cryptbot | d7446941b5aa39ddc27d10fe643a54f80aafb2abaf07e0ab54cefdb72403fed4

Analysis

max time kernel
151s
max time network
138s
platform
windows10_x64
resource
win10-en-20211104
submitted
05/12/2021, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72fd6124a1dbe632a397560ace2d813b.exe
Size 272KB
Sample211205-gpdpkscaen
SHA256 d7446941b5aa39ddc27d10fe643a54f80aafb2abaf07e0ab54cefdb72403fed4
MD5 72fd6124a1dbe632a397560ace2d813b
SHA1 86b28e7d6e45f01184afb1b3656a9b985c4ed1d6
SHA512 6a8b29aa37a139644de6ce93c7f7495c362f1069f503e286f24857582df75469ed1e5737adddb6be2f9c5edf09146e6e2245fe91796a70cfbe3e231d69c1a84f
MD5 SHA1 SHA512

Score

10^/10

cryptbot redline smokeloader backdoor collection discovery evasion infostealer spyware stealer suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php

rc4.i32

Extracted

Family

redline

195.133.47.114:38622

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ac05-140.dat	family_redline
behavioral2/files/0x000500000001ac05-141.dat	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 824 created 2300	824	WerFault.exe	99

suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata
Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
368	5F33.exe
4092	9509.exe
3916	C3EA.exe
1672	safsuja
2300	avfsuja
2372	4197.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Deletes itself 1 IoCs

pid	Process
3060	Process not Found

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
824	2300	WerFault.exe	99
3696	3760	WerFault.exe	41

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	72fd6124a1dbe632a397560ace2d813b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5F33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	safsuja
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	safsuja
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	safsuja
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	72fd6124a1dbe632a397560ace2d813b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	72fd6124a1dbe632a397560ace2d813b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5F33.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5F33.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4197.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9509.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9509.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4197.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1056	timeout.exe
3776	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1400	tasklist.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1524	ipconfig.exe
2208	NETSTAT.EXE
1376	NETSTAT.EXE
1752	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2196	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99A0C24F-5590-11EC-B34F-56EEF542141B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3200	72fd6124a1dbe632a397560ace2d813b.exe
3200	72fd6124a1dbe632a397560ace2d813b.exe
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3060	Process not Found

