djvu | 433cf9125a44e304eca2c5cf3bfe2af0b1deafd1c5e8d13d559e1bac9de711b3

Analysis

max time kernel
151s
max time network
151s
platform
windows10_x64
resource
win10-en-20211104
submitted
09/11/2021, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db2ef30e8f821c8f00456941f5944849.exe
Size 286KB
Sample211109-z4fftschfp
SHA256 433cf9125a44e304eca2c5cf3bfe2af0b1deafd1c5e8d13d559e1bac9de711b3
MD5 db2ef30e8f821c8f00456941f5944849
SHA1 01a08a69f1e8e6d822ece577a9ebe84a0c7f5f60
SHA512 7e8a3b0a1c57b3e7e8b6bff850d5cd28bbabca63ba90bca0f7a502e3964de641004388afb1271a01e7bc34ba66d6299e487107869c4bc224bf36d6fb900e72ee
MD5 SHA1 SHA512

Malware Config

Extracted

Family

smokeloader

Version

2020

http://nalirou70.top/
http://xacokuo80.top/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/

rc4.i32

Extracted

Family

redline

Botnet

new3

93.115.20.139:28978

Extracted

Family

redline

Botnet

SuperStar

185.215.113.29:36224

Extracted

Family

icedid

Botnet

1217670233

lakogrefop.rest
hangetilin.top
follytresh.co
zojecurf.store

Attributes

auth_var
14
url_path
/posts/

Extracted

Family

raccoon

Botnet

8dec62c1db2959619dca43e02fa46ad7bd606400

Attributes

url4cnc
http://telegin.top/capibar

http://ttmirror.top/capibar

http://teletele.top/capibar

http://telegalive.top/capibar

http://toptelete.top/capibar

http://telegraf.top/capibar

https://t.me/capibar

rc4.plain

Extracted

Family

redline

Botnet

1132044836

185.183.32.184:80

Extracted

Family

djvu

http://pqkl.org/lancer/get.php

Attributes

extension
.irfk
offline_id
7HKlLI6NrOQGMaTs5PqjvV1UcZ3VOcIeyFiH3Wt1
payload_url
http://kotob.top/dl/build2.exe

http://pqkl.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-dFmA3YqXzs Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0346uSifke

rsa_pubkey.plain

Extracted

Family

vidar

Version

48.1

Botnet

https://koyu.space/@rspich

Attributes

profile_id
706

Signatures

Detected Djvu ransomware 5 IoCs

resource	yara_rule
behavioral2/memory/1556-283-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/5080-288-0x0000000004920000-0x0000000004A3B000-memory.dmp	family_djvu
behavioral2/memory/1556-289-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4284-318-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/4284-325-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral2/memory/1784-142-0x0000000000418D26-mapping.dmp	family_redline
behavioral2/memory/1784-141-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/1756-176-0x0000000002200000-0x000000000221C000-memory.dmp	family_redline
behavioral2/memory/1756-178-0x0000000004920000-0x000000000493B000-memory.dmp	family_redline
behavioral2/memory/4888-215-0x00000000048B0000-0x00000000048DE000-memory.dmp	family_redline
behavioral2/memory/4888-217-0x0000000004B30000-0x0000000004B5C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
suricata
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/3320-348-0x00000000047C0000-0x0000000004895000-memory.dmp	family_vidar
behavioral2/memory/3320-349-0x0000000000400000-0x0000000002BAC000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 22 IoCs

pid	Process
4416	1D96.exe
772	1D96.exe
3284	5169.exe
4364	5169.exe
1784	5169.exe
3260	661B.exe
1564	8721.exe
1756	8721.exe
2844	C3ED.exe
2744	C3ED.exe
4888	F280.exe
3884	273D.exe
2856	4D93.exe
5080	7129.exe
2348	76F6.exe
1556	7129.exe
3344	7129.exe
928	8947.exe
3292	9QvqyDn8Mt.Exe
4284	7129.exe
3320	9658.exe
420	9F51.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	273D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	273D.exe

