Thu181d864eb8.exe

General
Target

Thu181d864eb8.exe

Filesize

172KB

Completed

04-11-2021 21:02

Score
10/10
MD5

7c3cf9ce3ffb1e5dd48896fdc9080bab

SHA1

34b4976f8f83c1e0a9d277d2a103a61616178728

SHA256

b3049882301853eed2aa8c5ac99010dd84292d7e092eb6f4311fa535716f5d83

Malware Config

Extracted

Family vidar
Version 47.9
Botnet 937
C2

https://mas.to/@kirpich

Attributes
profile_id
937

Extracted

Family raccoon
Botnet 8dec62c1db2959619dca43e02fa46ad7bd606400
Attributes
url4cnc
http://telegin.top/capibar
http://ttmirror.top/capibar
http://teletele.top/capibar
http://telegalive.top/capibar
http://toptelete.top/capibar
http://telegraf.top/capibar
https://t.me/capibar
rc4.plain
rc4.plain
Signatures 35

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • Raccoon

    Description

    Simple but powerful infostealer which was very active in 2019.

  • Suspicious use of NtCreateProcessExOtherParentProcess
    WerFault.exeWerFault.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1972 created 13361972WerFault.exe575sT1VTQzjUttLbWB0ZHLt2.exe
    PID 1112 created 12281112WerFault.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    Description

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    Tags

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    Description

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    Tags

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    Description

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    Tags

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Description

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Tags

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    Description

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    Tags

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    Tags

    TTPs

    Query RegistryVirtualization/Sandbox Evasion
  • Vidar Stealer

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/2188-137-0x00000000021C0000-0x0000000002296000-memory.dmpfamily_vidar
    behavioral2/memory/2188-141-0x0000000000400000-0x00000000004D9000-memory.dmpfamily_vidar
  • Downloads MZ/PE file
  • Executes dropped EXE
    a5eFlqaGqHWMkpG9puFbdHVG.exe575sT1VTQzjUttLbWB0ZHLt2.exej1mXxrhD1y4y7jsNw6MzO1eh.exeFBJQHBPekiHNvEoSuwgJ0w_e.exeEwHd5eKx9glXvopxUrPHkQgV.exez2azK7ZBQVJaEfy_KbPMuSed.exej1mXxrhD1y4y7jsNw6MzO1eh.exe

    Reported IOCs

    pidprocess
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1336575sT1VTQzjUttLbWB0ZHLt2.exe
    2636j1mXxrhD1y4y7jsNw6MzO1eh.exe
    2188FBJQHBPekiHNvEoSuwgJ0w_e.exe
    1584EwHd5eKx9glXvopxUrPHkQgV.exe
    3972z2azK7ZBQVJaEfy_KbPMuSed.exe
    1228j1mXxrhD1y4y7jsNw6MzO1eh.exe
  • Checks BIOS information in registry
    EwHd5eKx9glXvopxUrPHkQgV.exe

    Description

    BIOS information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersionEwHd5eKx9glXvopxUrPHkQgV.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersionEwHd5eKx9glXvopxUrPHkQgV.exe
  • Checks computer location settings
    Thu181d864eb8.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International\Geo\NationThu181d864eb8.exe
  • Loads dropped DLL
    FBJQHBPekiHNvEoSuwgJ0w_e.exe

    Reported IOCs

    pidprocess
    2188FBJQHBPekiHNvEoSuwgJ0w_e.exe
    2188FBJQHBPekiHNvEoSuwgJ0w_e.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Themida packer

    Description

    Detects Themida, an advanced Windows software protection system.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/files/0x000500000001ab98-133.datthemida
    behavioral2/memory/1584-146-0x0000000001260000-0x0000000001261000-memory.dmpthemida
  • Accesses 2FA software files, possible credential harvesting

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Checks whether UAC is enabled
    EwHd5eKx9glXvopxUrPHkQgV.exe

    TTPs

    System Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUAEwHd5eKx9glXvopxUrPHkQgV.exe
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    23ipinfo.io
    64ipinfo.io
    65ipinfo.io
    22ipinfo.io
  • Suspicious use of NtSetInformationThreadHideFromDebugger
    EwHd5eKx9glXvopxUrPHkQgV.exe

