Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
03-12-2021 03:37
Static task
static1
Behavioral task
behavioral1
Sample
6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe
Resource
win10-en-20211104
General
-
Target
6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe
-
Size
317KB
-
MD5
2e5b15e012f28b4405fd9ecdbfd0cb98
-
SHA1
bd733a45bdc3d32310a42e9ae2070b2f2bb9ccc2
-
SHA256
6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7
-
SHA512
7efbd90efd1c9ffc5c50e8a1079eecb7e546388f0cdeed25bc4be54bfcf2556d1aff8a078a4a58c0f1afb74dfa34e795435b2c4e8ac2e080bcdf2e1f0bd77bc1
Malware Config
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3500 3720 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exeNETSTAT.EXENETSTAT.EXEpid process 3984 ipconfig.exe 2168 ipconfig.exe 2988 NETSTAT.EXE 3008 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D903C10-401F-11EC-B34F-5A01924EA3B9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exepid process 1872 6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe 1872 6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3028 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1872 6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe 3028 3028 3028 3028 3028 3028 2372 explorer.exe 2372 explorer.exe 3028 3028 1404 explorer.exe 1404 explorer.exe 3028 3028 2084 explorer.exe 2084 explorer.exe 3028 3028 2136 explorer.exe 2136 explorer.exe 3028 3028 2092 explorer.exe 2092 explorer.exe 3028 3028 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe 2160 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1992 WMIC.exe Token: SeSecurityPrivilege 1992 WMIC.exe Token: SeTakeOwnershipPrivilege 1992 WMIC.exe Token: SeLoadDriverPrivilege 1992 WMIC.exe Token: SeSystemProfilePrivilege 1992 WMIC.exe Token: SeSystemtimePrivilege 1992 WMIC.exe Token: SeProfSingleProcessPrivilege 1992 WMIC.exe Token: SeIncBasePriorityPrivilege 1992 WMIC.exe Token: SeCreatePagefilePrivilege 1992 WMIC.exe Token: SeBackupPrivilege 1992 WMIC.exe Token: SeRestorePrivilege 1992 WMIC.exe Token: SeShutdownPrivilege 1992 WMIC.exe Token: SeDebugPrivilege 1992 WMIC.exe Token: SeSystemEnvironmentPrivilege 1992 WMIC.exe Token: SeRemoteShutdownPrivilege 1992 WMIC.exe Token: SeUndockPrivilege 1992 WMIC.exe Token: SeManageVolumePrivilege 1992 WMIC.exe Token: 33 1992 WMIC.exe Token: 34 1992 WMIC.exe Token: 35 1992 WMIC.exe Token: 36 1992 WMIC.exe Token: SeIncreaseQuotaPrivilege 1992 WMIC.exe Token: SeSecurityPrivilege 1992 WMIC.exe Token: SeTakeOwnershipPrivilege 1992 WMIC.exe Token: SeLoadDriverPrivilege 1992 WMIC.exe Token: SeSystemProfilePrivilege 1992 WMIC.exe Token: SeSystemtimePrivilege 1992 WMIC.exe Token: SeProfSingleProcessPrivilege 1992 WMIC.exe Token: SeIncBasePriorityPrivilege 1992 WMIC.exe Token: SeCreatePagefilePrivilege 1992 WMIC.exe Token: SeBackupPrivilege 1992 WMIC.exe Token: SeRestorePrivilege 1992 WMIC.exe Token: SeShutdownPrivilege 1992 WMIC.exe Token: SeDebugPrivilege 1992 WMIC.exe Token: SeSystemEnvironmentPrivilege 1992 WMIC.exe Token: SeRemoteShutdownPrivilege 1992 WMIC.exe Token: SeUndockPrivilege 1992 WMIC.exe Token: SeManageVolumePrivilege 1992 WMIC.exe Token: 33 1992 WMIC.exe Token: 34 1992 WMIC.exe Token: 35 1992 WMIC.exe Token: 36 1992 WMIC.exe Token: SeIncreaseQuotaPrivilege 368 WMIC.exe Token: SeSecurityPrivilege 368 WMIC.exe Token: SeTakeOwnershipPrivilege 368 WMIC.exe Token: SeLoadDriverPrivilege 368 WMIC.exe Token: SeSystemProfilePrivilege 368 WMIC.exe Token: SeSystemtimePrivilege 368 WMIC.exe Token: SeProfSingleProcessPrivilege 368 WMIC.exe Token: SeIncBasePriorityPrivilege 368 WMIC.exe Token: SeCreatePagefilePrivilege 368 WMIC.exe Token: SeBackupPrivilege 368 WMIC.exe Token: SeRestorePrivilege 368 WMIC.exe Token: SeShutdownPrivilege 368 WMIC.exe Token: SeDebugPrivilege 368 WMIC.exe Token: SeSystemEnvironmentPrivilege 368 WMIC.exe Token: SeRemoteShutdownPrivilege 368 WMIC.exe Token: SeUndockPrivilege 