Deletes itself 1 IoCs

pid	Process
3032	Process not Found

Loads dropped DLL 5 IoCs

pid	Process
3260	661B.exe
2496	regsvr32.exe
812	regsvr32.exe
3320	9658.exe
3320	9658.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1992	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000500000001abc0-236.dat	themida
behavioral2/files/0x000500000001abc0-237.dat	themida
behavioral2/memory/3884-241-0x0000000001370000-0x0000000001371000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\2384d14d-e984-4398-ab16-57572c0fa125\\7129.exe\" --AutoStart"	7129.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	273D.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
127	api.2ip.ua
138	api.2ip.ua
126	api.2ip.ua

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3884	273D.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4268 set thread context of 3024	4268	db2ef30e8f821c8f00456941f5944849.exe	68
PID 4416 set thread context of 772	4416	1D96.exe	70
PID 3284 set thread context of 1784	3284	5169.exe	73
PID 1564 set thread context of 1756	1564	8721.exe	77
PID 2844 set thread context of 2744	2844	C3ED.exe	80
PID 5080 set thread context of 1556	5080	7129.exe	89
PID 3344 set thread context of 4284	3344	7129.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	db2ef30e8f821c8f00456941f5944849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1D96.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	661B.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	661B.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	db2ef30e8f821c8f00456941f5944849.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	db2ef30e8f821c8f00456941f5944849.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1D96.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1D96.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	661B.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9658.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9658.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1256	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4924	taskkill.exe
3708	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	7129.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	7129.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3024	db2ef30e8f821c8f00456941f5944849.exe
3024	db2ef30e8f821c8f00456941f5944849.exe
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found
3032	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	Process not Found