Suspicious behavior: MapViewOfSection 57 IoCs

pid	Process
3200	72fd6124a1dbe632a397560ace2d813b.exe
368	5F33.exe
1672	safsuja
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3516	explorer.exe
3516	explorer.exe
3060	Process not Found
3060	Process not Found
904	explorer.exe
904	explorer.exe
3060	Process not Found
3060	Process not Found
2980	explorer.exe
2980	explorer.exe
3060	Process not Found
3060	Process not Found
2792	explorer.exe
2792	explorer.exe
3060	Process not Found
3060	Process not Found
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
3060	Process not Found
3060	Process not Found
2804	explorer.exe
2804	explorer.exe
2284	explorer.exe
2284	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2284	explorer.exe
2284	explorer.exe
2804	explorer.exe
2804	explorer.exe
2284	explorer.exe
2284	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3060	Process not Found
Token: SeCreatePagefilePrivilege	3060	Process not Found
Token: SeShutdownPrivilege	3060	Process not Found
Token: SeCreatePagefilePrivilege	3060	Process not Found
Token: SeIncreaseQuotaPrivilege	900	WMIC.exe
Token: SeSecurityPrivilege	900	WMIC.exe
Token: SeTakeOwnershipPrivilege	900	WMIC.exe
Token: SeLoadDriverPrivilege	900	WMIC.exe
Token: SeSystemProfilePrivilege	900	WMIC.exe
Token: SeSystemtimePrivilege	900	WMIC.exe
Token: SeProfSingleProcessPrivilege	900	WMIC.exe
Token: SeIncBasePriorityPrivilege	900	WMIC.exe
Token: SeCreatePagefilePrivilege	900	WMIC.exe
Token: SeBackupPrivilege	900	WMIC.exe
Token: SeRestorePrivilege	900	WMIC.exe
Token: SeShutdownPrivilege	900	WMIC.exe
Token: SeDebugPrivilege	900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	900	WMIC.exe
Token: SeRemoteShutdownPrivilege	900	WMIC.exe
Token: SeUndockPrivilege	900	WMIC.exe
Token: SeManageVolumePrivilege	900	WMIC.exe
Token: 33	900	WMIC.exe
Token: 34	900	WMIC.exe
Token: 35	900	WMIC.exe
Token: 36	900	WMIC.exe
Token: SeIncreaseQuotaPrivilege	900	WMIC.exe
Token: SeSecurityPrivilege	900	WMIC.exe
Token: SeTakeOwnershipPrivilege	900	WMIC.exe
Token: SeLoadDriverPrivilege	900	WMIC.exe
Token: SeSystemProfilePrivilege	900	WMIC.exe
Token: SeSystemtimePrivilege	900	WMIC.exe
Token: SeProfSingleProcessPrivilege	900	WMIC.exe
Token: SeIncBasePriorityPrivilege	900	WMIC.exe
Token: SeCreatePagefilePrivilege	900	WMIC.exe
Token: SeBackupPrivilege	900	WMIC.exe
Token: SeRestorePrivilege	900	WMIC.exe
Token: SeShutdownPrivilege	900	WMIC.exe
Token: SeDebugPrivilege	900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	900	WMIC.exe
Token: SeRemoteShutdownPrivilege	900	WMIC.exe
Token: SeUndockPrivilege	900	WMIC.exe
Token: SeManageVolumePrivilege	900	WMIC.exe
Token: 33	900	WMIC.exe
Token: 34	900	WMIC.exe
Token: 35	900	WMIC.exe
Token: 36	900	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1312	WMIC.exe
Token: SeSecurityPrivilege	1312	WMIC.exe
Token: SeTakeOwnershipPrivilege	1312	WMIC.exe
Token: SeLoadDriverPrivilege	1312	WMIC.exe
Token: SeSystemProfilePrivilege	1312	WMIC.exe
Token: SeSystemtimePrivilege	1312	WMIC.exe
Token: SeProfSingleProcessPrivilege	1312	WMIC.exe
Token: SeIncBasePriorityPrivilege	1312	WMIC.exe
Token: SeCreatePagefilePrivilege	1312	WMIC.exe
Token: SeBackupPrivilege	1312	WMIC.exe
Token: SeRestorePrivilege	1312	WMIC.exe
Token: SeShutdownPrivilege	1312	WMIC.exe
Token: SeDebugPrivilege	1312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1312	WMIC.exe
Token: SeRemoteShutdownPrivilege	1312	WMIC.exe
Token: SeUndockPrivilege	1312	WMIC.exe