368 WMIC.exe Token: SeManageVolumePrivilege 368 WMIC.exe Token: 33 368 WMIC.exe Token: 34 368 WMIC.exe Token: 35 368 WMIC.exe Token: 36 368 WMIC.exe Token: SeIncreaseQuotaPrivilege 368 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2876 iexplore.exe 2876 iexplore.exe 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3028 wrote to memory of 1760 3028 cmd.exe PID 3028 wrote to memory of 1760 3028 cmd.exe PID 1760 wrote to memory of 1992 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 1992 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 368 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 368 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2700 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2700 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2420 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2420 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3196 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3196 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2440 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2440 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2892 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2892 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3280 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3280 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3760 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3760 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3468 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3468 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2412 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2412 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3604 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3604 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 1740 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 1740 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3628 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 3628 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2168 1760 cmd.exe ipconfig.exe PID 1760 wrote to memory of 2168 1760 cmd.exe ipconfig.exe PID 1760 wrote to memory of 1552 1760 cmd.exe ROUTE.EXE PID 1760 wrote to memory of 1552 1760 cmd.exe ROUTE.EXE PID 1760 wrote to memory of 3820 1760 cmd.exe netsh.exe PID 1760 wrote to memory of 3820 1760 cmd.exe netsh.exe PID 1760 wrote to memory of 2228 1760 cmd.exe systeminfo.exe PID 1760 wrote to memory of 2228 1760 cmd.exe systeminfo.exe PID 1760 wrote to memory of 3944 1760 cmd.exe tasklist.exe PID 1760 wrote to memory of 3944 1760 cmd.exe tasklist.exe PID 1760 wrote to memory of 396 1760 cmd.exe net.exe PID 1760 wrote to memory of 396 1760 cmd.exe net.exe PID 396 wrote to memory of 1284 396 net.exe net1.exe PID 396 wrote to memory of 1284 396 net.exe net1.exe PID 1760 wrote to memory of 1104 1760 cmd.exe net.exe PID 1760 wrote to memory of 1104 1760 cmd.exe net.exe PID 1104 wrote to memory of 1992 1104 net.exe net1.exe PID 1104 wrote to memory of 1992 1104 net.exe net1.exe PID 1760 wrote to memory of 1464 1760 cmd.exe net.exe PID 1760 wrote to memory of 1464 1760 cmd.exe net.exe PID 1464 wrote to memory of 3264 1464 net.exe net1.exe PID 1464 wrote to memory of 3264 1464 net.exe net1.exe PID 1760 wrote to memory of 4052 1760 cmd.exe net.exe PID 1760 wrote to memory of 4052 1760 cmd.exe net.exe PID 4052 wrote to memory of 940 4052 net.exe net1.exe PID 4052 wrote to memory of 940 4052 net.exe net1.exe PID 1760 wrote to memory of 1416 1760 cmd.exe net.exe PID 1760 wrote to memory of 1416 1760 cmd.exe net.exe PID 1760 wrote to memory of 1604 1760 cmd.exe net.exe PID 1760 wrote to memory of 1604 1760 cmd.exe net.exe PID 1604 wrote to memory of 1644 1604 net.exe net1.exe PID 1604 wrote to memory of 1644 1604 net.exe net1.exe PID 1760 wrote to memory of 1844 1760 cmd.exe net.exe PID 1760 wrote to memory of 1844 1760 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3720 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe"C:\Users\Admin\AppData\Local\Temp\6a852eb059d77d6eea58d73ea47eb0da3c93a78935576ca616c16abfdb717cb7.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/344-132-0x0000023AFDDD0000-0x0000023AFDDD2000-memory.dmpFilesize