    Reported IOCs

    pidprocess
    1584EwHd5eKx9glXvopxUrPHkQgV.exe
  • Suspicious use of SetThreadContext
    j1mXxrhD1y4y7jsNw6MzO1eh.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2636 set thread context of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
  • Drops file in Program Files directory
    z2azK7ZBQVJaEfy_KbPMuSed.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files (x86)\PowerControl\PowerControl_Svc.exez2azK7ZBQVJaEfy_KbPMuSed.exe
    File createdC:\Program Files (x86)\PowerControl\PowerControl_Svc.exez2azK7ZBQVJaEfy_KbPMuSed.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    12721336WerFault.exe575sT1VTQzjUttLbWB0ZHLt2.exe
    30121336WerFault.exe575sT1VTQzjUttLbWB0ZHLt2.exe
    16561336WerFault.exe575sT1VTQzjUttLbWB0ZHLt2.exe
    17961336WerFault.exe575sT1VTQzjUttLbWB0ZHLt2.exe
    19721336WerFault.exe575sT1VTQzjUttLbWB0ZHLt2.exe
    11121228WerFault.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
  • Checks processor information in registry
    FBJQHBPekiHNvEoSuwgJ0w_e.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0FBJQHBPekiHNvEoSuwgJ0w_e.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringFBJQHBPekiHNvEoSuwgJ0w_e.exe
  • Creates scheduled task(s)
    schtasks.exeschtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    3484schtasks.exe
    3192schtasks.exe
  • Delays execution with timeout.exe
    timeout.exe

    Tags

    Reported IOCs

    pidprocess
    3876timeout.exe
  • Kills process with taskkill
    taskkill.exe

    Tags

    Reported IOCs

    pidprocess
    1288taskkill.exe
  • Suspicious behavior: EnumeratesProcesses
    Thu181d864eb8.exea5eFlqaGqHWMkpG9puFbdHVG.exe

