0c386b61b2fd8ca2baa9da1efc2510632d7f064905ae736db8cd4d43b0684488

General

Target

SplitBot.exe
Size

4.3MB
MD5

4e2835daca8a52e01540a596b5b57763
SHA1

bf9c98fb338e332081a6324d882f4769956b3cd8
SHA256

7c3c10637adb941c20d60062422812830a040172ad939c5d8ad24f6a18f6b34d
SHA512

633bd6eb1c117c772de389be8cc86766c56577375bdf8d954a3b8a878e354cc9328b02e414bcc1443694547bae91b3003ea8b0c8274c74e6ec0b683584933c16

Score

10^/10

persistence spyware stealer suricata

Malware Config

Signatures

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	1312	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	1312	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	1312	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	1312	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	1312	schtasks.exe

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata
Executes dropped EXE 2 IoCs

Processes:

reviewrefsessionmonitorreviewruntimeDhcp.exeexplorer.exe

pid process

2760 reviewrefsessionmonitorreviewruntimeDhcp.exe
3744 explorer.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reviewrefsessionmonitorreviewruntimeDhcp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Boot\\nl-NL\\explorer.exe\""	reviewrefsessionmonitorreviewruntimeDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Public\\AccountPictures\\audiodg.exe\""	reviewrefsessionmonitorreviewruntimeDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Documents and Settings\\spoolsv.exe\""	reviewrefsessionmonitorreviewruntimeDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\odt\\explorer.exe\""	reviewrefsessionmonitorreviewruntimeDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reviewrefsessionmonitorreviewruntimeDhcp = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e040fe8a-b0f5-4c95-a2e0-21e86574db7c\\reviewrefsessionmonitorreviewruntimeDhcp.exe\""	reviewrefsessionmonitorreviewruntimeDhcp.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

SplitBot.exe

pid process

2756 SplitBot.exe
2756 SplitBot.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

472 schtasks.exe
2164 schtasks.exe
540 schtasks.exe
856 schtasks.exe
3124 schtasks.exe

pid	process
2756	SplitBot.exe
2756	SplitBot.exe

pid	process
472	schtasks.exe
2164	schtasks.exe
540	schtasks.exe
856	schtasks.exe
3124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

reviewrefsessionmonitorreviewruntimeDhcp.exeexplorer.exe

pid	process
2760	reviewrefsessionmonitorreviewruntimeDhcp.exe
2760	reviewrefsessionmonitorreviewruntimeDhcp.exe
2760	reviewrefsessionmonitorreviewruntimeDhcp.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe
3744	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

3744 explorer.exe

pid	process
3744	explorer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

reviewrefsessionmonitorreviewruntimeDhcp.exeexplorer.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2760	reviewrefsessionmonitorreviewruntimeDhcp.exe
Token: SeDebugPrivilege	3744	explorer.exe
Token: SeBackupPrivilege	396	vssvc.exe
Token: SeRestorePrivilege	396	vssvc.exe
Token: SeAuditPrivilege	396	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SplitBot.exe

pid process

2756 SplitBot.exe

pid	process
2756	SplitBot.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SplitBot.exereviewrefsessionmonitorreviewruntimeDhcp.exe

description	pid	process	target process
PID 2756 wrote to memory of 2760	2756	SplitBot.exe	reviewrefsessionmonitorreviewruntimeDhcp.exe
PID 2756 wrote to memory of 2760	2756	SplitBot.exe	reviewrefsessionmonitorreviewruntimeDhcp.exe
PID 2760 wrote to memory of 3744	2760	reviewrefsessionmonitorreviewruntimeDhcp.exe	explorer.exe
PID 2760 wrote to memory of 3744	2760	reviewrefsessionmonitorreviewruntimeDhcp.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\SplitBot.exe
"C:\Users\Admin\AppData\Local\Temp\SplitBot.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756

C:\Users\Admin\AppData\Local\Temp\reviewrefsessionmonitorreviewruntimeDhcp.exe
"C:\Users\Admin\AppData\Local\Temp\reviewrefsessionmonitorreviewruntimeDhcp.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760

C:\odt\explorer.exe
"C:\odt\explorer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewrefsessionmonitorreviewruntimeDhcp" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\e040fe8a-b0f5-4c95-a2e0-21e86574db7c\reviewrefsessionmonitorreviewruntimeDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Boot\nl-NL\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Documents and Settings\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\reviewrefsessionmonitorreviewruntimeDhcp.exe
MD5
a15410a6d2cc6b4484c870f4332658f2

SHA1
84b03444e3f5dcd6df96ac5ccf8dcbb712bd5525

SHA256
b60805e0e0dab7bc799ecc98d9280ef029fb787ffc2f754edc9640fd49187845

SHA512
824cb01c90daea7e31a9e704632cb77dccdbade2bcdf293620cf6a88d313ca504911989399507de3d93d198fce07512959d45c8998af47c5a3286f77699a6838