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3024	db2ef30e8f821c8f00456941f5944849.exe
772	1D96.exe
3260	661B.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeDebugPrivilege	3284	5169.exe
Token: SeDebugPrivilege	1784	5169.exe
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeDebugPrivilege	4888	F280.exe
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeDebugPrivilege	3884	273D.exe
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeDebugPrivilege	2856	4D93.exe
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeDebugPrivilege	2348	76F6.exe
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found
Token: SeCreatePagefilePrivilege	3032	Process not Found
Token: SeShutdownPrivilege	3032	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3024	4268	db2ef30e8f821c8f00456941f5944849.exe	68
PID 4268 wrote to memory of 3024	4268	db2ef30e8f821c8f00456941f5944849.exe	68
PID 4268 wrote to memory of 3024	4268	db2ef30e8f821c8f00456941f5944849.exe	68
PID 4268 wrote to memory of 3024	4268	db2ef30e8f821c8f00456941f5944849.exe	68
PID 4268 wrote to memory of 3024	4268	db2ef30e8f821c8f00456941f5944849.exe	68
PID 4268 wrote to memory of 3024	4268	db2ef30e8f821c8f00456941f5944849.exe	68
PID 3032 wrote to memory of 4416	3032	Process not Found	69
PID 3032 wrote to memory of 4416	3032	Process not Found	69
PID 3032 wrote to memory of 4416	3032	Process not Found	69
PID 4416 wrote to memory of 772	4416	1D96.exe	70
PID 4416 wrote to memory of 772	4416	1D96.exe	70
PID 4416 wrote to memory of 772	4416	1D96.exe	70
PID 4416 wrote to memory of 772	4416	1D96.exe	70
PID 4416 wrote to memory of 772	4416	1D96.exe	70
PID 4416 wrote to memory of 772	4416	1D96.exe	70
PID 3032 wrote to memory of 3284	3032	Process not Found	71
PID 3032 wrote to memory of 3284	3032	Process not Found	71
PID 3032 wrote to memory of 3284	3032	Process not Found	71
PID 3284 wrote to memory of 4364	3284	5169.exe	72
PID 3284 wrote to memory of 4364	3284	5169.exe	72
PID 3284 wrote to memory of 4364	3284	5169.exe	72
PID 3284 wrote to memory of 1784	3284	5169.exe	73
PID 3284 wrote to memory of 1784	3284	5169.exe	73
PID 3284 wrote to memory of 1784	3284	5169.exe	73
PID 3284 wrote to memory of 1784	3284	5169.exe	73
PID 3284 wrote to memory of 1784	3284	5169.exe	73
PID 3284 wrote to memory of 1784	3284	5169.exe	73
PID 3284 wrote to memory of 1784	3284	5169.exe	73
PID 3284 wrote to memory of 1784	3284	5169.exe	73
PID 3032 wrote to memory of 3260	3032	Process not Found	74
PID 3032 wrote to memory of 3260	3032	Process not Found	74
PID 3032 wrote to memory of 3260	3032	Process not Found	74
PID 3032 wrote to memory of 1564	3032	Process not Found	76
PID 3032 wrote to memory of 1564	3032	Process not Found	76
PID 3032 wrote to memory of 1564	3032	Process not Found	76
PID 1564 wrote to memory of 1756	1564	8721.exe	77
PID 1564 wrote to memory of 1756	1564	8721.exe	77
PID 1564 wrote to memory of 1756	1564	8721.exe	77
PID 1564 wrote to memory of 1756	1564	8721.exe	77
PID 1564 wrote to memory of 1756	1564	8721.exe	77
PID 1564 wrote to memory of 1756	1564	8721.exe	77
PID 1564 wrote to memory of 1756	1564	8721.exe	77
PID 1564 wrote to memory of 1756	1564	8721.exe	77
PID 1564 wrote to memory of 1756	1564	8721.exe	77
PID 3032 wrote to memory of 2496	3032	Process not Found	78
PID 3032 wrote to memory of 2496	3032	Process not Found	78
PID 3032 wrote to memory of 2844	3032	Process not Found	79
PID 3032 wrote to memory of 2844	3032	Process not Found	79
PID 3032 wrote to memory of 2844	3032	Process not Found	79
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 2844 wrote to memory of 2744	2844	C3ED.exe	80
PID 3032 wrote to memory of 4888	3032	Process not Found	83
PID 3032 wrote to memory of 4888	3032	Process not Found	83
PID 3032 wrote to memory of 4888	3032	Process not Found	83
PID 3032 wrote to memory of 3884	3032	Process not Found	84
PID 3032 wrote to memory of 3884	3032	Process not Found	84

C:\Users\Admin\AppData\Local\Temp\db2ef30e8f821c8f00456941f5944849.exe
"C:\Users\Admin\AppData\Local\Temp\db2ef30e8f821c8f00456941f5944849.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\db2ef30e8f821c8f00456941f5944849.exe
  "C:\Users\Admin\AppData\Local\Temp\db2ef30e8f821c8f00456941f5944849.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3024

C:\Users\Admin\AppData\Local\Temp\1D96.exe
C:\Users\Admin\AppData\Local\Temp\1D96.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\1D96.exe
  C:\Users\Admin\AppData\Local\Temp\1D96.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:772

C:\Users\Admin\AppData\Local\Temp\5169.exe
C:\Users\Admin\AppData\Local\Temp\5169.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\5169.exe
  "C:\Users\Admin\AppData\Local\Temp\5169.exe"
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\5169.exe
  "C:\Users\Admin\AppData\Local\Temp\5169.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1784

C:\Users\Admin\AppData\Local\Temp\661B.exe
C:\Users\Admin\AppData\Local\Temp\661B.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3260

C:\Users\Admin\AppData\Local\Temp\8721.exe
C:\Users\Admin\AppData\Local\Temp\8721.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\8721.exe
  C:\Users\Admin\AppData\Local\Temp\8721.exe
  2⤵
  - Executes dropped EXE
  PID:1756

