Analysis
-
max time kernel
163s -
max time network
217s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
04-11-2021 20:57
Static task
static1
Behavioral task
behavioral1
Sample
Thu181d864eb8.exe
Resource
win7-en-20211014
General
-
Target
Thu181d864eb8.exe
-
Size
172KB
-
MD5
7c3cf9ce3ffb1e5dd48896fdc9080bab
-
SHA1
34b4976f8f83c1e0a9d277d2a103a61616178728
-
SHA256
b3049882301853eed2aa8c5ac99010dd84292d7e092eb6f4311fa535716f5d83
-
SHA512
52ec2ec50a2d4ca4f29e6b611176e37fee8693a7c34ec2197ec2ad250d525f607c3d4d70534520d1f5c16fd3f9231d261b00f8c3746d033eab1ed36cdde07473
Malware Config
Extracted
vidar
47.9
937
https://mas.to/@kirpich
-
profile_id
937
Extracted
raccoon
8dec62c1db2959619dca43e02fa46ad7bd606400
-
url4cnc
http://telegin.top/capibar
http://ttmirror.top/capibar
http://teletele.top/capibar
http://telegalive.top/capibar
http://toptelete.top/capibar
http://telegraf.top/capibar
https://t.me/capibar
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process target process PID 1972 created 1336 1972 WerFault.exe 575sT1VTQzjUttLbWB0ZHLt2.exe PID 1112 created 1228 1112 WerFault.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe -
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2188-137-0x00000000021C0000-0x0000000002296000-memory.dmp family_vidar behavioral2/memory/2188-141-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
Processes:
a5eFlqaGqHWMkpG9puFbdHVG.exe575sT1VTQzjUttLbWB0ZHLt2.exej1mXxrhD1y4y7jsNw6MzO1eh.exeFBJQHBPekiHNvEoSuwgJ0w_e.exeEwHd5eKx9glXvopxUrPHkQgV.exez2azK7ZBQVJaEfy_KbPMuSed.exej1mXxrhD1y4y7jsNw6MzO1eh.exepid process 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1336 575sT1VTQzjUttLbWB0ZHLt2.exe 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe 2188 FBJQHBPekiHNvEoSuwgJ0w_e.exe 1584 EwHd5eKx9glXvopxUrPHkQgV.exe 3972 z2azK7ZBQVJaEfy_KbPMuSed.exe 1228 j1mXxrhD1y4y7jsNw6MzO1eh.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
EwHd5eKx9glXvopxUrPHkQgV.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion EwHd5eKx9glXvopxUrPHkQgV.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion EwHd5eKx9glXvopxUrPHkQgV.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Thu181d864eb8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International\Geo\Nation Thu181d864eb8.exe -
Loads dropped DLL 2 IoCs
Processes:
FBJQHBPekiHNvEoSuwgJ0w_e.exepid process 2188 FBJQHBPekiHNvEoSuwgJ0w_e.exe 2188 FBJQHBPekiHNvEoSuwgJ0w_e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Pictures\Adobe Films\EwHd5eKx9glXvopxUrPHkQgV.exe themida behavioral2/memory/1584-146-0x0000000001260000-0x0000000001261000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
EwHd5eKx9glXvopxUrPHkQgV.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA EwHd5eKx9glXvopxUrPHkQgV.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 23 ipinfo.io 64 ipinfo.io 65 ipinfo.io 22 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
EwHd5eKx9glXvopxUrPHkQgV.exepid process 1584 EwHd5eKx9glXvopxUrPHkQgV.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
j1mXxrhD1y4y7jsNw6MzO1eh.exedescription pid process target process PID 2636 set thread context of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe -
Drops file in Program Files directory 2 IoCs
Processes:
z2azK7ZBQVJaEfy_KbPMuSed.exedescription ioc process File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe z2azK7ZBQVJaEfy_KbPMuSed.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe z2azK7ZBQVJaEfy_KbPMuSed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1272 1336 WerFault.exe 575sT1VTQzjUttLbWB0ZHLt2.exe 3012 1336 WerFault.exe 575sT1VTQzjUttLbWB0ZHLt2.exe 1656 1336 WerFault.exe 575sT1VTQzjUttLbWB0ZHLt2.exe 1796 1336 WerFault.exe 575sT1VTQzjUttLbWB0ZHLt2.exe 1972 1336 WerFault.exe 575sT1VTQzjUttLbWB0ZHLt2.exe 1112 1228 WerFault.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
FBJQHBPekiHNvEoSuwgJ0w_e.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FBJQHBPekiHNvEoSuwgJ0w_e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FBJQHBPekiHNvEoSuwgJ0w_e.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3484 schtasks.exe 3192 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3876 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1288 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Thu181d864eb8.exea5eFlqaGqHWMkpG9puFbdHVG.exepid process 2584 Thu181d864eb8.exe 2584 Thu181d864eb8.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe 1212 a5eFlqaGqHWMkpG9puFbdHVG.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exetaskkill.exeEwHd5eKx9glXvopxUrPHkQgV.exeWerFault.exedescription pid process Token: SeRestorePrivilege 1272 WerFault.exe Token: SeBackupPrivilege 1272 WerFault.exe Token: SeDebugPrivilege 1272 WerFault.exe Token: SeDebugPrivilege 3012 WerFault.exe Token: SeDebugPrivilege 1656 WerFault.exe Token: SeDebugPrivilege 1796 WerFault.exe Token: SeDebugPrivilege 1972 WerFault.exe Token: SeDebugPrivilege 1288 taskkill.exe Token: SeDebugPrivilege 1584 EwHd5eKx9glXvopxUrPHkQgV.exe Token: SeDebugPrivilege 1112 WerFault.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
Thu181d864eb8.exez2azK7ZBQVJaEfy_KbPMuSed.exej1mXxrhD1y4y7jsNw6MzO1eh.exeFBJQHBPekiHNvEoSuwgJ0w_e.execmd.exedescription pid process target process PID 2584 wrote to memory of 1212 2584 Thu181d864eb8.exe a5eFlqaGqHWMkpG9puFbdHVG.exe PID 2584 wrote to memory of 1212 2584 Thu181d864eb8.exe a5eFlqaGqHWMkpG9puFbdHVG.exe PID 2584 wrote to memory of 1336 2584 Thu181d864eb8.exe 575sT1VTQzjUttLbWB0ZHLt2.exe PID 2584 wrote to memory of 1336 2584 Thu181d864eb8.exe 575sT1VTQzjUttLbWB0ZHLt2.exe PID 2584 wrote to memory of 1336 2584 Thu181d864eb8.exe 575sT1VTQzjUttLbWB0ZHLt2.exe PID 2584 wrote to memory of 2188 2584 Thu181d864eb8.exe FBJQHBPekiHNvEoSuwgJ0w_e.exe PID 2584 wrote to memory of 2188 2584 Thu181d864eb8.exe FBJQHBPekiHNvEoSuwgJ0w_e.exe PID 2584 wrote to memory of 2188 2584 Thu181d864eb8.exe FBJQHBPekiHNvEoSuwgJ0w_e.exe PID 2584 wrote to memory of 2636 2584 Thu181d864eb8.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2584 wrote to memory of 2636 2584 Thu181d864eb8.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2584 wrote to memory of 2636 2584 Thu181d864eb8.