Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 01:57
Static task
static1
Behavioral task
behavioral1
Sample
e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe
Resource
win10-en-20211104
General
-
Target
e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe
-
Size
232KB
-
MD5
0e314e38d19179ead2e608867588bc50
-
SHA1
e76f626f2898fdef4008fcaa961175767a5b03c2
-
SHA256
e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b
-
SHA512
a1d5fb57e5594c45b6433048055ae4205f0795b95f759fef1cf8179134600b45bd33ae205db2cb8c4addb1fe5360522527169818a7549a8519e5ff2ba301dea8
Malware Config
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Executes dropped EXE 1 IoCs
Processes:
vudjeftpid process 4436 vudjeft -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2236 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4192 3840 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vudjefte57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vudjeft Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vudjeft Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vudjeft -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 4448 ipconfig.exe 2280 NETSTAT.EXE 1444 NETSTAT.EXE 2088 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1971E4F9-404B-11EC-B34F-5E5582552494} = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exepid process 3092 e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe 3092 e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2236 -
Suspicious behavior: MapViewOfSection 50 IoCs
Processes:
e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exevudjeftpid process 3092 e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe 2236 2236 2236 2236 2236 2236 1012 explorer.exe 1012 explorer.exe 2236 2236 816 explorer.exe 816 explorer.exe 2236 2236 480 explorer.exe 480 explorer.exe 2236 2236 1388 explorer.exe 1388 explorer.exe 2236 2236 4332 explorer.exe 4332 explorer.exe 2236 2236 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 4332 explorer.exe 4332 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 2684 explorer.exe 4436 vudjeft -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 816 WMIC.exe Token: SeSecurityPrivilege 816 WMIC.exe Token: SeTakeOwnershipPrivilege 816 WMIC.exe Token: SeLoadDriverPrivilege 816 WMIC.exe Token: SeSystemProfilePrivilege 816 WMIC.exe Token: SeSystemtimePrivilege 816 WMIC.exe Token: SeProfSingleProcessPrivilege 816 WMIC.exe Token: SeIncBasePriorityPrivilege 816 WMIC.exe Token: SeCreatePagefilePrivilege 816 WMIC.exe Token: SeBackupPrivilege 816 WMIC.exe Token: SeRestorePrivilege 816 WMIC.exe Token: SeShutdownPrivilege 816 WMIC.exe Token: SeDebugPrivilege 816 WMIC.exe Token: SeSystemEnvironmentPrivilege 816 WMIC.exe Token: SeRemoteShutdownPrivilege 816 WMIC.exe Token: SeUndockPrivilege 816 WMIC.exe Token: SeManageVolumePrivilege 816 WMIC.exe Token: 33 816 WMIC.exe Token: 34 816 WMIC.exe Token: 35 816 WMIC.exe Token: 36 816 WMIC.exe Token: SeIncreaseQuotaPrivilege 816 WMIC.exe Token: SeSecurityPrivilege 816 WMIC.exe Token: SeTakeOwnershipPrivilege 816 WMIC.exe Token: SeLoadDriverPrivilege 816 WMIC.exe Token: SeSystemProfilePrivilege 816 WMIC.exe Token: SeSystemtimePrivilege 816 WMIC.exe Token: SeProfSingleProcessPrivilege 816 WMIC.exe Token: SeIncBasePriorityPrivilege 816 WMIC.exe Token: SeCreatePagefilePrivilege 816 WMIC.exe Token: SeBackupPrivilege 816 WMIC.exe Token: SeRestorePrivilege 816 WMIC.exe Token: SeShutdownPrivilege 816 WMIC.exe Token: SeDebugPrivilege 816 WMIC.exe Token: SeSystemEnvironmentPrivilege 816 WMIC.exe Token: SeRemoteShutdownPrivilege 816 WMIC.exe Token: SeUndockPrivilege 816 WMIC.exe Token: SeManageVolumePrivilege 816 WMIC.exe Token: 33 816 WMIC.exe Token: 34 816 WMIC.exe Token: 35 816 WMIC.exe Token: 36 816 WMIC.exe Token: SeIncreaseQuotaPrivilege 480 WMIC.exe Token: SeSecurityPrivilege 480 WMIC.exe Token: SeTakeOwnershipPrivilege 480 WMIC.exe Token: SeLoadDriverPrivilege 480 WMIC.exe Token: SeSystemProfilePrivilege 480 WMIC.exe Token: SeSystemtimePrivilege 480 WMIC.exe Token: SeProfSingleProcessPrivilege 480 WMIC.exe Token: SeIncBasePriorityPrivilege 480 WMIC.exe Token: SeCreatePagefilePrivilege 480 WMIC.exe Token: SeBackupPrivilege 480 WMIC.exe Token: SeRestorePrivilege 480 WMIC.exe Token: SeShutdownPrivilege 480 WMIC.exe Token: SeDebugPrivilege 480 WMIC.exe Token: SeSystemEnvironmentPrivilege 480 WMIC.exe Token: SeRemoteShutdownPrivilege 480 WMIC.exe Token: SeUndockPrivilege 480 WMIC.exe Token: SeManageVolumePrivilege 480 WMIC.exe Token: 33 480 WMIC.exe Token: 34 480 WMIC.exe Token: 35 480 WMIC.exe Token: 36 480 WMIC.exe Token: SeIncreaseQuotaPrivilege 480 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1996 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1996 iexplore.exe 1996 iexplore.exe 4284 IEXPLORE.EXE 4284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2236 wrote to memory of 588 2236 cmd.exe PID 2236 wrote to memory of 588 2236 cmd.exe PID 588 wrote to memory of 816 588 cmd.exe WMIC.exe PID 588 wrote to memory of 816 588 cmd.exe WMIC.exe PID 588 wrote to memory of 480 588 cmd.exe WMIC.exe PID 588 wrote to memory of 480 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1136 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1136 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1296 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1296 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1508 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1508 588 cmd.exe WMIC.exe PID 588 wrote to memory of 4220 588 cmd.exe WMIC.exe PID 588 wrote to memory of 4220 588 cmd.exe WMIC.exe PID 588 wrote to memory of 4956 588 cmd.exe WMIC.exe PID 588 wrote to memory of 4956 588 cmd.exe WMIC.exe PID 588 wrote to memory of 5040 588 cmd.exe WMIC.exe PID 588 wrote to memory of 5040 588 cmd.exe WMIC.exe PID 588 wrote to memory of 2692 588 cmd.exe WMIC.exe PID 588 wrote to memory of 2692 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1460 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1460 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1936 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1936 588 cmd.exe WMIC.exe PID 588 wrote to memory of 5088 588 cmd.exe WMIC.exe PID 588 wrote to memory of 5088 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1532 588 cmd.exe WMIC.exe PID 588 wrote to memory of 1532 588 cmd.exe WMIC.exe PID 588 wrote to memory of 4736 588 cmd.exe WMIC.exe PID 588 wrote to memory of 4736 588 cmd.exe WMIC.exe PID 588 wrote to memory of 4448 588 cmd.exe ipconfig.exe PID 588 wrote to memory of 4448 588 cmd.exe ipconfig.exe PID 588 wrote to memory of 4428 588 cmd.exe ROUTE.EXE PID 588 wrote to memory of 4428 588 cmd.exe ROUTE.EXE PID 588 wrote to memory of 4168 588 cmd.exe netsh.exe PID 588 wrote to memory of 4168 588 cmd.exe netsh.exe PID 588 wrote to memory of 4672 588 cmd.exe systeminfo.exe PID 588 wrote to memory of 4672 588 cmd.exe systeminfo.exe PID 588 wrote to memory of 4268 588 cmd.exe tasklist.exe PID 588 wrote to memory of 4268 588 cmd.exe tasklist.exe PID 588 wrote to memory of 3168 588 cmd.exe net.exe PID 588 wrote to memory of 3168 588 cmd.exe net.exe PID 3168 wrote to memory of 3832 3168 net.exe net1.exe PID 3168 wrote to memory of 3832 3168 net.exe net1.exe PID 588 wrote to memory of 3712 588 cmd.exe net.exe PID 588 wrote to memory of 3712 588 cmd.exe net.exe PID 3712 wrote to memory of 1200 3712 net.exe net1.exe PID 3712 wrote to memory of 1200 3712 net.exe net1.exe PID 588 wrote to memory of 688 588 cmd.exe net.exe PID 588 wrote to memory of 688 588 cmd.exe net.exe PID 688 wrote to memory of 716 688 net.exe net1.exe PID 688 wrote to memory of 716 688 net.exe net1.exe PID 588 wrote to memory of 2988 588 cmd.exe net.exe PID 588 wrote to memory of 2988 588 cmd.exe net.exe PID 2988 wrote to memory of 4280 2988 net.exe net1.exe PID 2988 wrote to memory of 4280 2988 net.exe net1.exe PID 588 wrote to memory of 4976 588 cmd.exe net.exe PID 588 wrote to memory of 4976 588 cmd.exe net.exe PID 588 wrote to memory of 4236 588 cmd.exe net.exe PID 588 wrote to memory of 4236 588 cmd.exe net.exe PID 4236 wrote to memory of 904 4236 net.exe net1.exe PID 4236 wrote to memory of 904 4236 net.exe net1.exe PID 588 wrote to memory of 3860 588 cmd.exe net.exe PID 588 wrote to memory of 3860 588 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3840 -s 9242⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe"C:\Users\Admin\AppData\Local\Temp\e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\vudjeftC:\Users\Admin\AppData\Roaming\vudjeft1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\vudjeftMD5
0e314e38d19179ead2e608867588bc50
SHA1e76f626f2898fdef4008fcaa961175767a5b03c2
SHA256e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b
SHA512a1d5fb57e5594c45b6433048055ae4205f0795b95f759fef1cf8179134600b45bd33ae205db2cb8c4addb1fe5360522527169818a7549a8519e5ff2ba301dea8
-
C:\Users\Admin\AppData\Roaming\vudjeftMD5
0e314e38d19179ead2e608867588bc50
SHA1e76f626f2898fdef4008fcaa961175767a5b03c2
SHA256e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b
SHA512a1d5fb57e5594c45b6433048055ae4205f0795b95f759fef1cf8179134600b45bd33ae205db2cb8c4addb1fe5360522527169818a7549a8519e5ff2ba301dea8
-
memory/480-127-0x0000000000000000-mapping.dmp
-
memory/480-238-0x0000000000D50000-0x0000000000D59000-memory.dmpFilesize
36KB
-
memory/480-237-0x0000000000D60000-0x0000000000D65000-memory.dmpFilesize
20KB
-
memory/480-236-0x0000000000000000-mapping.dmp
-
memory/588-124-0x0000000000000000-mapping.dmp
-
memory/688-151-0x0000000000000000-mapping.dmp
-
memory/716-152-0x0000000000000000-mapping.dmp
-
memory/816-233-0x0000000000D60000-0x0000000000D69000-memory.dmpFilesize
36KB
-
memory/816-232-0x0000000000000000-mapping.dmp
-
memory/816-126-0x0000000000000000-mapping.dmp
-
memory/816-234-0x0000000000D50000-0x0000000000D5E000-memory.dmpFilesize
56KB
-
memory/904-157-0x0000000000000000-mapping.dmp
-
memory/1012-229-0x0000000000000000-mapping.dmp
-
memory/1012-231-0x0000000000B90000-0x0000000000B9B000-memory.dmpFilesize
44KB
-
memory/1012-230-0x0000000000BA0000-0x0000000000BA7000-memory.dmpFilesize
28KB
-
memory/1136-128-0x0000000000000000-mapping.dmp
-
memory/1200-150-0x0000000000000000-mapping.dmp
-
memory/1296-129-0x0000000000000000-mapping.dmp
-
memory/1360-162-0x0000000000000000-mapping.dmp
-
memory/1388-241-0x00000000008A0000-0x00000000008AC000-memory.dmpFilesize
48KB
-
memory/1388-239-0x0000000000000000-mapping.dmp
-
memory/1388-240-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/1444-163-0x0000000000000000-mapping.dmp
-
memory/1460-137-0x0000000000000000-mapping.dmp
-
memory/1484-164-0x0000000000000000-mapping.dmp
-
memory/1508-130-0x0000000000000000-mapping.dmp
-
memory/1532-140-0x0000000000000000-mapping.dmp
-
memory/1820-132-0x00000241636E0000-0x00000241636E2000-memory.dmpFilesize
8KB
-
memory/1820-131-0x00000241636E0000-0x00000241636E2000-memory.dmpFilesize
8KB
-
memory/1936-138-0x0000000000000000-mapping.dmp
-
memory/1996-182-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-211-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-264-0x000001A435900000-0x000001A435901000-memory.dmpFilesize
4KB
-
memory/1996-261-0x000001A4379F0000-0x000001A4379F1000-memory.dmpFilesize
4KB
-
memory/1996-259-0x000001A4379F0000-0x000001A4379F1000-memory.dmpFilesize
4KB
-
memory/1996-242-0x000001A437940000-0x000001A437941000-memory.dmpFilesize
4KB
-
memory/1996-192-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-235-0x000001A4358F0000-0x000001A4358F1000-memory.dmpFilesize
4KB
-
memory/1996-220-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-218-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-217-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-216-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-215-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-214-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-213-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-212-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-210-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-206-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-205-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-170-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-171-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-172-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-174-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-175-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-176-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-177-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-179-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-178-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-180-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-193-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-183-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-184-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-186-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-187-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-188-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-190-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-191-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-204-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-202-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-200-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-196-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-197-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/1996-199-0x00007FFAEAE90000-0x00007FFAEAEFB000-memory.dmpFilesize
428KB
-
memory/2088-165-0x0000000000000000-mapping.dmp
-
memory/2236-125-0x0000000000DA0000-0x0000000000DAF000-memory.dmpFilesize
60KB
-
memory/2236-122-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/2236-169-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/2236-168-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/2236-166-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/2236-121-0x0000000000D20000-0x0000000000D36000-memory.dmpFilesize
88KB
-
memory/2236-263-0x0000000002B00000-0x0000000002B16000-memory.dmpFilesize
88KB
-
memory/2236-123-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/2280-160-0x0000000000000000-mapping.dmp
-
memory/2408-249-0x000002B27A2E0000-0x000002B27A2E1000-memory.dmpFilesize
4KB
-
memory/2420-250-0x00000118A0EF0000-0x00000118A0EF1000-memory.dmpFilesize
4KB
-
memory/2684-248-0x0000000001010000-0x000000000101D000-memory.dmpFilesize
52KB
-
memory/2684-247-0x0000000001020000-0x0000000001027000-memory.dmpFilesize
28KB
-
memory/2684-246-0x0000000000000000-mapping.dmp
-
memory/2692-136-0x0000000000000000-mapping.dmp
-
memory/2744-251-0x0000019D507F0000-0x0000019D507F1000-memory.dmpFilesize
4KB
-
memory/2988-153-0x0000000000000000-mapping.dmp
-
memory/3092-120-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/3092-118-0x0000000002C20000-0x0000000002CCE000-memory.dmpFilesize
696KB
-
memory/3092-119-0x0000000002C20000-0x0000000002CCE000-memory.dmpFilesize
696KB
-
memory/3168-147-0x0000000000000000-mapping.dmp
-
memory/3556-226-0x0000000000000000-mapping.dmp
-
memory/3556-228-0x0000000000A80000-0x0000000000A8C000-memory.dmpFilesize
48KB
-
memory/3556-227-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/3580-254-0x000001C3A48D0000-0x000001C3A48D1000-memory.dmpFilesize
4KB
-
memory/3712-149-0x0000000000000000-mapping.dmp
-
memory/3792-161-0x0000000000000000-mapping.dmp
-
memory/3832-148-0x0000000000000000-mapping.dmp
-
memory/3860-158-0x0000000000000000-mapping.dmp
-
memory/4168-144-0x0000000000000000-mapping.dmp
-
memory/4192-262-0x000002E93CEC0000-0x000002E93CEC1000-memory.dmpFilesize
4KB
-
memory/4220-133-0x0000000000000000-mapping.dmp
-
memory/4236-156-0x0000000000000000-mapping.dmp
-
memory/4268-146-0x0000000000000000-mapping.dmp
-
memory/4280-154-0x0000000000000000-mapping.dmp
-
memory/4284-195-0x0000000000000000-mapping.dmp
-
memory/4332-243-0x0000000000000000-mapping.dmp
-
memory/4332-244-0x0000000001230000-0x0000000001236000-memory.dmpFilesize
24KB
-
memory/4332-245-0x0000000001220000-0x000000000122B000-memory.dmpFilesize
44KB
-
memory/4364-224-0x0000000000E00000-0x0000000000E75000-memory.dmpFilesize
468KB
-
memory/4364-225-0x0000000000B50000-0x0000000000BBB000-memory.dmpFilesize
428KB
-
memory/4364-219-0x0000000000000000-mapping.dmp
-
memory/4428-143-0x0000000000000000-mapping.dmp
-
memory/4436-260-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/4436-256-0x0000000002BE0000-0x0000000002BE9000-memory.dmpFilesize
36KB
-
memory/4436-255-0x0000000002BD0000-0x0000000002BD8000-memory.dmpFilesize
32KB
-
memory/4436-257-0x0000000002C10000-0x0000000002D5A000-memory.dmpFilesize
1.3MB
-
memory/4436-258-0x0000000002BF0000-0x0000000002BFB000-memory.dmpFilesize
44KB
-
memory/4448-142-0x0000000000000000-mapping.dmp
-
memory/4656-159-0x0000000000000000-mapping.dmp
-
memory/4672-145-0x0000000000000000-mapping.dmp
-
memory/4736-141-0x0000000000000000-mapping.dmp
-
memory/4956-134-0x0000000000000000-mapping.dmp
-
memory/4976-155-0x0000000000000000-mapping.dmp
-
memory/5040-135-0x0000000000000000-mapping.dmp
-
memory/5088-139-0x0000000000000000-mapping.dmp