    Reported IOCs

    pidprocess
    2584Thu181d864eb8.exe
    2584Thu181d864eb8.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
    1212a5eFlqaGqHWMkpG9puFbdHVG.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exetaskkill.exeEwHd5eKx9glXvopxUrPHkQgV.exeWerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeRestorePrivilege1272WerFault.exe
    Token: SeBackupPrivilege1272WerFault.exe
    Token: SeDebugPrivilege1272WerFault.exe
    Token: SeDebugPrivilege3012WerFault.exe
    Token: SeDebugPrivilege1656WerFault.exe
    Token: SeDebugPrivilege1796WerFault.exe
    Token: SeDebugPrivilege1972WerFault.exe
    Token: SeDebugPrivilege1288taskkill.exe
    Token: SeDebugPrivilege1584EwHd5eKx9glXvopxUrPHkQgV.exe
    Token: SeDebugPrivilege1112WerFault.exe
  • Suspicious use of WriteProcessMemory
    Thu181d864eb8.exez2azK7ZBQVJaEfy_KbPMuSed.exej1mXxrhD1y4y7jsNw6MzO1eh.exeFBJQHBPekiHNvEoSuwgJ0w_e.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2584 wrote to memory of 12122584Thu181d864eb8.exea5eFlqaGqHWMkpG9puFbdHVG.exe
    PID 2584 wrote to memory of 12122584Thu181d864eb8.exea5eFlqaGqHWMkpG9puFbdHVG.exe
    PID 2584 wrote to memory of 13362584Thu181d864eb8.exe575sT1VTQzjUttLbWB0ZHLt2.exe
    PID 2584 wrote to memory of 13362584Thu181d864eb8.exe575sT1VTQzjUttLbWB0ZHLt2.exe
    PID 2584 wrote to memory of 13362584Thu181d864eb8.exe575sT1VTQzjUttLbWB0ZHLt2.exe
    PID 2584 wrote to memory of 21882584Thu181d864eb8.exeFBJQHBPekiHNvEoSuwgJ0w_e.exe
    PID 2584 wrote to memory of 21882584Thu181d864eb8.exeFBJQHBPekiHNvEoSuwgJ0w_e.exe
    PID 2584 wrote to memory of 21882584Thu181d864eb8.exeFBJQHBPekiHNvEoSuwgJ0w_e.exe
    PID 2584 wrote to memory of 26362584Thu181d864eb8.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2584 wrote to memory of 26362584Thu181d864eb8.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2584 wrote to memory of 26362584Thu181d864eb8.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2584 wrote to memory of 15842584Thu181d864eb8.exeEwHd5eKx9glXvopxUrPHkQgV.exe
    PID 2584 wrote to memory of 15842584Thu181d864eb8.exeEwHd5eKx9glXvopxUrPHkQgV.exe
    PID 2584 wrote to memory of 15842584Thu181d864eb8.exeEwHd5eKx9glXvopxUrPHkQgV.exe
    PID 2584 wrote to memory of 39722584Thu181d864eb8.exez2azK7ZBQVJaEfy_KbPMuSed.exe
    PID 2584 wrote to memory of 39722584Thu181d864eb8.exez2azK7ZBQVJaEfy_KbPMuSed.exe
    PID 2584 wrote to memory of 39722584Thu181d864eb8.exez2azK7ZBQVJaEfy_KbPMuSed.exe
    PID 3972 wrote to memory of 34843972z2azK7ZBQVJaEfy_KbPMuSed.exeschtasks.exe
    PID 3972 wrote to memory of 34843972z2azK7ZBQVJaEfy_KbPMuSed.exeschtasks.exe
    PID 3972 wrote to memory of 34843972z2azK7ZBQVJaEfy_KbPMuSed.exeschtasks.exe
    PID 3972 wrote to memory of 31923972z2azK7ZBQVJaEfy_KbPMuSed.exeschtasks.exe
    PID 3972 wrote to memory of 31923972z2azK7ZBQVJaEfy_KbPMuSed.exeschtasks.exe
    PID 3972 wrote to memory of 31923972z2azK7ZBQVJaEfy_KbPMuSed.exeschtasks.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2636 wrote to memory of 12282636j1mXxrhD1y4y7jsNw6MzO1eh.exej1mXxrhD1y4y7jsNw6MzO1eh.exe
    PID 2188 wrote to memory of 7722188FBJQHBPekiHNvEoSuwgJ0w_e.execmd.exe
    PID 2188 wrote to memory of 7722188FBJQHBPekiHNvEoSuwgJ0w_e.execmd.exe
    PID 2188 wrote to memory of 7722188FBJQHBPekiHNvEoSuwgJ0w_e.execmd.exe
    PID 772 wrote to memory of 1288772cmd.exetaskkill.exe
    PID 772 wrote to memory of 1288772cmd.exetaskkill.exe
    PID 772 wrote to memory of 1288772cmd.exetaskkill.exe
    PID 772 wrote to memory of 3876772cmd.exetimeout.exe
    PID 772 wrote to memory of 3876772cmd.exetimeout.exe
    PID 772 wrote to memory of 3876772cmd.exetimeout.exe
Processes 19
  • C:\Users\Admin\AppData\Local\Temp\Thu181d864eb8.exe
    "C:\Users\Admin\AppData\Local\Temp\Thu181d864eb8.exe"
    Checks computer location settings
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Users\Admin\Pictures\Adobe Films\a5eFlqaGqHWMkpG9puFbdHVG.exe
      "C:\Users\Admin\Pictures\Adobe Films\a5eFlqaGqHWMkpG9puFbdHVG.exe"
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1212
    • C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe
      "C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe
        "C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe"
        Executes dropped EXE
        PID:1228
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 944
          Suspicious use of NtCreateProcessExOtherParentProcess
          Program crash
          Suspicious use of AdjustPrivilegeToken
          PID:1112
    • C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exe
      "C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exe"
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c taskkill /im FBJQHBPekiHNvEoSuwgJ0w_e.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exe" & del C:\ProgramData\*.dll & exit
        Suspicious use of WriteProcessMemory
        PID:772
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /im FBJQHBPekiHNvEoSuwgJ0w_e.exe /f
          Kills process with taskkill
          Suspicious use of AdjustPrivilegeToken
          PID:1288
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 6
          Delays execution with timeout.exe
          PID:3876
    • C:\Users\Admin\Pictures\Adobe Films\575sT1VTQzjUttLbWB0ZHLt2.exe
      "C:\Users\Admin\Pictures\Adobe Films\575sT1VTQzjUttLbWB0ZHLt2.exe"
      Executes dropped EXE
      PID:1336
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 664
        Program crash
        Suspicious use of AdjustPrivilegeToken
        PID:1272
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 684
        Program crash
        Suspicious use of AdjustPrivilegeToken
        PID:3012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 736
        Program crash
        Suspicious use of AdjustPrivilegeToken
        PID:1656
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 736
        Program crash
        Suspicious use of AdjustPrivilegeToken
        PID:1796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 640
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious use of AdjustPrivilegeToken
        PID:1972
    • C:\Users\Admin\Pictures\Adobe Films\EwHd5eKx9glXvopxUrPHkQgV.exe
      "C:\Users\Admin\Pictures\Adobe Films\EwHd5eKx9glXvopxUrPHkQgV.exe"
      Executes dropped EXE
      Checks BIOS information in registry
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      PID:1584
    • C:\Users\Admin\Pictures\Adobe Films\z2azK7ZBQVJaEfy_KbPMuSed.exe
      "C:\Users\Admin\Pictures\Adobe Films\z2azK7ZBQVJaEfy_KbPMuSed.exe"
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:3972
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        Creates scheduled task(s)
        PID:3484
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        Creates scheduled task(s)
        PID:3192
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\ProgramData\freebl3.dll