Token: SeManageVolumePrivilege	1312	WMIC.exe
Token: 33	1312	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2196	iexplore.exe
2196	iexplore.exe
4016	IEXPLORE.EXE
4016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 368	3060	Process not Found	69
PID 3060 wrote to memory of 368	3060	Process not Found	69
PID 3060 wrote to memory of 368	3060	Process not Found	69
PID 3060 wrote to memory of 4092	3060	Process not Found	70
PID 3060 wrote to memory of 4092	3060	Process not Found	70
PID 3060 wrote to memory of 4092	3060	Process not Found	70
PID 3060 wrote to memory of 2424	3060	Process not Found	73
PID 3060 wrote to memory of 2424	3060	Process not Found	73
PID 3060 wrote to memory of 3916	3060	Process not Found	75
PID 3060 wrote to memory of 3916	3060	Process not Found	75
PID 3060 wrote to memory of 3916	3060	Process not Found	75
PID 2424 wrote to memory of 900	2424	cmd.exe	76
PID 2424 wrote to memory of 900	2424	cmd.exe	76
PID 2424 wrote to memory of 1312	2424	cmd.exe	77
PID 2424 wrote to memory of 1312	2424	cmd.exe	77
PID 2424 wrote to memory of 1520	2424	cmd.exe	78
PID 2424 wrote to memory of 1520	2424	cmd.exe	78
PID 2424 wrote to memory of 1932	2424	cmd.exe	79
PID 2424 wrote to memory of 1932	2424	cmd.exe	79
PID 2424 wrote to memory of 1528	2424	cmd.exe	80
PID 2424 wrote to memory of 1528	2424	cmd.exe	80
PID 2424 wrote to memory of 4016	2424	cmd.exe	83
PID 2424 wrote to memory of 4016	2424	cmd.exe	83
PID 2424 wrote to memory of 2184	2424	cmd.exe	85
PID 2424 wrote to memory of 2184	2424	cmd.exe	85
PID 2424 wrote to memory of 1336	2424	cmd.exe	86
PID 2424 wrote to memory of 1336	2424	cmd.exe	86
PID 2424 wrote to memory of 3820	2424	cmd.exe	87
PID 2424 wrote to memory of 3820	2424	cmd.exe	87
PID 2424 wrote to memory of 2104	2424	cmd.exe	88
PID 2424 wrote to memory of 2104	2424	cmd.exe	88
PID 2424 wrote to memory of 992	2424	cmd.exe	89
PID 2424 wrote to memory of 992	2424	cmd.exe	89
PID 2424 wrote to memory of 2632	2424	cmd.exe	90
PID 2424 wrote to memory of 2632	2424	cmd.exe	90
PID 2424 wrote to memory of 3956	2424	cmd.exe	91
PID 2424 wrote to memory of 3956	2424	cmd.exe	91
PID 2424 wrote to memory of 1692	2424	cmd.exe	92
PID 2424 wrote to memory of 1692	2424	cmd.exe	92
PID 2424 wrote to memory of 1524	2424	cmd.exe	93
PID 2424 wrote to memory of 1524	2424	cmd.exe	93
PID 2424 wrote to memory of 912	2424	cmd.exe	94
PID 2424 wrote to memory of 912	2424	cmd.exe	94
PID 2424 wrote to memory of 828	2424	cmd.exe	95
PID 2424 wrote to memory of 828	2424	cmd.exe	95
PID 2424 wrote to memory of 2196	2424	cmd.exe	96
PID 2424 wrote to memory of 2196	2424	cmd.exe	96
PID 2424 wrote to memory of 1400	2424	cmd.exe	102
PID 2424 wrote to memory of 1400	2424	cmd.exe	102
PID 2424 wrote to memory of 3644	2424	cmd.exe	103
PID 2424 wrote to memory of 3644	2424	cmd.exe	103
PID 3644 wrote to memory of 3632	3644	net.exe	104
PID 3644 wrote to memory of 3632	3644	net.exe	104
PID 4092 wrote to memory of 1940	4092	9509.exe	105
PID 4092 wrote to memory of 1940	4092	9509.exe	105
PID 4092 wrote to memory of 1940	4092	9509.exe	105
PID 2424 wrote to memory of 3860	2424	cmd.exe	107
PID 2424 wrote to memory of 3860	2424	cmd.exe	107
PID 3860 wrote to memory of 2164	3860	net.exe	108
PID 3860 wrote to memory of 2164	3860	net.exe	108
PID 1940 wrote to memory of 3776	1940	cmd.exe	109
PID 1940 wrote to memory of 3776	1940	cmd.exe	109
PID 1940 wrote to memory of 3776	1940	cmd.exe	109
PID 2424 wrote to memory of 3344	2424	cmd.exe	110