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\A74C.dll
1⤵
- Loads dropped DLL
PID:2496

C:\Users\Admin\AppData\Local\Temp\C3ED.exe
C:\Users\Admin\AppData\Local\Temp\C3ED.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\C3ED.exe
  C:\Users\Admin\AppData\Local\Temp\C3ED.exe
  2⤵
  - Executes dropped EXE
  PID:2744

C:\Users\Admin\AppData\Local\Temp\F280.exe
C:\Users\Admin\AppData\Local\Temp\F280.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Users\Admin\AppData\Local\Temp\273D.exe
C:\Users\Admin\AppData\Local\Temp\273D.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Users\Admin\AppData\Local\Temp\4D93.exe
C:\Users\Admin\AppData\Local\Temp\4D93.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Users\Admin\AppData\Local\Temp\7129.exe
C:\Users\Admin\AppData\Local\Temp\7129.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5080
- C:\Users\Admin\AppData\Local\Temp\7129.exe
  C:\Users\Admin\AppData\Local\Temp\7129.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies system certificate store
  PID:1556
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\2384d14d-e984-4398-ab16-57572c0fa125" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\7129.exe
    "C:\Users\Admin\AppData\Local\Temp\7129.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\7129.exe
      "C:\Users\Admin\AppData\Local\Temp\7129.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:4284

C:\Users\Admin\AppData\Local\Temp\76F6.exe
C:\Users\Admin\AppData\Local\Temp\76F6.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Users\Admin\AppData\Local\Temp\8947.exe
C:\Users\Admin\AppData\Local\Temp\8947.exe
1⤵
- Executes dropped EXE
PID:928
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" vbsCrIpT: cLOSe( CReateoBJECt( "WscrIpT.sHEll").rUN( "C:\Windows\system32\cmd.exe /Q /R type ""C:\Users\Admin\AppData\Local\Temp\8947.exe"" > 9QvqyDn8Mt.Exe&& stARt 9QvQYDN8MT.EXE -PkCqqHUkE43wIVRS &IF """" == """" for %A IN ( ""C:\Users\Admin\AppData\Local\Temp\8947.exe"" ) do taskkill /IM ""%~nxA"" -f ", 0 , tRUE ))
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /Q /R type "C:\Users\Admin\AppData\Local\Temp\8947.exe" > 9QvqyDn8Mt.Exe&& stARt 9QvQYDN8MT.EXE -PkCqqHUkE43wIVRS &IF "" == "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\8947.exe" ) do taskkill /IM "%~nxA" -f
    3⤵
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\9QvqyDn8Mt.Exe
      9QvQYDN8MT.EXE -PkCqqHUkE43wIVRS
      4⤵
      Executes dropped EXE
      PID:3292
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIpT: cLOSe( CReateoBJECt( "WscrIpT.sHEll").rUN( "C:\Windows\system32\cmd.exe /Q /R type ""C:\Users\Admin\AppData\Local\Temp\9QvqyDn8Mt.Exe"" > 9QvqyDn8Mt.Exe&& stARt 9QvQYDN8MT.EXE -PkCqqHUkE43wIVRS &IF ""-PkCqqHUkE43wIVRS "" == """" for %A IN ( ""C:\Users\Admin\AppData\Local\Temp\9QvqyDn8Mt.Exe"" ) do taskkill /IM ""%~nxA"" -f ", 0 , tRUE ))
        5⤵
        
        PID:5092
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /Q /R type "C:\Users\Admin\AppData\Local\Temp\9QvqyDn8Mt.Exe" > 9QvqyDn8Mt.Exe&& stARt 9QvQYDN8MT.EXE -PkCqqHUkE43wIVRS &IF "-PkCqqHUkE43wIVRS " == "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\9QvqyDn8Mt.Exe" ) do taskkill /IM "%~nxA" -f
        6⤵
        