                  MD5

                  ef2834ac4ee7d6724f255beaf527e635

                  SHA1

                  5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

                  SHA256

                  a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

                  SHA512

                  c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

                • C:\ProgramData\mozglue.dll

                  MD5

                  8f73c08a9660691143661bf7332c3c27

                  SHA1

                  37fa65dd737c50fda710fdbde89e51374d0c204a

                  SHA256

                  3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                  SHA512

                  0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                • C:\ProgramData\msvcp140.dll

                  MD5

                  109f0f02fd37c84bfc7508d4227d7ed5

                  SHA1

                  ef7420141bb15ac334d3964082361a460bfdb975

                  SHA256

                  334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                  SHA512

                  46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                • C:\ProgramData\nss3.dll

                  MD5

                  bfac4e3c5908856ba17d41edcd455a51

                  SHA1

                  8eec7e888767aa9e4cca8ff246eb2aacb9170428

                  SHA256

                  e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                  SHA512

                  2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                • C:\ProgramData\softokn3.dll

                  MD5

                  a2ee53de9167bf0d6c019303b7ca84e5

                  SHA1

                  2a3c737fa1157e8483815e98b666408a18c0db42

                  SHA256

                  43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

                  SHA512

                  45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

                • C:\ProgramData\vcruntime140.dll

                  MD5

                  7587bf9cb4147022cd5681b015183046

                  SHA1

                  f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                  SHA256

                  c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                  SHA512

                  0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                • C:\Users\Admin\Pictures\Adobe Films\575sT1VTQzjUttLbWB0ZHLt2.exe

                  MD5

                  49252ec4ef4b0dbf252e84686ca1f134

                  SHA1

                  26428e6dac64addc42848042f6bb600d98d821e9

                  SHA256

                  e5e540171fdb508b9c6a3ab4fa62fa5b8c2645fadd036b7c8d9932e990575092

                  SHA512

                  ba9fe920b2196f9958e0d5204812a5180dca70d6ecfb19a24efd69e56e67db7635feb49280a8b2726168a5d7daef448b5ab1e4b9197f2f773ef39085f3f77aae

                • C:\Users\Admin\Pictures\Adobe Films\575sT1VTQzjUttLbWB0ZHLt2.exe

                  MD5

                  49252ec4ef4b0dbf252e84686ca1f134

                  SHA1

                  26428e6dac64addc42848042f6bb600d98d821e9

                  SHA256

                  e5e540171fdb508b9c6a3ab4fa62fa5b8c2645fadd036b7c8d9932e990575092

                  SHA512

                  ba9fe920b2196f9958e0d5204812a5180dca70d6ecfb19a24efd69e56e67db7635feb49280a8b2726168a5d7daef448b5ab1e4b9197f2f773ef39085f3f77aae

