a1529f32f4c5c04917dab680bff06d42bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\5FF1.exe
MD5
4ddce1574ea6e7b9d9d70f9c6f23a1c9

SHA1
89a9b86f4ffb646bf9856584292a42c5db14da26

SHA256
cb3be2979c500241fb4fae88ac0773a56745aa2807ba5c2970370b09d32231f3

SHA512
7a5beeac769961e393349ab2330f467edbacebf7b713883539eaf76792cdb978724d763ad1c3d54b4f79da32276ab466f2f844790020ecaf546e0fffaeb1f64d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5FF1.exe
MD5
4ddce1574ea6e7b9d9d70f9c6f23a1c9

SHA1
89a9b86f4ffb646bf9856584292a42c5db14da26

SHA256
cb3be2979c500241fb4fae88ac0773a56745aa2807ba5c2970370b09d32231f3

SHA512
7a5beeac769961e393349ab2330f467edbacebf7b713883539eaf76792cdb978724d763ad1c3d54b4f79da32276ab466f2f844790020ecaf546e0fffaeb1f64d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a40ba16-65c8-4960-9a86-80edc401f343\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\yinahcbq.exe
MD5
2f78691447961c59d3d3e89ce1ab8e7d

SHA1
59e991db56baf5fb87f97627052e8a20cb5075ae

SHA256
d08eeb19e32105c3f63f150cbb671b9155af4eb4b9bd9267b79ab510e6db6304

SHA512
cc55b82525b245def6d8cdfe00c50f8306aa194d7e18c2bd85523e7b0c7c6813ed7187e30d71bf103da23bff06cb8fa31b13a56dc5bbfb8a6bfa794c96903928

Download Submit
C:\Windows\SysWOW64\wydozddr\yinahcbq.exe
MD5
2f78691447961c59d3d3e89ce1ab8e7d

SHA1
59e991db56baf5fb87f97627052e8a20cb5075ae

SHA256
d08eeb19e32105c3f63f150cbb671b9155af4eb4b9bd9267b79ab510e6db6304

SHA512
cc55b82525b245def6d8cdfe00c50f8306aa194d7e18c2bd85523e7b0c7c6813ed7187e30d71bf103da23bff06cb8fa31b13a56dc5bbfb8a6bfa794c96903928

Download Submit
memory/520-141-0x0000000000000000-mapping.dmp

Download
memory/856-144-0x0000000000000000-mapping.dmp

Download
memory/1200-146-0x0000000000000000-mapping.dmp

Download
memory/1200-155-0x00000000033B0000-0x000000000343E000-memory.dmp

Filesize
568KB

Download
memory/1200-164-0x0000000000400000-0x00000000016FF000-memory.dmp

Filesize
19.0MB

Download
memory/1200-149-0x0000000001926000-0x0000000001975000-memory.dmp

Filesize
316KB

Download
memory/1432-150-0x0000000000000000-mapping.dmp

Download
memory/1668-151-0x0000000000000000-mapping.dmp

Download
memory/1824-189-0x0000000000793000-0x00000000007A1000-memory.dmp

Filesize
56KB

Download
memory/1824-289-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2204-156-0x0000000000000000-mapping.dmp

Download
memory/2472-290-0x0000000000EA0000-0x0000000000EB5000-memory.dmp

Filesize
84KB

Download
memory/2472-279-0x0000000000EA9A6B-mapping.dmp

Download
memory/2736-157-0x0000000000000000-mapping.dmp

Download
memory/3028-119-0x0000000000860000-0x0000000000876000-memory.dmp

Filesize
88KB

Download
memory/3028-167-0x00000000028C0000-0x00000000028D6000-memory.dmp

Filesize
88KB

Download
memory/3152-129-0x0000000000402E86-mapping.dmp

Download
memory/3720-138-0x0000000004470000-0x000000000450E000-memory.dmp

Filesize
632KB

Download
memory/3720-135-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3720-140-0x00000000078C0000-0x00000000078C1000-memory.dmp

Filesize
4KB

Download
memory/3720-139-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/3720-137-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/3720-132-0x0000000000000000-mapping.dmp

Download
memory/4076-116-0x0000000000620000-0x0000000000629000-memory.dmp

Filesize
36KB

Download
memory/4076-115-0x0000000000759000-0x0000000000762000-memory.dmp

Filesize
36KB

Download
memory/4132-168-0x00000000042E0000-0x00000000042E1000-memory.dmp

Filesize
4KB

Download
memory/4132-210-0x000000007EC70000-0x000000007EC71000-memory.dmp

Filesize
4KB

Download
memory/4132-161-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/4132-187-0x0000000007D90000-0x0000000007D91000-memory.dmp

Filesize
4KB

Download
memory/4132-212-0x00000000042E3000-0x00000000042E4000-memory.dmp

Filesize
4KB

Download
memory/4132-159-0x0000000004120000-0x0000000004121000-memory.dmp

Filesize
4KB

Download
memory/4132-158-0x0000000000000000-mapping.dmp

Download
memory/4132-184-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/4132-169-0x00000000042E2000-0x00000000042E3000-memory.dmp

Filesize
4KB

Download
memory/4132-211-0x00000000090D0000-0x00000000090D1000-memory.dmp

Filesize
4KB

Download
memory/4132-163-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Filesize
4KB

Download
memory/4132-160-0x0000000004120000-0x0000000004121000-memory.dmp

Filesize
4KB

Download
memory/4132-209-0x0000000008F00000-0x0000000008F01000-memory.dmp

Filesize
4KB

Download
memory/4132-204-0x0000000008B70000-0x0000000008B71000-memory.dmp

Filesize
4KB

Download
memory/4132-197-0x0000000008DD0000-0x0000000008E03000-memory.dmp

Filesize
204KB

Download
memory/4132-176-0x00000000074E0000-0x00000000074E1000-memory.dmp

Filesize
4KB

Download
memory/4132-177-0x0000000007400000-0x0000000007401000-memory.dmp

Filesize
4KB

Download
memory/4132-190-0x0000000004120000-0x0000000004121000-memory.dmp

Filesize
4KB

Download
memory/4132-179-0x0000000007510000-0x0000000007511000-memory.dmp

Filesize
4KB

Download
memory/4132-181-0x00000000076F0000-0x00000000076F1000-memory.dmp

Filesize
4KB

Download
memory/4180-117-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4180-118-0x0000000000402E86-mapping.dmp

Download
memory/4340-124-0x0000000000000000-mapping.dmp

Download
memory/4340-153-0x0000000000610000-0x0000000000623000-memory.dmp

Filesize
76KB

Download
memory/4340-154-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4448-120-0x0000000000000000-mapping.dmp

Download
memory/4448-131-0x00000000004C0000-0x000000000056E000-memory.dmp

Filesize
696KB

Download
memory/4580-175-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/4580-178-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/4580-174-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/4580-172-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/4580-180-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/4580-165-0x0000000000438F0E-mapping.dmp

Download
memory/4580-162-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4580-182-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/4580-186-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/4600-183-0x0000000000000000-mapping.dmp

Download
memory/4720-173-0x0000000000000000-mapping.dmp

Download