smokeloader | fc2e04d392ab5e508fdf6c90ce456bfd0af6def1f10a2074f82df8f58079d5e4

Analysis

max time kernel
33s
max time network
168s
platform
windows7_x64
resource
win7-en-20210920
submitted
25/10/2021, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe
Size 3.3MB
Sample211025-fre5rageel
SHA256 fc2e04d392ab5e508fdf6c90ce456bfd0af6def1f10a2074f82df8f58079d5e4
MD5 bc9bcb032e5015bf47efe154f0e6a206
SHA1 2e4cd2c7cacd2b434b2ae0f3c898d3e3e2b7e51b
SHA512 38ccc5cf8fcba21352558c1f0c1531937e32f9c68b23b15fd36431ae968b1322bfca9b0062c95fff001c4575947eb358655106e185d96903fa2d86fb47cee1d0
MD5 SHA1 SHA512

Score

10^/10

smokeloader vidar 706 937 aspackv2 backdoor evasion spyware stealer suricata themida trojan

Malware Config

Extracted

Family

vidar

Version

40.1

Botnet

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

vidar

Version

41.5

Botnet

https://mas.to/@xeroxxx

Attributes

profile_id
937

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral1/memory/1768-176-0x0000000000400000-0x0000000002D0D000-memory.dmp	family_vidar
behavioral1/memory/2124-226-0x0000000002BF0000-0x0000000002CC6000-memory.dmp	family_vidar
behavioral1/memory/2124-227-0x0000000000400000-0x0000000001091000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0006000000012296-62.dat	aspack_v212_v242
behavioral1/files/0x0006000000012296-63.dat	aspack_v212_v242
behavioral1/files/0x000700000001225b-64.dat	aspack_v212_v242
behavioral1/files/0x000700000001225b-65.dat	aspack_v212_v242
behavioral1/files/0x00050000000125b7-69.dat	aspack_v212_v242
behavioral1/files/0x00050000000125b7-68.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

pid	Process
1472	setup_install.exe
880	Tue14763da6399edb6a0.exe
1692	Tue1487f0a02d7f.exe
852	Tue14df7771140a.exe
1580	Tue1463c606efd.exe
1000	Tue14bf2991c6d3.exe
1768	Tue14d5c83cd6f6e941.exe
1372	Tue1487f0a02d7f.exe
1092	Tue1463c606efd.exe
1376	Tue1444a019a95f.exe
848	pexja_q6CON7qvTlUjQ7jHrW.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Tue1444a019a95f.exe

Loads dropped DLL 43 IoCs

pid	Process
784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe
784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe
784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe
1472	setup_install.exe
1472	setup_install.exe
1472	setup_install.exe
1472	setup_install.exe
1472	setup_install.exe
1472	setup_install.exe
1472	setup_install.exe
1472	setup_install.exe
2004	cmd.exe
2004	cmd.exe
1068	cmd.exe
1068	cmd.exe
880	Tue14763da6399edb6a0.exe
880	Tue14763da6399edb6a0.exe
1692	Tue1487f0a02d7f.exe
1692	Tue1487f0a02d7f.exe
1228	cmd.exe
1736	cmd.exe
1156	cmd.exe
1156	cmd.exe
1692	Tue1487f0a02d7f.exe
1768	Tue14d5c83cd6f6e941.exe
1768	Tue14d5c83cd6f6e941.exe
2012	cmd.exe
1376	Tue1444a019a95f.exe
1376	Tue1444a019a95f.exe
1372	Tue1487f0a02d7f.exe
1372	Tue1487f0a02d7f.exe
1464	WerFault.exe
1464	WerFault.exe
1464	WerFault.exe
1464	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1376	Tue1444a019a95f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2068-239-0x0000000000C10000-0x0000000000C11000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	ipinfo.io
48	ipinfo.io
168	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1464	1472	WerFault.exe	28
1408	1768	WerFault.exe	37

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue14763da6399edb6a0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue14763da6399edb6a0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue14763da6399edb6a0.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Tue14d5c83cd6f6e941.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue14d5c83cd6f6e941.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Tue14df7771140a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue14df7771140a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue14df7771140a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
880	Tue14763da6399edb6a0.exe
880	Tue14763da6399edb6a0.exe
1464	WerFault.exe
1464	WerFault.exe
1464	WerFault.exe
1464	WerFault.exe
1464	WerFault.exe
1464	WerFault.exe
1072	powershell.exe
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1408	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1408	WerFault.exe
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
880	Tue14763da6399edb6a0.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	Tue14bf2991c6d3.exe
Token: SeDebugPrivilege	852	Tue14df7771140a.exe
Token: SeDebugPrivilege	1464	WerFault.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	1408	WerFault.exe
Token: SeShutdownPrivilege	1268	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1472	784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe	28
PID 784 wrote to memory of 1472	784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe	28
PID 784 wrote to memory of 1472	784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe	28
PID 784 wrote to memory of 1472	784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe	28
PID 784 wrote to memory of 1472	784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe	28
PID 784 wrote to memory of 1472	784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe	28
PID 784 wrote to memory of 1472	784	FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe	28
PID 1472 wrote to memory of 1212	1472	setup_install.exe	30
PID 1472 wrote to memory of 1212	1472	setup_install.exe	30
PID 1472 wrote to memory of 1212	1472	setup_install.exe	30
PID 1472 wrote to memory of 1212	1472	setup_install.exe	30
PID 1472 wrote to memory of 1212	1472	setup_install.exe	30
PID 1472 wrote to memory of 1212	1472	setup_install.exe	30
PID 1472 wrote to memory of 1212	1472	setup_install.exe	30
PID 1472 wrote to memory of 1068	1472	setup_install.exe	46
PID 1472 wrote to memory of 1068	1472	setup_install.exe	46
PID 1472 wrote to memory of 1068	1472	setup_install.exe	46
PID 1472 wrote to memory of 1068	1472	setup_install.exe	46
PID 1472 wrote to memory of 1068	1472	setup_install.exe	46
PID 1472 wrote to memory of 1068	1472	setup_install.exe	46
PID 1472 wrote to memory of 1068	1472	setup_install.exe	46
PID 1472 wrote to memory of 2004	1472	setup_install.exe	45
PID 1472 wrote to memory of 2004	1472	setup_install.exe	45
PID 1472 wrote to memory of 2004	1472	setup_install.exe	45
PID 1472 wrote to memory of 2004	1472	setup_install.exe	45
PID 1472 wrote to memory of 2004	1472	setup_install.exe	45
PID 1472 wrote to memory of 2004	1472	setup_install.exe	45
PID 1472 wrote to memory of 2004	1472	setup_install.exe	45
PID 1472 wrote to memory of 1388	1472	setup_install.exe	44
PID 1472 wrote to memory of 1388	1472	setup_install.exe	44
PID 1472 wrote to memory of 1388	1472	setup_install.exe	44
PID 1472 wrote to memory of 1388	1472	setup_install.exe	44
PID 1472 wrote to memory of 1388	1472	setup_install.exe	44
PID 1472 wrote to memory of 1388	1472	setup_install.exe	44
PID 1472 wrote to memory of 1388	1472	setup_install.exe	44
PID 1472 wrote to memory of 1156	1472	setup_install.exe	31
PID 1472 wrote to memory of 1156	1472	setup_install.exe	31
PID 1472 wrote to memory of 1156	1472	setup_install.exe	31
PID 1472 wrote to memory of 1156	1472	setup_install.exe	31
PID 1472 wrote to memory of 1156	1472	setup_install.exe	31
PID 1472 wrote to memory of 1156	1472	setup_install.exe	31
PID 1472 wrote to memory of 1156	1472	setup_install.exe	31
PID 1472 wrote to memory of 1228	1472	setup_install.exe	42
PID 1472 wrote to memory of 1228	1472	setup_install.exe	42
PID 1472 wrote to memory of 1228	1472	setup_install.exe	42
PID 1472 wrote to memory of 1228	1472	setup_install.exe	42
PID 1472 wrote to memory of 1228	1472	setup_install.exe	42
PID 1472 wrote to memory of 1228	1472	setup_install.exe	42
PID 1472 wrote to memory of 1228	1472	setup_install.exe	42
PID 2004 wrote to memory of 880	2004	cmd.exe	41
PID 2004 wrote to memory of 880	2004	cmd.exe	41
PID 2004 wrote to memory of 880	2004	cmd.exe	41
PID 2004 wrote to memory of 880	2004	cmd.exe	41
PID 2004 wrote to memory of 880	2004	cmd.exe	41
PID 2004 wrote to memory of 880	2004	cmd.exe	41
PID 2004 wrote to memory of 880	2004	cmd.exe	41
PID 1068 wrote to memory of 1692	1068	cmd.exe	32
PID 1068 wrote to memory of 1692	1068	cmd.exe	32
PID 1068 wrote to memory of 1692	1068	cmd.exe	32
PID 1068 wrote to memory of 1692	1068	cmd.exe	32
PID 1068 wrote to memory of 1692	1068	cmd.exe	32
PID 1068 wrote to memory of 1692	1068	cmd.exe	32
PID 1068 wrote to memory of 1692	1068	cmd.exe	32
PID 1472 wrote to memory of 1736	1472	setup_install.exe	36