Download Submit
C:\Users\Admin\AppData\Local\Temp\reviewrefsessionmonitorreviewruntimeDhcp.exe
MD5
a15410a6d2cc6b4484c870f4332658f2

SHA1
84b03444e3f5dcd6df96ac5ccf8dcbb712bd5525

SHA256
b60805e0e0dab7bc799ecc98d9280ef029fb787ffc2f754edc9640fd49187845

SHA512
824cb01c90daea7e31a9e704632cb77dccdbade2bcdf293620cf6a88d313ca504911989399507de3d93d198fce07512959d45c8998af47c5a3286f77699a6838

Download Submit
C:\odt\explorer.exe
MD5
a15410a6d2cc6b4484c870f4332658f2

SHA1
84b03444e3f5dcd6df96ac5ccf8dcbb712bd5525

SHA256
b60805e0e0dab7bc799ecc98d9280ef029fb787ffc2f754edc9640fd49187845

SHA512
824cb01c90daea7e31a9e704632cb77dccdbade2bcdf293620cf6a88d313ca504911989399507de3d93d198fce07512959d45c8998af47c5a3286f77699a6838

Download Submit
C:\odt\explorer.exe
MD5
a15410a6d2cc6b4484c870f4332658f2

SHA1
84b03444e3f5dcd6df96ac5ccf8dcbb712bd5525

SHA256
b60805e0e0dab7bc799ecc98d9280ef029fb787ffc2f754edc9640fd49187845

SHA512
824cb01c90daea7e31a9e704632cb77dccdbade2bcdf293620cf6a88d313ca504911989399507de3d93d198fce07512959d45c8998af47c5a3286f77699a6838

Download Submit
memory/2756-115-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2760-116-0x0000000000000000-mapping.dmp

Download
memory/2760-119-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/2760-121-0x000000001B4B0000-0x000000001B4B2000-memory.dmp

Filesize
8KB

Download
memory/3744-134-0x0000000002ED2000-0x0000000002ED4000-memory.dmp

Filesize
8KB

Download
memory/3744-137-0x0000000002ED8000-0x0000000002EDA000-memory.dmp

Filesize
8KB

Download
memory/3744-128-0x0000000002E60000-0x0000000002E67000-memory.dmp

Filesize
28KB

Download
memory/3744-129-0x0000000002E80000-0x0000000002E88000-memory.dmp

Filesize
32KB

Download
memory/3744-130-0x0000000002F20000-0x0000000002F70000-memory.dmp

Filesize
320KB

Download
memory/3744-131-0x0000000002E70000-0x0000000002E74000-memory.dmp

Filesize
16KB

Download
memory/3744-132-0x0000000002E90000-0x0000000002E92000-memory.dmp

Filesize
8KB

Download
memory/3744-133-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/3744-122-0x0000000000000000-mapping.dmp

Download
memory/3744-135-0x0000000002ED4000-0x0000000002ED6000-memory.dmp

Filesize
8KB

Download
memory/3744-136-0x0000000002ED6000-0x0000000002ED8000-memory.dmp

Filesize
8KB

Download
memory/3744-127-0x0000000002ED0000-0x0000000002ED2000-memory.dmp

Filesize
8KB

Download
memory/3744-138-0x0000000002EDA000-0x0000000002EDF000-memory.dmp

Filesize
20KB

Download
memory/3744-139-0x000000001CC50000-0x000000001CC54000-memory.dmp

Filesize
16KB

Download
memory/3744-140-0x000000001CC54000-0x000000001CC57000-memory.dmp

Filesize
12KB

Download
memory/3744-141-0x000000001CC57000-0x000000001CC5C000-memory.dmp

Filesize
20KB

Download
memory/3744-142-0x000000001CC5C000-0x000000001CC61000-memory.dmp

Filesize
20KB

Download
memory/3744-143-0x0000000002EDD000-0x0000000002EDE000-memory.dmp

Filesize
4KB

Download
memory/3744-144-0x0000000002ED6000-0x0000000002ED7000-memory.dmp

Filesize
4KB

Download
memory/3744-145-0x000000001CC51000-0x000000001CC56000-memory.dmp

Filesize
20KB

Download
memory/3744-146-0x000000001CC5B000-0x000000001CC60000-memory.dmp

Filesize
20KB

Download
memory/3744-147-0x0000000002EDC000-0x0000000002EDE000-memory.dmp

Filesize
8KB

Download
memory/3744-148-0x000000001CC51000-0x000000001CC56000-memory.dmp

Filesize
20KB

Download
memory/3744-149-0x000000001CC5B000-0x000000001CC60000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads