Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 21:22
Static task
static1
Behavioral task
behavioral1
Sample
4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe
Resource
win10-en-20211104
General
-
Target
4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe
-
Size
207KB
-
MD5
45bf57203a4ff9b9d978daa434a113a3
-
SHA1
09cf50fe8a3346a81352bf6d3463fbf84147e120
-
SHA256
4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a
-
SHA512
29559ba5362753bff8a86463ff51830b7c8e7bf7b95a4f1bc6661f12c094c4cfacb3313ee65d7a5f9da3a71971d00721984815beb6c2f4cb9b59411216720c57
Malware Config
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1384 3700 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 1788 ipconfig.exe 1764 NETSTAT.EXE 4012 NETSTAT.EXE 2964 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{938E3A9F-5611-11EC-B34F-F2D496D9C4B6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exepid process 3716 4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe 3716 4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3716 4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe 3064 3064 3064 3064 3064 3064 1448 explorer.exe 1448 explorer.exe 3064 3064 1284 explorer.exe 1284 explorer.exe 3064 3064 4024 explorer.exe 4024 explorer.exe 3064 3064 3572 explorer.exe 3572 explorer.exe 3064 3064 2692 explorer.exe 2692 explorer.exe 3064 3064 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 864 WMIC.exe Token: SeSecurityPrivilege 864 WMIC.exe Token: SeTakeOwnershipPrivilege 864 WMIC.exe Token: SeLoadDriverPrivilege 864 WMIC.exe Token: SeSystemProfilePrivilege 864 WMIC.exe Token: SeSystemtimePrivilege 864 WMIC.exe Token: SeProfSingleProcessPrivilege 864 WMIC.exe Token: SeIncBasePriorityPrivilege 864 WMIC.exe Token: SeCreatePagefilePrivilege 864 WMIC.exe Token: SeBackupPrivilege 864 WMIC.exe Token: SeRestorePrivilege 864 WMIC.exe Token: SeShutdownPrivilege 864 WMIC.exe Token: SeDebugPrivilege 864 WMIC.exe Token: SeSystemEnvironmentPrivilege 864 WMIC.exe Token: SeRemoteShutdownPrivilege 864 WMIC.exe Token: SeUndockPrivilege 864 WMIC.exe Token: SeManageVolumePrivilege 864 WMIC.exe Token: 33 864 WMIC.exe Token: 34 864 WMIC.exe Token: 35 864 WMIC.exe Token: 36 864 WMIC.exe Token: SeIncreaseQuotaPrivilege 864 WMIC.exe Token: SeSecurityPrivilege 864 WMIC.exe Token: SeTakeOwnershipPrivilege 864 WMIC.exe Token: SeLoadDriverPrivilege 864 WMIC.exe Token: SeSystemProfilePrivilege 864 WMIC.exe Token: SeSystemtimePrivilege 864 WMIC.exe Token: SeProfSingleProcessPrivilege 864 WMIC.exe Token: SeIncBasePriorityPrivilege 864 WMIC.exe Token: SeCreatePagefilePrivilege 864 WMIC.exe Token: SeBackupPrivilege 864 WMIC.exe Token: SeRestorePrivilege 864 WMIC.exe Token: SeShutdownPrivilege 864 WMIC.exe Token: SeDebugPrivilege 864 WMIC.exe Token: SeSystemEnvironmentPrivilege 864 WMIC.exe Token: SeRemoteShutdownPrivilege 864 WMIC.exe Token: SeUndockPrivilege 864 WMIC.exe Token: SeManageVolumePrivilege 864 WMIC.exe Token: 33 864 WMIC.exe Token: 34 864 WMIC.exe Token: 35 864 WMIC.exe Token: 36 864 WMIC.exe Token: SeIncreaseQuotaPrivilege 2568 WMIC.exe Token: SeSecurityPrivilege 2568 WMIC.exe Token: SeTakeOwnershipPrivilege 2568 WMIC.exe Token: SeLoadDriverPrivilege 2568 WMIC.exe Token: SeSystemProfilePrivilege 2568 WMIC.exe Token: SeSystemtimePrivilege 2568 WMIC.exe Token: SeProfSingleProcessPrivilege 2568 WMIC.exe Token: SeIncBasePriorityPrivilege 2568 WMIC.exe Token: SeCreatePagefilePrivilege 2568 WMIC.exe Token: SeBackupPrivilege 2568 WMIC.exe Token: SeRestorePrivilege 2568 WMIC.exe Token: SeShutdownPrivilege 2568 WMIC.exe Token: SeDebugPrivilege 2568 WMIC.exe Token: SeSystemEnvironmentPrivilege 2568 WMIC.exe Token: SeRemoteShutdownPrivilege 2568 WMIC.exe Token: SeUndockPrivilege 2568 WMIC.exe Token: SeManageVolumePrivilege 2568 WMIC.exe Token: 33 2568 WMIC.exe Token: 34 2568 WMIC.exe Token: 35 2568 WMIC.exe Token: 36 2568 WMIC.exe Token: SeIncreaseQuotaPrivilege 2568 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1348 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1348 iexplore.exe 1348 iexplore.exe 3604 IEXPLORE.EXE 3604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3064 wrote to memory of 3564 3064 cmd.exe PID 3064 wrote to memory of 3564 3064 cmd.exe PID 3564 wrote to memory of 864 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 864 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 2568 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 2568 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 1924 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 1924 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 1224 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 1224 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 396 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 396 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3000 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3000 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 2856 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 2856 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3508 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3508 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 964 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 964 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 2112 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 2112 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 2176 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 2176 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3464 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3464 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3300 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3300 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3640 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 3640 3564 cmd.exe WMIC.exe PID 3564 wrote to memory of 1788 3564 cmd.exe ipconfig.exe PID 3564 wrote to memory of 1788 3564 cmd.exe ipconfig.exe PID 3564 wrote to memory of 2704 3564 cmd.exe ROUTE.EXE PID 3564 wrote to memory of 2704 3564 cmd.exe ROUTE.EXE PID 3564 wrote to memory of 3588 3564 cmd.exe netsh.exe PID 3564 wrote to memory of 3588 3564 cmd.exe netsh.exe PID 3564 wrote to memory of 1932 3564 cmd.exe systeminfo.exe PID 3564 wrote to memory of 1932 3564 cmd.exe systeminfo.exe PID 3564 wrote to memory of 2568 3564 cmd.exe tasklist.exe PID 3564 wrote to memory of 2568 3564 cmd.exe tasklist.exe PID 3564 wrote to memory of 724 3564 cmd.exe net.exe PID 3564 wrote to memory of 724 3564 cmd.exe net.exe PID 724 wrote to memory of 3572 724 net.exe net1.exe PID 724 wrote to memory of 3572 724 net.exe net1.exe PID 3564 wrote to memory of 1300 3564 cmd.exe net.exe PID 3564 wrote to memory of 1300 3564 cmd.exe net.exe PID 1300 wrote to memory of 3500 1300 net.exe net1.exe PID 1300 wrote to memory of 3500 1300 net.exe net1.exe PID 3564 wrote to memory of 2400 3564 cmd.exe net.exe PID 3564 wrote to memory of 2400 3564 cmd.exe net.exe PID 2400 wrote to memory of 2084 2400 net.exe net1.exe PID 2400 wrote to memory of 2084 2400 net.exe net1.exe PID 3564 wrote to memory of 1740 3564 cmd.exe net.exe PID 3564 wrote to memory of 1740 3564 cmd.exe net.exe PID 1740 wrote to memory of 1944 1740 net.exe net1.exe PID 1740 wrote to memory of 1944 1740 net.exe net1.exe PID 3564 wrote to memory of 1980 3564 cmd.exe net.exe PID 3564 wrote to memory of 1980 3564 cmd.exe net.exe PID 3564 wrote to memory of 2008 3564 cmd.exe net.exe PID 3564 wrote to memory of 2008 3564 cmd.exe net.exe PID 2008 wrote to memory of 2080 2008 net.exe net1.exe PID 2008 wrote to memory of 2080 2008 net.exe net1.exe PID 3564 wrote to memory of 2260 3564 cmd.exe net.exe PID 3564 wrote to memory of 2260 3564 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3700 -s 9042⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe"C:\Users\Admin\AppData\Local\Temp\4a9debade8c695bd6094e7c48aae7dac597422d14a9feda9a729355c20954c0a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1348 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-130-0x0000000000000000-mapping.dmp
-
memory/396-161-0x0000000000000000-mapping.dmp
-
memory/724-147-0x0000000000000000-mapping.dmp
-
memory/864-126-0x0000000000000000-mapping.dmp
-
memory/964-136-0x0000000000000000-mapping.dmp
-
memory/1008-226-0x0000000000000000-mapping.dmp
-
memory/1008-228-0x0000000000820000-0x000000000082C000-memory.dmpFilesize
48KB
-
memory/1008-227-0x0000000000830000-0x0000000000837000-memory.dmpFilesize
28KB
-
memory/1060-162-0x0000000000000000-mapping.dmp
-
memory/1224-129-0x0000000000000000-mapping.dmp
-
memory/1284-232-0x0000000000000000-mapping.dmp
-
memory/1284-233-0x00000000005D0000-0x00000000005D9000-memory.dmpFilesize
36KB
-
memory/1284-234-0x00000000005C0000-0x00000000005CE000-memory.dmpFilesize
56KB
-
memory/1300-149-0x0000000000000000-mapping.dmp
-
memory/1348-183-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-180-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-256-0x000001D237740000-0x000001D237741000-memory.dmpFilesize
4KB
-
memory/1348-204-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-254-0x000001D239830000-0x000001D239831000-memory.dmpFilesize
4KB
-
memory/1348-202-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-200-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-253-0x000001D239830000-0x000001D239831000-memory.dmpFilesize
4KB
-
memory/1348-192-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-199-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-197-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-196-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-191-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-206-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-193-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-210-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-242-0x000001D239780000-0x000001D239781000-memory.dmpFilesize
4KB
-
memory/1348-211-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-235-0x000001D237730000-0x000001D237731000-memory.dmpFilesize
4KB
-
memory/1348-212-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-190-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-189-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-187-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-186-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-184-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-213-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-182-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-205-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-179-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-178-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-177-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-220-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-218-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-217-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-216-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-215-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-214-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-170-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-171-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-172-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-174-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-175-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1348-176-0x00007FF9B7290000-0x00007FF9B72FB000-memory.dmpFilesize
428KB
-
memory/1384-255-0x00000235800B0000-0x00000235800B1000-memory.dmpFilesize
4KB
-
memory/1448-231-0x0000000002800000-0x000000000280B000-memory.dmpFilesize
44KB
-
memory/1448-229-0x0000000000000000-mapping.dmp
-
memory/1448-230-0x0000000002810000-0x0000000002817000-memory.dmpFilesize