C:\Users\Admin\AppData\Local\Temp\FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe
"C:\Users\Admin\AppData\Local\Temp\FC2E04D392AB5E508FDF6C90CE456BFD0AF6DEF1F10A2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\7zS013C4306\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS013C4306\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:1212
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue14d5c83cd6f6e941.exe
    3⤵
    - Loads dropped DLL
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue14d5c83cd6f6e941.exe
      Tue14d5c83cd6f6e941.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      PID:1768
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 952
        5⤵
        Loads dropped DLL
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue1444a019a95f.exe
    3⤵
    - Loads dropped DLL
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue1444a019a95f.exe
      Tue1444a019a95f.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      PID:1376
    - - C:\Users\Admin\Pictures\Adobe Films\pexja_q6CON7qvTlUjQ7jHrW.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pexja_q6CON7qvTlUjQ7jHrW.exe"
        5⤵
        Executes dropped EXE
        
        PID:848
    - - C:\Users\Admin\Pictures\Adobe Films\9dlPnQ3K9KENelmqgLTr0dHk.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\9dlPnQ3K9KENelmqgLTr0dHk.exe"
        5⤵
        
        PID:2068
    - - C:\Users\Admin\Pictures\Adobe Films\REqTtXFuEzZaGosESZd_oBnD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\REqTtXFuEzZaGosESZd_oBnD.exe"
        5⤵
        
        PID:2084
      - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        6⤵
        
        PID:2512
      - C:\Program Files (x86)\Company\NewProduct\inst3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst3.exe"
        6⤵
        
        PID:2544
      - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        6⤵
        
        PID:2596
      - C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
        
        "C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
        6⤵
        
        PID:2620
    - - C:\Users\Admin\Pictures\Adobe Films\2fk4zUa79KiZHmu0ECSBhr0E.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2fk4zUa79KiZHmu0ECSBhr0E.exe"
        5⤵
        
        PID:2124
    - - C:\Users\Admin\Pictures\Adobe Films\CqxMj3JHY61n6_NVr7ajDTi5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CqxMj3JHY61n6_NVr7ajDTi5.exe"
        5⤵
        
        PID:2108
    - - C:\Users\Admin\Pictures\Adobe Films\GVaPj0NYbNZsXelpETtanKFq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\GVaPj0NYbNZsXelpETtanKFq.exe"
        5⤵
        
        PID:2100
    - - C:\Users\Admin\Pictures\Adobe Films\d3p9ePNXERvgYsLUuocBOzAd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\d3p9ePNXERvgYsLUuocBOzAd.exe"
        5⤵
        
        PID:2144
    - - C:\Users\Admin\Pictures\Adobe Films\yf50xuCdNq56fbeetAfO3HPS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\yf50xuCdNq56fbeetAfO3HPS.exe"
        5⤵
        
        PID:2176
    - - C:\Users\Admin\Pictures\Adobe Films\0aseR3GSC3_PEyi5AbbVgODd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0aseR3GSC3_PEyi5AbbVgODd.exe"
        5⤵
        
        PID:2220
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        
        PID:1668
    - - C:\Users\Admin\Pictures\Adobe Films\LfCTHFku8M58yQLIkyhrkrF5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\LfCTHFku8M58yQLIkyhrkrF5.exe"
        5⤵
        
        PID:2208
    - - C:\Users\Admin\Pictures\Adobe Films\DZGCLni_v81HXapArppmb6V6.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DZGCLni_v81HXapArppmb6V6.exe"
        5⤵
        
        PID:2188
    - - C:\Users\Admin\Pictures\Adobe Films\Y_MFMuSiGyb5w3eA7uXun23j.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Y_MFMuSiGyb5w3eA7uXun23j.exe"
        5⤵
        
        PID:2320
    - - C:\Users\Admin\Pictures\Adobe Films\gmJZypEKf8eEKkz7aYG4TQlD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\gmJZypEKf8eEKkz7aYG4TQlD.exe"
        5⤵
        