        PID:4084
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbscRiPT: cLoSE( CreaTEoBjeCT("WSCRIpt.shelL" ).rUn ( "C:\Windows\system32\cmd.exe /q /c echO | Set /P = ""MZ"" > Z7hM_OPG.W & COpy /b /y Z7HM_OPG.W+ M97FmK.B + D2sZGB.P QzUC.Q3F & dEL M97FmK.B D2szGB.P Z7hM_Opg.W& sTarT regsvr32 -s .\QzUC.Q3F " , 0 ,True ) )
        5⤵
        
        PID:3256
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /c echO | Set /P = "MZ" > Z7hM_OPG.W& COpy /b /y Z7HM_OPG.W+ M97FmK.B + D2sZGB.P QzUC.Q3F & dEL M97FmK.B D2szGB.P Z7hM_Opg.W& sTarT regsvr32 -s .\QzUC.Q3F
        6⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echO "
        7⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>Z7hM_OPG.W"
        7⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 -s .\QzUC.Q3F
        7⤵
        Loads dropped DLL
        
        PID:812
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "8947.exe" -f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3708

C:\Users\Admin\AppData\Local\Temp\9658.exe
C:\Users\Admin\AppData\Local\Temp\9658.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im 9658.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\9658.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im 9658.exe /f
    3⤵
    - Kills process with taskkill
    PID:4924
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:1256

C:\Users\Admin\AppData\Local\Temp\9F51.exe
C:\Users\Admin\AppData\Local\Temp\9F51.exe
1⤵
- Executes dropped EXE
PID:420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/420-363-0x00000000073F3000-0x00000000073F4000-memory.dmp

Download

memory/420-364-0x00000000073F4000-0x00000000073F6000-memory.dmp

Download

memory/420-351-0x0000000002CB0000-0x0000000002CE9000-memory.dmp

Download

memory/420-362-0x00000000073F2000-0x00000000073F3000-memory.dmp

Download

memory/420-361-0x00000000073F0000-0x00000000073F1000-memory.dmp

Download

memory/420-352-0x0000000000400000-0x0000000002B5C000-memory.dmp

Download

memory/812-378-0x0000000005300000-0x00000000053B7000-memory.dmp

Download

memory/812-339-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/812-379-0x0000000005480000-0x0000000005536000-memory.dmp

Download

memory/1556-289-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1564-181-0x0000000004730000-0x0000000004760000-memory.dmp

Download

memory/1756-176-0x0000000002200000-0x000000000221C000-memory.dmp

Download

memory/1756-183-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1756-186-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/1756-178-0x0000000004920000-0x000000000493B000-memory.dmp

Download

memory/1756-188-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/1756-173-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1756-187-0x00000000049D2000-0x00000000049D3000-memory.dmp

Download

memory/1756-185-0x00000000049D4000-0x00000000049D6000-memory.dmp

Download

memory/1756-189-0x00000000049D3000-0x00000000049D4000-memory.dmp

Download

memory/1784-165-0x0000000006500000-0x0000000006501000-memory.dmp

Download

memory/1784-161-0x0000000005B20000-0x0000000005B21000-memory.dmp

Download

memory/1784-167-0x00000000084B0000-0x00000000084B1000-memory.dmp

Download

memory/1784-141-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1784-147-0x0000000005D80000-0x0000000005D81000-memory.dmp