                • C:\Users\Admin\Pictures\Adobe Films\EwHd5eKx9glXvopxUrPHkQgV.exe

                  MD5

                  c0f94c48ed4cde88182bf8d23c593681

                  SHA1

                  109221d280ed1eacca64491b846d49dc7f00a085

                  SHA256

                  3cb29ddb05b9144c3e4f78cc10de67c76c8d51c11bdc0e9642ee8b80555c87fb

                  SHA512

                  573bb151bc32bdba0761c8630480e9e0535c915688e94a8745de0787ec939259689feea68c34d8bb9d77939cb17a5ebc677cb261b87fae949ee2a055e58baacf

                • C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exe

                  MD5

                  21bb6f6da4d85a40fea01d98c2132b50

                  SHA1

                  eebad8256656b3113eba7321bcce467a61a98322

                  SHA256

                  4401cc5459665a04cab4be3e7930ab187e86908b056ad321e19b3b0e8fc255ac

                  SHA512

                  3b1b4c91181d5b286e795afc5ef3549f1473595aa5a69cb51d6d9b31dcda284003d682f1bf3f24d663f4b552ac991996169107c9ac1707901c0fe0ba57f61d9f

                • C:\Users\Admin\Pictures\Adobe Films\FBJQHBPekiHNvEoSuwgJ0w_e.exe

                  MD5

                  21bb6f6da4d85a40fea01d98c2132b50

                  SHA1

                  eebad8256656b3113eba7321bcce467a61a98322

                  SHA256

                  4401cc5459665a04cab4be3e7930ab187e86908b056ad321e19b3b0e8fc255ac

                  SHA512

                  3b1b4c91181d5b286e795afc5ef3549f1473595aa5a69cb51d6d9b31dcda284003d682f1bf3f24d663f4b552ac991996169107c9ac1707901c0fe0ba57f61d9f

                • C:\Users\Admin\Pictures\Adobe Films\a5eFlqaGqHWMkpG9puFbdHVG.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • C:\Users\Admin\Pictures\Adobe Films\a5eFlqaGqHWMkpG9puFbdHVG.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe

                  MD5

                  639b8ee565307d8541ee1d9c86cf84d3

                  SHA1

                  e73072a3b128e34805e7565d1cc90df085e89cdc

                  SHA256

                  a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9

                  SHA512

                  f5689df5b7515b8b038b1a081efec473f1c788f0aa41e548ba663a7a0b411d8ffc485879967cf61989764b161eea260b8b2e25cd0fde4af39f583b784050a768

                • C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe

                  MD5

                  639b8ee565307d8541ee1d9c86cf84d3

                  SHA1

                  e73072a3b128e34805e7565d1cc90df085e89cdc

                  SHA256

                  a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9

                  SHA512

                  f5689df5b7515b8b038b1a081efec473f1c788f0aa41e548ba663a7a0b411d8ffc485879967cf61989764b161eea260b8b2e25cd0fde4af39f583b784050a768

                • C:\Users\Admin\Pictures\Adobe Films\j1mXxrhD1y4y7jsNw6MzO1eh.exe

                  MD5

                  639b8ee565307d8541ee1d9c86cf84d3

                  SHA1

                  e73072a3b128e34805e7565d1cc90df085e89cdc

                  SHA256

                  a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9

                  SHA512

                  f5689df5b7515b8b038b1a081efec473f1c788f0aa41e548ba663a7a0b411d8ffc485879967cf61989764b161eea260b8b2e25cd0fde4af39f583b784050a768

                • C:\Users\Admin\Pictures\Adobe Films\z2azK7ZBQVJaEfy_KbPMuSed.exe

                  MD5

                  19b0bf2bb132231de9dd08f8761c5998

                  SHA1

                  a08a73f6fa211061d6defc14bc8fec6ada2166c4

                  SHA256

                  ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e

                  SHA512

                  5bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1

                • C:\Users\Admin\Pictures\Adobe Films\z2azK7ZBQVJaEfy_KbPMuSed.exe

                  MD5

                  19b0bf2bb132231de9dd08f8761c5998

                  SHA1

                  a08a73f6fa211061d6defc14bc8fec6ada2166c4

                  SHA256

                  ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e

                  SHA512

                  5bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1

                • \ProgramData\mozglue.dll

                  MD5

                  8f73c08a9660691143661bf7332c3c27

                  SHA1

                  37fa65dd737c50fda710fdbde89e51374d0c204a

                  SHA256

                  3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                  SHA512

                  0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                • \ProgramData\nss3.dll