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2336

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2324

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3760 -s 900
  2⤵
  - Program crash
  PID:3696

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3472

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3268

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3256

C:\Users\Admin\AppData\Local\Temp\72fd6124a1dbe632a397560ace2d813b.exe
"C:\Users\Admin\AppData\Local\Temp\72fd6124a1dbe632a397560ace2d813b.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3200

C:\Users\Admin\AppData\Local\Temp\5F33.exe
C:\Users\Admin\AppData\Local\Temp\5F33.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:368

C:\Users\Admin\AppData\Local\Temp\9509.exe
C:\Users\Admin\AppData\Local\Temp\9509.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\FaEbybrui & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\9509.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:3776

C:\Windows\system32\cmd.exe
cmd
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
  2⤵
  PID:1520
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
  2⤵
  PID:1932
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
  2⤵
  PID:1528
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
  2⤵
  PID:4016
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
  2⤵
  PID:2184
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
  2⤵
  PID:1336
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
  2⤵
  PID:3820
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
  2⤵
  PID:2104
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
  2⤵
  PID:992
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
  2⤵
  PID:2632
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
  2⤵
  PID:3956
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
  2⤵
  PID:1692
- C:\Windows\system32\ipconfig.exe
  ipconfig /displaydns
  2⤵
  - Gathers network information
  PID:1524
- C:\Windows\system32\ROUTE.EXE
  route print
  2⤵
  PID:912
- C:\Windows\system32\netsh.exe
  netsh firewall show state
  2⤵
  PID:828
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:2196
- C:\Windows\system32\tasklist.exe
  tasklist /v
  2⤵
  - Enumerates processes with tasklist
  PID:1400
- C:\Windows\system32\net.exe
  net accounts /domain
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts /domain
    3⤵
    PID:3632
- C:\Windows\system32\net.exe
  net share
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    PID:2164
- C:\Windows\system32\net.exe
  net user
  2⤵
  PID:3344
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:2696
- C:\Windows\system32\net.exe
  net user /domain
  2⤵
  PID:524
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /domain
    3⤵
    PID:2632
- C:\Windows\system32\net.exe
  net use
  2⤵
  PID:368
- C:\Windows\system32\net.exe
  net group
  2⤵
  PID:1848
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 group
    3⤵
    PID:4048
- C:\Windows\system32\net.exe
  net localgroup
  2⤵
  PID:2252
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup
    3⤵
    PID:1756
- C:\Windows\system32\NETSTAT.EXE
  netstat -r
  2⤵
  - Gathers network information
  PID:2208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
    3⤵
    PID:648
  - - C:\Windows\system32\ROUTE.EXE
      C:\Windows\system32\route.exe print
      4⤵
      PID:1140
- C:\Windows\system32\NETSTAT.EXE
  netstat -nao
  2⤵
  - Gathers network information
  PID:1376
- C:\Windows\system32\schtasks.exe
  schtasks /query
  2⤵
  PID:1408
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:1752

C:\Users\Admin\AppData\Local\Temp\C3EA.exe
C:\Users\Admin\AppData\Local\Temp\C3EA.exe
1⤵
- Executes dropped EXE
PID:3916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2780

C:\Users\Admin\AppData\Roaming\safsuja
C:\Users\Admin\AppData\Roaming\safsuja
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1672

C:\Users\Admin\AppData\Roaming\avfsuja
C:\Users\Admin\AppData\Roaming\avfsuja
1⤵
- Executes dropped EXE
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 476
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  PID:824

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4016

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:312

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3596

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:3516

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:904

C:\Users\Admin\AppData\Local\Temp\4197.exe
C:\Users\Admin\AppData\Local\Temp\4197.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\GUOqjXFbD & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4197.exe"
  2⤵
  PID:1072
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:1056

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2980

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2792

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2284

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/312-287-0x0000000000D20000-0x0000000000D95000-memory.dmp

Download

memory/312-288-0x0000000000CB0000-0x0000000000D1B000-memory.dmp

Download

memory/368-126-0x0000000000450000-0x000000000059A000-memory.dmp

Download

memory/368-127-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/368-125-0x00000000006F8000-0x0000000000701000-memory.dmp

Download

memory/824-324-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/824-320-0x0000000005290000-0x000000000529B000-memory.dmp

Download

memory/824-319-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/904-295-0x0000000000D80000-0x0000000000D89000-memory.dmp

Download

memory/904-296-0x0000000000D70000-0x0000000000D7E000-memory.dmp

Download

memory/1056-330-0x0000000000C30000-0x0000000000C3B000-memory.dmp

Download

memory/1056-329-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download

memory/1072-328-0x00000000005D0000-0x00000000005DB000-memory.dmp

Download

memory/1072-327-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

memory/1672-181-0x0000000000718000-0x0000000000721000-memory.dmp

Download

memory/1672-185-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1672-184-0x0000000000450000-0x000000000059A000-memory.dmp

Download

memory/2196-267-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-232-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-297-0x000001B780140000-0x000001B780141000-memory.dmp

Download

memory/2196-335-0x000001B780150000-0x000001B780151000-memory.dmp

Download

memory/2196-332-0x000001B7802D0000-0x000001B7802D1000-memory.dmp

Download

memory/2196-333-0x000001B7802D0000-0x000001B7802D1000-memory.dmp

Download

memory/2196-266-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-264-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-262-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-261-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-259-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-258-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-310-0x000001B7802A0000-0x000001B7802A1000-memory.dmp

Download

memory/2196-255-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-254-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-238-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-253-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-252-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-251-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-249-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-248-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-246-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-245-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-240-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-244-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-242-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-239-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-241-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-237-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-236-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-234-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2196-233-0x00007FFC723B0000-0x00007FFC7241B000-memory.dmp