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2584 wrote to memory of 1584 2584 Thu181d864eb8.exe EwHd5eKx9glXvopxUrPHkQgV.exe PID 2584 wrote to memory of 1584 2584 Thu181d864eb8.exe EwHd5eKx9glXvopxUrPHkQgV.exe PID 2584 wrote to memory of 1584 2584 Thu181d864eb8.exe EwHd5eKx9glXvopxUrPHkQgV.exe PID 2584 wrote to memory of 3972 2584 Thu181d864eb8.exe z2azK7ZBQVJaEfy_KbPMuSed.exe PID 2584 wrote to memory of 3972 2584 Thu181d864eb8.exe z2azK7ZBQVJaEfy_KbPMuSed.exe PID 2584 wrote to memory of 3972 2584 Thu181d864eb8.exe z2azK7ZBQVJaEfy_KbPMuSed.exe PID 3972 wrote to memory of 3484 3972 z2azK7ZBQVJaEfy_KbPMuSed.exe schtasks.exe PID 3972 wrote to memory of 3484 3972 z2azK7ZBQVJaEfy_KbPMuSed.exe schtasks.exe PID 3972 wrote to memory of 3484 3972 z2azK7ZBQVJaEfy_KbPMuSed.exe schtasks.exe PID 3972 wrote to memory of 3192 3972 z2azK7ZBQVJaEfy_KbPMuSed.exe schtasks.exe PID 3972 wrote to memory of 3192 3972 z2azK7ZBQVJaEfy_KbPMuSed.exe schtasks.exe PID 3972 wrote to memory of 3192 3972 z2azK7ZBQVJaEfy_KbPMuSed.exe schtasks.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2636 wrote to memory of 1228 2636 j1mXxrhD1y4y7jsNw6MzO1eh.exe j1mXxrhD1y4y7jsNw6MzO1eh.exe PID 2188 wrote to memory of 772 2188 FBJQHBPekiHNvEoSuwgJ0w_e.exe cmd.exe PID 2188 wrote to memory of 772 2188 FBJQHBPekiHNvEoSuwgJ0w_e.exe cmd.exe PID 2188 wrote to memory of 772 2188 FBJQHBPekiHNvEoSuwgJ0w_e.exe cmd.exe PID 772 wrote to memory of 1288 772 cmd.exe taskkill.exe PID 772 wrote to memory of 1288 772 cmd.exe taskkill.exe PID 772 wrote to memory of 1288 772 cmd.exe taskkill.exe PID 772 wrote to memory of 3876 772 cmd.exe timeout.exe PID 772 wrote to memory of 3876 772 cmd.exe timeout.exe PID 772 wrote to memory of 3876 772 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Thu181d864eb8.exe"C:\Users\Admin\AppData\Local\Temp\Thu181d864eb8.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\a5eFlqaGqHWMkpG9puFbdHVG.exe"C:\Users\Admin\Pictures\Adobe Films\a5eFlqaGqHWMkpG9puFbdHVG.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe"C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe"C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 9444⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exe"C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im FBJQHBPekiHNvEoSuwgJ0w_e.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exe" & del C:\ProgramData\*.dll & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im FBJQHBPekiHNvEoSuwgJ0w_e.exe /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\575sT1VTQzjUttLbWB0ZHLt2.exe"C:\Users\Admin\Pictures\Adobe Films\575sT1VTQzjUttLbWB0ZHLt2.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 6643⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 6843⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 7363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 7363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 6403⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\EwHd5eKx9glXvopxUrPHkQgV.exe"C:\Users\Admin\Pictures\Adobe Films\EwHd5eKx9glXvopxUrPHkQgV.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\z2azK7ZBQVJaEfy_KbPMuSed.exe"C:\Users\Admin\Pictures\Adobe Films\z2azK7ZBQVJaEfy_KbPMuSed.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\freebl3.dllMD5
ef2834ac4ee7d6724f255beaf527e635
SHA15be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
SHA512c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2
-
C:\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\msvcp140.dllMD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\ProgramData\softokn3.dllMD5
a2ee53de9167bf0d6c019303b7ca84e5
SHA12a3c737fa1157e8483815e98b666408a18c0db42
SHA25643536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