                  MD5

                  bfac4e3c5908856ba17d41edcd455a51

                  SHA1

                  8eec7e888767aa9e4cca8ff246eb2aacb9170428

                  SHA256

                  e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                  SHA512

                  2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                • memory/772-176-0x0000000000000000-mapping.dmp

                • memory/1212-119-0x0000000000000000-mapping.dmp

                • memory/1228-173-0x0000000000680000-0x00000000006CE000-memory.dmp

                • memory/1228-174-0x00000000006D0000-0x000000000075E000-memory.dmp

                • memory/1228-172-0x0000000000400000-0x0000000000491000-memory.dmp

                • memory/1228-164-0x0000000000400000-0x0000000000491000-memory.dmp

                • memory/1228-160-0x0000000000402998-mapping.dmp

                • memory/1228-175-0x0000000000400000-0x0000000000491000-memory.dmp

                • memory/1228-159-0x0000000000400000-0x0000000000491000-memory.dmp

                • memory/1288-177-0x0000000000000000-mapping.dmp

                • memory/1336-158-0x0000000000400000-0x0000000000903000-memory.dmp

                • memory/1336-122-0x0000000000000000-mapping.dmp

                • memory/1336-157-0x0000000002510000-0x0000000002554000-memory.dmp

                • memory/1584-146-0x0000000001260000-0x0000000001261000-memory.dmp

                • memory/1584-155-0x0000000005560000-0x0000000005561000-memory.dmp

                • memory/1584-149-0x0000000000D60000-0x0000000000D61000-memory.dmp

                • memory/1584-169-0x0000000006760000-0x0000000006761000-memory.dmp

                • memory/1584-148-0x0000000005C50000-0x0000000005C51000-memory.dmp

                • memory/1584-152-0x0000000005630000-0x0000000005631000-memory.dmp

                • memory/1584-142-0x0000000077250000-0x00000000773DE000-memory.dmp

                • memory/1584-179-0x0000000006F30000-0x0000000006F31000-memory.dmp

                • memory/1584-180-0x0000000007630000-0x0000000007631000-memory.dmp

                • memory/1584-131-0x0000000000000000-mapping.dmp

                • memory/1584-150-0x0000000005640000-0x0000000005641000-memory.dmp

                • memory/1584-167-0x00000000057D0000-0x00000000057D1000-memory.dmp

                • memory/1584-168-0x00000000058F0000-0x00000000058F1000-memory.dmp

                • memory/1584-151-0x0000000005520000-0x0000000005521000-memory.dmp

                • memory/1584-170-0x0000000005990000-0x0000000005991000-memory.dmp

                • memory/1584-171-0x0000000006460000-0x0000000006461000-memory.dmp

                • memory/2188-141-0x0000000000400000-0x00000000004D9000-memory.dmp

                • memory/2188-136-0x0000000002020000-0x000000000209C000-memory.dmp

                • memory/2188-123-0x0000000000000000-mapping.dmp

                • memory/2188-137-0x00000000021C0000-0x0000000002296000-memory.dmp

                • memory/2584-118-0x0000000006420000-0x000000000656A000-memory.dmp

                • memory/2636-163-0x00000000006C0000-0x0000000000730000-memory.dmp

                • memory/2636-143-0x0000000000570000-0x00000000006BA000-memory.dmp

                • memory/2636-145-0x0000000000400000-0x000000000049B000-memory.dmp

                • memory/2636-144-0x00000000020D0000-0x0000000002153000-memory.dmp

                • memory/2636-162-0x00000000004A0000-0x000000000054E000-memory.dmp

                • memory/2636-124-0x0000000000000000-mapping.dmp

                • memory/3192-154-0x0000000000000000-mapping.dmp

                • memory/3484-153-0x0000000000000000-mapping.dmp

                • memory/3876-178-0x0000000000000000-mapping.dmp

                • memory/3972-132-0x0000000000000000-mapping.dmp