8KB
-
memory/344-131-0x0000023AFDDD0000-0x0000023AFDDD2000-memory.dmpFilesize
8KB
-
memory/368-127-0x0000000000000000-mapping.dmp
-
memory/396-147-0x0000000000000000-mapping.dmp
-
memory/596-225-0x0000000001050000-0x00000000010BB000-memory.dmpFilesize
428KB
-
memory/596-224-0x0000000003540000-0x00000000035B5000-memory.dmpFilesize
468KB
-
memory/596-219-0x0000000000000000-mapping.dmp
-
memory/940-154-0x0000000000000000-mapping.dmp
-
memory/1088-228-0x0000000000490000-0x000000000049C000-memory.dmpFilesize
48KB
-
memory/1088-227-0x00000000004A0000-0x00000000004A7000-memory.dmpFilesize
28KB
-
memory/1088-226-0x0000000000000000-mapping.dmp
-
memory/1104-149-0x0000000000000000-mapping.dmp
-
memory/1284-148-0x0000000000000000-mapping.dmp
-
memory/1404-234-0x0000000000FF0000-0x0000000000FFE000-memory.dmpFilesize
56KB
-
memory/1404-233-0x0000000001200000-0x0000000001209000-memory.dmpFilesize
36KB
-
memory/1404-232-0x0000000000000000-mapping.dmp
-
memory/1416-155-0x0000000000000000-mapping.dmp
-
memory/1464-151-0x0000000000000000-mapping.dmp
-
memory/1552-143-0x0000000000000000-mapping.dmp
-
memory/1604-156-0x0000000000000000-mapping.dmp
-
memory/1644-157-0x0000000000000000-mapping.dmp
-
memory/1720-159-0x0000000000000000-mapping.dmp
-
memory/1740-140-0x0000000000000000-mapping.dmp
-
memory/1760-125-0x0000000000000000-mapping.dmp
-
memory/1828-195-0x0000000000000000-mapping.dmp
-
memory/1844-158-0x0000000000000000-mapping.dmp
-
memory/1872-120-0x0000000000400000-0x00000000004D0000-memory.dmpFilesize
832KB
-
memory/1872-119-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1872-118-0x0000000000741000-0x0000000000752000-memory.dmpFilesize
68KB
-
memory/1992-126-0x0000000000000000-mapping.dmp
-
memory/1992-150-0x0000000000000000-mapping.dmp
-
memory/2084-237-0x0000000000180000-0x0000000000185000-memory.dmpFilesize
20KB
-
memory/2084-238-0x0000000000170000-0x0000000000179000-memory.dmpFilesize
36KB
-
memory/2084-236-0x0000000000000000-mapping.dmp
-
memory/2092-244-0x00000000003F0000-0x00000000003F6000-memory.dmpFilesize
24KB
-
memory/2092-245-0x00000000003E0000-0x00000000003EB000-memory.dmpFilesize
44KB
-
memory/2092-243-0x0000000000000000-mapping.dmp
-
memory/2124-161-0x0000000000000000-mapping.dmp
-
memory/2136-241-0x0000000000350000-0x000000000035C000-memory.dmpFilesize
48KB
-
memory/2136-240-0x0000000000360000-0x0000000000366000-memory.dmpFilesize
24KB
-
memory/2136-239-0x0000000000000000-mapping.dmp
-
memory/2160-247-0x0000000000760000-0x0000000000767000-memory.dmpFilesize
28KB
-
memory/2160-246-0x0000000000000000-mapping.dmp
-
memory/2160-248-0x0000000000750000-0x000000000075D000-memory.dmpFilesize
52KB
-
memory/2168-142-0x0000000000000000-mapping.dmp
-
memory/2228-145-0x0000000000000000-mapping.dmp
-
memory/2328-249-0x000001A93F970000-0x000001A93F971000-memory.dmpFilesize
4KB
-
memory/2336-250-0x0000024ADA110000-0x0000024ADA111000-memory.dmpFilesize
4KB
-
memory/2372-231-0x0000000000790000-0x000000000079B000-memory.dmpFilesize
44KB
-
memory/2372-230-0x00000000007A0000-0x00000000007A7000-memory.dmpFilesize
28KB
-
memory/2372-229-0x0000000000000000-mapping.dmp
-
memory/2412-138-0x0000000000000000-mapping.dmp
-
memory/2420-129-0x0000000000000000-mapping.dmp
-
memory/2440-133-0x0000000000000000-mapping.dmp
-
memory/2460-251-0x0000022232A40000-0x0000022232A41000-memory.dmpFilesize
4KB
-
memory/2700-128-0x0000000000000000-mapping.dmp
-