28KB
-
memory/1740-153-0x0000000000000000-mapping.dmp
-
memory/1764-160-0x0000000000000000-mapping.dmp
-
memory/1788-142-0x0000000000000000-mapping.dmp
-
memory/1924-128-0x0000000000000000-mapping.dmp
-
memory/1932-145-0x0000000000000000-mapping.dmp
-
memory/1944-154-0x0000000000000000-mapping.dmp
-
memory/1980-155-0x0000000000000000-mapping.dmp
-
memory/2008-156-0x0000000000000000-mapping.dmp
-
memory/2080-157-0x0000000000000000-mapping.dmp
-
memory/2084-152-0x0000000000000000-mapping.dmp
-
memory/2112-137-0x0000000000000000-mapping.dmp
-
memory/2176-138-0x0000000000000000-mapping.dmp
-
memory/2260-158-0x0000000000000000-mapping.dmp
-
memory/2400-151-0x0000000000000000-mapping.dmp
-
memory/2448-246-0x0000000000000000-mapping.dmp
-
memory/2448-247-0x00000000008D0000-0x00000000008D7000-memory.dmpFilesize
28KB
-
memory/2448-248-0x00000000008C0000-0x00000000008CD000-memory.dmpFilesize
52KB
-
memory/2568-127-0x0000000000000000-mapping.dmp
-
memory/2568-146-0x0000000000000000-mapping.dmp
-
memory/2648-249-0x00000194C24B0000-0x00000194C24B1000-memory.dmpFilesize
4KB
-
memory/2672-250-0x000001FEB5270000-0x000001FEB5271000-memory.dmpFilesize
4KB
-
memory/2692-244-0x0000000002810000-0x0000000002816000-memory.dmpFilesize
24KB
-
memory/2692-245-0x0000000002800000-0x000000000280B000-memory.dmpFilesize
44KB
-
memory/2692-243-0x0000000000000000-mapping.dmp
-
memory/2704-143-0x0000000000000000-mapping.dmp
-
memory/2740-219-0x0000000000000000-mapping.dmp
-
memory/2740-225-0x0000000002800000-0x000000000286B000-memory.dmpFilesize
428KB
-
memory/2740-224-0x0000000002870000-0x00000000028E5000-memory.dmpFilesize
468KB
-
memory/2856-134-0x0000000000000000-mapping.dmp
-
memory/2896-251-0x000002A398DB0000-0x000002A398DB1000-memory.dmpFilesize
4KB
-
memory/2964-165-0x0000000000000000-mapping.dmp
-
memory/3000-133-0x0000000000000000-mapping.dmp
-
memory/3064-166-0x00000000011D0000-0x00000000011D2000-memory.dmpFilesize
8KB
-
memory/3064-122-0x00000000011D0000-0x00000000011D2000-memory.dmpFilesize
8KB
-
memory/3064-123-0x00000000011D0000-0x00000000011D2000-memory.dmpFilesize
8KB
-
memory/3064-124-0x00000000011C0000-0x00000000011CF000-memory.dmpFilesize
60KB
-
memory/3064-168-0x00000000011D0000-0x00000000011D2000-memory.dmpFilesize
8KB
-
memory/3064-169-0x00000000011D0000-0x00000000011D2000-memory.dmpFilesize
8KB
-
memory/3064-121-0x0000000000F00000-0x0000000000F16000-memory.dmpFilesize
88KB
-
memory/3144-131-0x0000016DEE590000-0x0000016DEE592000-memory.dmpFilesize
8KB
-
memory/3144-132-0x0000016DEE590000-0x0000016DEE592000-memory.dmpFilesize
8KB
-
memory/3300-140-0x0000000000000000-mapping.dmp
-
memory/3424-252-0x000001BFE91B0000-0x000001BFE91B1000-memory.dmpFilesize
4KB
-
memory/3464-139-0x0000000000000000-mapping.dmp
-
memory/3500-150-0x0000000000000000-mapping.dmp
-
memory/3508-135-0x0000000000000000-mapping.dmp
-
memory/3564-125-0x0000000000000000-mapping.dmp
-
memory/3572-241-0x0000000000960000-0x000000000096C000-memory.dmpFilesize
48KB
-
memory/3572-240-0x0000000000970000-0x0000000000976000-memory.dmpFilesize
24KB
-
memory/3572-148-0x0000000000000000-mapping.dmp
-
memory/3572-239-0x0000000000000000-mapping.dmp
-
memory/3588-144-0x0000000000000000-mapping.dmp
-
memory/3604-195-0x0000000000000000-mapping.dmp
-
memory/3640-141-0x0000000000000000-mapping.dmp
-
memory/3716-118-0x0000000002DE0000-0x0000000002DE8000-memory.dmpFilesize
32KB
-
memory/3716-120-0x0000000000400000-0x0000000002B6D000-memory.dmpFilesize
39.4MB
-
memory/3716-119-0x0000000002DF0000-0x0000000002DF9000-memory.dmpFilesize
36KB
-
memory/4012-163-0x0000000000000000-mapping.dmp
-
memory/4024-238-0x0000000002A60000-0x0000000002A69000-memory.dmpFilesize
36KB
-
memory/4024-237-0x0000000002A70000-0x0000000002A75000-memory.dmpFilesize
20KB
-
memory/4024-236-0x0000000000000000-mapping.dmp
-
memory/4044-159-0x0000000000000000-mapping.dmp
-
memory/4064-164-0x0000000000000000-mapping.dmp