Download

memory/2284-313-0x00000000008D0000-0x00000000008DB000-memory.dmp

Download

memory/2284-312-0x00000000008E0000-0x00000000008E6000-memory.dmp

Download

memory/2300-314-0x0000000000450000-0x000000000059A000-memory.dmp

Download

memory/2300-187-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2300-182-0x00000000007B8000-0x00000000007C1000-memory.dmp

Download

memory/2300-315-0x0000000000450000-0x000000000059A000-memory.dmp

Download

memory/2300-186-0x0000000000450000-0x000000000059A000-memory.dmp

Download

memory/2324-323-0x000001D8E5870000-0x000001D8E5871000-memory.dmp

Download

memory/2336-325-0x000001A20B330000-0x000001A20B331000-memory.dmp

Download

memory/2372-306-0x0000000002060000-0x00000000020A7000-memory.dmp

Download

memory/2372-307-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/2436-326-0x000001DF04740000-0x000001DF04741000-memory.dmp

Download

memory/2780-156-0x000001C19D250000-0x000001C19D252000-memory.dmp

Download

memory/2780-155-0x000001C19D250000-0x000001C19D252000-memory.dmp

Download

memory/2792-308-0x0000000000F90000-0x0000000000F96000-memory.dmp

Download

memory/2792-309-0x0000000000F80000-0x0000000000F8C000-memory.dmp

Download

memory/2804-321-0x00000000012E0000-0x00000000012E7000-memory.dmp

Download

memory/2804-322-0x00000000012D0000-0x00000000012DD000-memory.dmp

Download

memory/2980-303-0x00000000032E0000-0x00000000032E9000-memory.dmp

Download

memory/2980-302-0x00000000032F0000-0x00000000032F5000-memory.dmp

Download

memory/3060-135-0x0000000004C30000-0x0000000004C32000-memory.dmp

Download

memory/3060-136-0x0000000004C30000-0x0000000004C32000-memory.dmp

Download

memory/3060-230-0x0000000004C30000-0x0000000004C32000-memory.dmp

Download

memory/3060-227-0x00000000051F0000-0x0000000005206000-memory.dmp

Download

memory/3060-121-0x00000000012D0000-0x00000000012E6000-memory.dmp

Download

memory/3060-231-0x0000000004C30000-0x0000000004C32000-memory.dmp

Download

memory/3060-210-0x0000000004C30000-0x0000000004C32000-memory.dmp

Download

memory/3060-137-0x0000000004C20000-0x0000000004C2F000-memory.dmp

Download

memory/3060-128-0x0000000001490000-0x00000000014A6000-memory.dmp

Download

memory/3200-119-0x0000000002020000-0x0000000002029000-memory.dmp

Download

memory/3200-120-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3472-331-0x0000020980010000-0x0000020980011000-memory.dmp

Download

memory/3516-293-0x0000000000420000-0x000000000042B000-memory.dmp

Download

memory/3516-292-0x0000000000430000-0x0000000000437000-memory.dmp

Download

memory/3596-289-0x0000000000EE0000-0x0000000000EE7000-memory.dmp

Download

memory/3596-290-0x0000000000ED0000-0x0000000000EDC000-memory.dmp

Download

memory/3696-334-0x0000019F3DF80000-0x0000019F3DF81000-memory.dmp

Download

memory/3916-165-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

memory/3916-151-0x0000000004990000-0x0000000004991000-memory.dmp

Download

memory/3916-170-0x0000000005870000-0x0000000005871000-memory.dmp

Download

memory/3916-169-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/3916-167-0x0000000005A00000-0x0000000005A01000-memory.dmp

Download

memory/3916-166-0x0000000005460000-0x0000000005461000-memory.dmp

Download

memory/3916-172-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Download

memory/3916-143-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download

memory/3916-145-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

memory/3916-152-0x0000000004840000-0x0000000004E46000-memory.dmp

Download

memory/3916-171-0x00000000063B0000-0x00000000063B1000-memory.dmp

Download

memory/3916-149-0x0000000004950000-0x0000000004951000-memory.dmp

Download

memory/3916-148-0x0000000004A20000-0x0000000004A21000-memory.dmp

Download

memory/3916-146-0x00000000048F0000-0x00000000048F1000-memory.dmp

Download

memory/4092-134-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/4092-133-0x00000000020B0000-0x00000000020F7000-memory.dmp

Download