Download

memory/1784-148-0x0000000005770000-0x0000000005771000-memory.dmp

Download

memory/1784-149-0x00000000058A0000-0x00000000058A1000-memory.dmp

Download

memory/1784-150-0x00000000057D0000-0x00000000057D1000-memory.dmp

Download

memory/1784-151-0x0000000005810000-0x0000000005811000-memory.dmp

Download

memory/1784-153-0x0000000005770000-0x0000000005D76000-memory.dmp

Download

memory/1784-166-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Download

memory/1784-164-0x0000000005C10000-0x0000000005C11000-memory.dmp

Download

memory/2348-305-0x0000000007184000-0x0000000007186000-memory.dmp

Download

memory/2348-304-0x0000000007183000-0x0000000007184000-memory.dmp

Download

memory/2348-303-0x0000000007182000-0x0000000007183000-memory.dmp

Download

memory/2348-301-0x0000000000400000-0x0000000002B5B000-memory.dmp

Download

memory/2348-302-0x0000000007180000-0x0000000007181000-memory.dmp

Download

memory/2348-290-0x0000000004760000-0x0000000004799000-memory.dmp

Download

memory/2496-193-0x00000000026A0000-0x00000000026D7000-memory.dmp

Download

memory/2744-200-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/2744-205-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/2744-206-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/2744-208-0x0000000000760000-0x00000000007EE000-memory.dmp

Download

memory/2744-207-0x00000000004A0000-0x00000000005EA000-memory.dmp

Download

memory/2744-209-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/2844-204-0x00000000022C0000-0x0000000002330000-memory.dmp

Download

memory/2844-203-0x0000000002220000-0x0000000002283000-memory.dmp

Download

memory/2844-199-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/2844-198-0x0000000002190000-0x0000000002213000-memory.dmp

Download

memory/2844-197-0x0000000001FC0000-0x0000000002037000-memory.dmp

Download

memory/2856-267-0x000000001C050000-0x000000001C052000-memory.dmp

Download

memory/2856-260-0x0000000000C90000-0x0000000000CD0000-memory.dmp

Download

memory/2856-258-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/3024-120-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3032-122-0x00000000009A0000-0x00000000009B6000-memory.dmp

Download

memory/3032-130-0x0000000000BF0000-0x0000000000C06000-memory.dmp

Download

memory/3032-168-0x0000000002A20000-0x0000000002A36000-memory.dmp

Download

memory/3260-160-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3260-159-0x0000000000580000-0x0000000000589000-memory.dmp

Download

memory/3260-158-0x0000000000570000-0x0000000000578000-memory.dmp

Download

memory/3284-152-0x0000000005050000-0x0000000005051000-memory.dmp

Download

memory/3284-139-0x0000000005060000-0x0000000005076000-memory.dmp

Download

memory/3284-134-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/3284-136-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/3284-137-0x000000000AA70000-0x000000000AA71000-memory.dmp

Download

memory/3284-138-0x000000000A610000-0x000000000A611000-memory.dmp

Download

memory/3320-348-0x00000000047C0000-0x0000000004895000-memory.dmp

Download

memory/3320-349-0x0000000000400000-0x0000000002BAC000-memory.dmp

Download

memory/3884-248-0x00000000778E0000-0x0000000077A6E000-memory.dmp

Download

memory/3884-241-0x0000000001370000-0x0000000001371000-memory.dmp

Download

memory/3884-249-0x0000000000D60000-0x0000000000D72000-memory.dmp

Download

memory/4268-119-0x00000000001D0000-0x00000000001D9000-memory.dmp

Download

memory/4284-325-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4888-232-0x0000000009290000-0x0000000009291000-memory.dmp

Download

memory/4888-214-0x0000000002B60000-0x0000000002C0E000-memory.dmp

Download

memory/4888-217-0x0000000004B30000-0x0000000004B5C000-memory.dmp

Download

memory/4888-227-0x0000000007364000-0x0000000007366000-memory.dmp

Download

memory/4888-215-0x00000000048B0000-0x00000000048DE000-memory.dmp

Download

memory/4888-225-0x0000000007362000-0x0000000007363000-memory.dmp

Download

memory/4888-226-0x0000000007363000-0x0000000007364000-memory.dmp

Download

memory/4888-223-0x0000000000400000-0x0000000002B5B000-memory.dmp

Download

memory/4888-224-0x0000000007360000-0x0000000007361000-memory.dmp

Download

memory/5080-288-0x0000000004920000-0x0000000004A3B000-memory.dmp

Download