memory/2876-171-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-220-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-178-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-179-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-180-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-182-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-183-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-184-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-186-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-187-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-216-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-176-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-175-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-192-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-193-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-256-0x000001BC8BF40000-0x000001BC8BF41000-memory.dmpFilesize
4KB
-
memory/2876-196-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-197-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-199-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-200-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-202-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-204-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-205-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-206-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-210-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-211-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-212-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-213-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-214-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-215-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-188-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-217-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-218-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-254-0x000001BC8E030000-0x000001BC8E031000-memory.dmpFilesize
4KB
-
memory/2876-177-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-253-0x000001BC8E030000-0x000001BC8E031000-memory.dmpFilesize
4KB
-
memory/2876-190-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-191-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-174-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-242-0x000001BC8DF80000-0x000001BC8DF81000-memory.dmpFilesize
4KB
-
memory/2876-172-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-170-0x00007FFB85D90000-0x00007FFB85DFB000-memory.dmpFilesize
428KB
-
memory/2876-235-0x000001BC8BF30000-0x000001BC8BF31000-memory.dmpFilesize
4KB
-
memory/2892-134-0x0000000000000000-mapping.dmp
-
memory/2988-160-0x0000000000000000-mapping.dmp
-
memory/3008-163-0x0000000000000000-mapping.dmp
-
memory/3028-121-0x0000000000AD0000-0x0000000000AE6000-memory.dmpFilesize
88KB
-
memory/3028-124-0x00000000024A0000-0x00000000024AF000-memory.dmpFilesize
60KB
-
memory/3028-169-0x00000000024B0000-0x00000000024B2000-memory.dmpFilesize
8KB
-
memory/3028-166-0x00000000024B0000-0x00000000024B2000-memory.dmpFilesize
8KB
-
memory/3028-168-0x00000000024B0000-0x00000000024B2000-memory.dmpFilesize
8KB
-
memory/3028-123-0x00000000024B0000-0x00000000024B2000-memory.dmpFilesize
8KB
-
memory/3028-122-0x00000000024B0000-0x00000000024B2000-memory.dmpFilesize
8KB
-
memory/3196-130-0x0000000000000000-mapping.dmp
-
memory/3264-152-0x0000000000000000-mapping.dmp
-
memory/3280-135-0x0000000000000000-mapping.dmp
-
memory/3468-137-0x0000000000000000-mapping.dmp
-
memory/3480-252-0x0000017F987D0000-0x0000017F987D1000-memory.dmpFilesize
4KB
-
memory/3500-255-0x000001FD2C230000-0x000001FD2C231000-memory.dmpFilesize
4KB
-
memory/3548-162-0x0000000000000000-mapping.dmp
-
memory/3604-139-0x0000000000000000-mapping.dmp
-
memory/3628-141-0x0000000000000000-mapping.dmp
-
memory/3760-136-0x0000000000000000-mapping.dmp
-
memory/3820-144-0x0000000000000000-mapping.dmp
-
memory/3928-164-0x0000000000000000-mapping.dmp
-
memory/3944-146-0x0000000000000000-mapping.dmp
-
memory/3984-165-0x0000000000000000-mapping.dmp
-
memory/4052-153-0x0000000000000000-mapping.dmp