SHA51245b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8
-
C:\ProgramData\vcruntime140.dllMD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
C:\Users\Admin\Pictures\Adobe Films\575sT1VTQzjUttLbWB0ZHLt2.exeMD5
49252ec4ef4b0dbf252e84686ca1f134
SHA126428e6dac64addc42848042f6bb600d98d821e9
SHA256e5e540171fdb508b9c6a3ab4fa62fa5b8c2645fadd036b7c8d9932e990575092
SHA512ba9fe920b2196f9958e0d5204812a5180dca70d6ecfb19a24efd69e56e67db7635feb49280a8b2726168a5d7daef448b5ab1e4b9197f2f773ef39085f3f77aae
-
C:\Users\Admin\Pictures\Adobe Films\575sT1VTQzjUttLbWB0ZHLt2.exeMD5
49252ec4ef4b0dbf252e84686ca1f134
SHA126428e6dac64addc42848042f6bb600d98d821e9
SHA256e5e540171fdb508b9c6a3ab4fa62fa5b8c2645fadd036b7c8d9932e990575092
SHA512ba9fe920b2196f9958e0d5204812a5180dca70d6ecfb19a24efd69e56e67db7635feb49280a8b2726168a5d7daef448b5ab1e4b9197f2f773ef39085f3f77aae
-
C:\Users\Admin\Pictures\Adobe Films\EwHd5eKx9glXvopxUrPHkQgV.exeMD5
c0f94c48ed4cde88182bf8d23c593681
SHA1109221d280ed1eacca64491b846d49dc7f00a085
SHA2563cb29ddb05b9144c3e4f78cc10de67c76c8d51c11bdc0e9642ee8b80555c87fb
SHA512573bb151bc32bdba0761c8630480e9e0535c915688e94a8745de0787ec939259689feea68c34d8bb9d77939cb17a5ebc677cb261b87fae949ee2a055e58baacf
-
C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exeMD5
21bb6f6da4d85a40fea01d98c2132b50
SHA1eebad8256656b3113eba7321bcce467a61a98322
SHA2564401cc5459665a04cab4be3e7930ab187e86908b056ad321e19b3b0e8fc255ac
SHA5123b1b4c91181d5b286e795afc5ef3549f1473595aa5a69cb51d6d9b31dcda284003d682f1bf3f24d663f4b552ac991996169107c9ac1707901c0fe0ba57f61d9f
-
C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exeMD5
21bb6f6da4d85a40fea01d98c2132b50
SHA1eebad8256656b3113eba7321bcce467a61a98322
SHA2564401cc5459665a04cab4be3e7930ab187e86908b056ad321e19b3b0e8fc255ac
SHA5123b1b4c91181d5b286e795afc5ef3549f1473595aa5a69cb51d6d9b31dcda284003d682f1bf3f24d663f4b552ac991996169107c9ac1707901c0fe0ba57f61d9f
-
C:\Users\Admin\Pictures\Adobe Films\a5eFlqaGqHWMkpG9puFbdHVG.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\a5eFlqaGqHWMkpG9puFbdHVG.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exeMD5
639b8ee565307d8541ee1d9c86cf84d3
SHA1e73072a3b128e34805e7565d1cc90df085e89cdc
SHA256a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9
SHA512f5689df5b7515b8b038b1a081efec473f1c788f0aa41e548ba663a7a0b411d8ffc485879967cf61989764b161eea260b8b2e25cd0fde4af39f583b784050a768
-
C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exeMD5
639b8ee565307d8541ee1d9c86cf84d3
SHA1e73072a3b128e34805e7565d1cc90df085e89cdc
SHA256a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9
SHA512f5689df5b7515b8b038b1a081efec473f1c788f0aa41e548ba663a7a0b411d8ffc485879967cf61989764b161eea260b8b2e25cd0fde4af39f583b784050a768
-
C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exeMD5
639b8ee565307d8541ee1d9c86cf84d3
SHA1e73072a3b128e34805e7565d1cc90df085e89cdc
SHA256a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9
SHA512f5689df5b7515b8b038b1a081efec473f1c788f0aa41e548ba663a7a0b411d8ffc485879967cf61989764b161eea260b8b2e25cd0fde4af39f583b784050a768
-
C:\Users\Admin\Pictures\Adobe Films\z2azK7ZBQVJaEfy_KbPMuSed.exeMD5
19b0bf2bb132231de9dd08f8761c5998
SHA1a08a73f6fa211061d6defc14bc8fec6ada2166c4
SHA256ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