        PID:2300
    - - C:\Users\Admin\Pictures\Adobe Films\zL08r5LknlWqR7gSSgggoJuF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zL08r5LknlWqR7gSSgggoJuF.exe"
        5⤵
        
        PID:2288
    - - C:\Users\Admin\Pictures\Adobe Films\6bfO_63KQVxpG_lZccr150dN.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6bfO_63KQVxpG_lZccr150dN.exe"
        5⤵
        
        PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue14bf2991c6d3.exe
    3⤵
    - Loads dropped DLL
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue14bf2991c6d3.exe
      Tue14bf2991c6d3.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue14df7771140a.exe
    3⤵
    - Loads dropped DLL
    PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue1463c606efd.exe
    3⤵
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue1463c606efd.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue1463c606efd.exe"
      4⤵
      Executes dropped EXE
      PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue14763da6399edb6a0.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue1487f0a02d7f.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 420
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1464

C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue1487f0a02d7f.exe
Tue1487f0a02d7f.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692
- C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue1487f0a02d7f.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue1487f0a02d7f.exe" -a
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1372

C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue14df7771140a.exe
Tue14df7771140a.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue1463c606efd.exe
Tue1463c606efd.exe
1⤵
- Executes dropped EXE
PID:1580

C:\Users\Admin\AppData\Local\Temp\7zS013C4306\Tue14763da6399edb6a0.exe
Tue14763da6399edb6a0.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-54-0x0000000075871000-0x0000000075873000-memory.dmp

Download

memory/852-159-0x0000000000240000-0x000000000025C000-memory.dmp

Download

memory/852-157-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/852-163-0x000000001B1A0000-0x000000001B1A2000-memory.dmp

Download

memory/880-118-0x0000000002DB1000-0x0000000002DB9000-memory.dmp

Download

memory/880-169-0x0000000000400000-0x0000000002CB1000-memory.dmp

Download

memory/880-170-0x0000000000250000-0x0000000000259000-memory.dmp

Download

memory/1000-165-0x000000001B1E0000-0x000000001B1E2000-memory.dmp

Download

memory/1000-155-0x0000000000300000-0x0000000000301000-memory.dmp

Download

memory/1072-171-0x0000000001E21000-0x0000000001E22000-memory.dmp

Download

memory/1072-177-0x0000000001E22000-0x0000000001E24000-memory.dmp

Download

memory/1072-166-0x0000000001E20000-0x0000000001E21000-memory.dmp

Download

memory/1268-180-0x0000000002B20000-0x0000000002B36000-memory.dmp

Download

memory/1376-190-0x00000000043F0000-0x000000000453A000-memory.dmp

Download

memory/1388-167-0x0000000002140000-0x0000000002235000-memory.dmp

Download

memory/1408-189-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Download

memory/1464-179-0x0000000000430000-0x00000000004B0000-memory.dmp

Download

memory/1472-82-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1472-77-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1472-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1472-105-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1472-104-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1472-99-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1472-87-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1472-76-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1472-91-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1472-75-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1472-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1472-83-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1472-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1472-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1472-92-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1768-176-0x0000000000400000-0x0000000002D0D000-memory.dmp

Download

memory/1768-175-0x0000000003250000-0x0000000005B5D000-memory.dmp

Download

memory/1768-146-0x0000000000301000-0x0000000000365000-memory.dmp

Download

memory/2068-239-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/2124-226-0x0000000002BF0000-0x0000000002CC6000-memory.dmp

Download

memory/2124-227-0x0000000000400000-0x0000000001091000-memory.dmp

Download

memory/2124-214-0x0000000001221000-0x000000000129D000-memory.dmp

Download

memory/2144-231-0x00000000013C0000-0x00000000013C1000-memory.dmp

Download

memory/2188-221-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/2220-246-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/2220-247-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/2220-245-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/2220-244-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/2288-220-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download

memory/2288-243-0x0000000000350000-0x0000000000351000-memory.dmp

Download

memory/2300-228-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/2544-241-0x0000000000120000-0x0000000000130000-memory.dmp

Download

memory/2596-237-0x0000000000F50000-0x0000000001501000-memory.dmp

Download

memory/2596-238-0x0000000000150000-0x0000000000153000-memory.dmp

Download

memory/2620-236-0x0000000000160000-0x0000000000161000-memory.dmp

Download