SHA5125bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1
-
C:\Users\Admin\Pictures\Adobe Films\z2azK7ZBQVJaEfy_KbPMuSed.exeMD5
19b0bf2bb132231de9dd08f8761c5998
SHA1a08a73f6fa211061d6defc14bc8fec6ada2166c4
SHA256ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
SHA5125bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1
-
\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
memory/772-176-0x0000000000000000-mapping.dmp
-
memory/1212-119-0x0000000000000000-mapping.dmp
-
memory/1228-175-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1228-174-0x00000000006D0000-0x000000000075E000-memory.dmpFilesize
568KB
-
memory/1228-173-0x0000000000680000-0x00000000006CE000-memory.dmpFilesize
312KB
-
memory/1228-172-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1228-164-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1228-160-0x0000000000402998-mapping.dmp
-
memory/1228-159-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1288-177-0x0000000000000000-mapping.dmp
-
memory/1336-122-0x0000000000000000-mapping.dmp
-
memory/1336-158-0x0000000000400000-0x0000000000903000-memory.dmpFilesize
5.0MB
-
memory/1336-157-0x0000000002510000-0x0000000002554000-memory.dmpFilesize
272KB
-
memory/1584-155-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/1584-171-0x0000000006460000-0x0000000006461000-memory.dmpFilesize
4KB
-
memory/1584-131-0x0000000000000000-mapping.dmp
-
memory/1584-152-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/1584-180-0x0000000007630000-0x0000000007631000-memory.dmpFilesize
4KB
-
memory/1584-151-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/1584-179-0x0000000006F30000-0x0000000006F31000-memory.dmpFilesize
4KB
-
memory/1584-142-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1584-150-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/1584-149-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/1584-148-0x0000000005C50000-0x0000000005C51000-memory.dmpFilesize
4KB
-
memory/1584-167-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/1584-168-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/1584-169-0x0000000006760000-0x0000000006761000-memory.dmpFilesize
4KB
-
memory/1584-170-0x0000000005990000-0x0000000005991000-memory.dmpFilesize
4KB
-
memory/1584-146-0x0000000001260000-0x0000000001261000-memory.dmpFilesize
4KB
-
memory/2188-141-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2188-123-0x0000000000000000-mapping.dmp
-
memory/2188-136-0x0000000002020000-0x000000000209C000-memory.dmpFilesize
496KB
-
memory/2188-137-0x00000000021C0000-0x0000000002296000-memory.dmpFilesize
856KB
-
memory/2584-118-0x0000000006420000-0x000000000656A000-memory.dmpFilesize
1.3MB
-
memory/2636-143-0x0000000000570000-0x00000000006BA000-memory.dmpFilesize
1.3MB
-
memory/2636-162-0x00000000004A0000-0x000000000054E000-memory.dmpFilesize
696KB
-
memory/2636-163-0x00000000006C0000-0x0000000000730000-memory.dmpFilesize
448KB
-
memory/2636-145-0x0000000000400000-0x000000000049B000-memory.dmpFilesize
620KB
-
memory/2636-144-0x00000000020D0000-0x0000000002153000-memory.dmpFilesize
524KB
-
memory/2636-124-0x0000000000000000-mapping.dmp
-
memory/3192-154-0x0000000000000000-mapping.dmp
-
memory/3484-153-0x0000000000000000-mapping.dmp
-
memory/3876-178-0x0000000000000000-mapping.dmp
-
memory/3972-132-0x0000000000000000-mapping.dmp