smokeloader | fc0ca51fbc6a446ee39b3cdfc49a571c75ba7398ebb3b1a212882608061bb1e4

Analysis

max time kernel
161s
max time network
158s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05f70f02dc8c7054afd3ff2b7b730921.exe
Size 251KB
Sample220124-hs782aded4
SHA256 fc0ca51fbc6a446ee39b3cdfc49a571c75ba7398ebb3b1a212882608061bb1e4
MD5 05f70f02dc8c7054afd3ff2b7b730921
SHA1 e5ba4df60e3327e683def0a05307b8777ffca3b5
SHA512 5c7fa50a0347a2e4d16daced180f926b96e00fdba3a5a102f736cecc432598189c64b38e44ce34fa21f28743e102c7d59cb5a182f93f18169911a83e6cecc4a5
MD5 SHA1 SHA512

Score

10^/10

smokeloader backdoor collection evasion trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3468	850A.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Deletes itself 1 IoCs

pid	Process
3036	Process not Found

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	3780	WerFault.exe	34

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	05f70f02dc8c7054afd3ff2b7b730921.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	05f70f02dc8c7054afd3ff2b7b730921.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	05f70f02dc8c7054afd3ff2b7b730921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	850A.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	850A.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	850A.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2676	tasklist.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1176	ipconfig.exe
2548	NETSTAT.EXE
2856	NETSTAT.EXE
3212	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2744	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD0742C4-7CE3-11EC-9231-EAC8E7FB3643} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3792	05f70f02dc8c7054afd3ff2b7b730921.exe
3792	05f70f02dc8c7054afd3ff2b7b730921.exe
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	Process not Found

Suspicious behavior: MapViewOfSection 48 IoCs

pid	Process
3792	05f70f02dc8c7054afd3ff2b7b730921.exe
3468	850A.exe
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3036	Process not Found
3832	explorer.exe
3832	explorer.exe
3036	Process not Found
3036	Process not Found
1852	explorer.exe
1852	explorer.exe
3036	Process not Found
3036	Process not Found
888	explorer.exe
888	explorer.exe
3036	Process not Found
3036	Process not Found
3060	explorer.exe
3060	explorer.exe
3036	Process not Found
3036	Process not Found
1952	explorer.exe
1952	explorer.exe
3036	Process not Found
3036	Process not Found
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	856	WMIC.exe
Token: SeSecurityPrivilege	856	WMIC.exe
Token: SeTakeOwnershipPrivilege	856	WMIC.exe
Token: SeLoadDriverPrivilege	856	WMIC.exe
Token: SeSystemProfilePrivilege	856	WMIC.exe
Token: SeSystemtimePrivilege	856	WMIC.exe
Token: SeProfSingleProcessPrivilege	856	WMIC.exe
Token: SeIncBasePriorityPrivilege	856	WMIC.exe
Token: SeCreatePagefilePrivilege	856	WMIC.exe
Token: SeBackupPrivilege	856	WMIC.exe
Token: SeRestorePrivilege	856	WMIC.exe
Token: SeShutdownPrivilege	856	WMIC.exe
Token: SeDebugPrivilege	856	WMIC.exe
Token: SeSystemEnvironmentPrivilege	856	WMIC.exe
Token: SeRemoteShutdownPrivilege	856	WMIC.exe
Token: SeUndockPrivilege	856	WMIC.exe
Token: SeManageVolumePrivilege	856	WMIC.exe
Token: 33	856	WMIC.exe
Token: 34	856	WMIC.exe
Token: 35	856	WMIC.exe
Token: 36	856	WMIC.exe
Token: SeIncreaseQuotaPrivilege	856	WMIC.exe
Token: SeSecurityPrivilege	856	WMIC.exe
Token: SeTakeOwnershipPrivilege	856	WMIC.exe
Token: SeLoadDriverPrivilege	856	WMIC.exe
Token: SeSystemProfilePrivilege	856	WMIC.exe
Token: SeSystemtimePrivilege	856	WMIC.exe
Token: SeProfSingleProcessPrivilege	856	WMIC.exe
Token: SeIncBasePriorityPrivilege	856	WMIC.exe
Token: SeCreatePagefilePrivilege	856	WMIC.exe
Token: SeBackupPrivilege	856	WMIC.exe
Token: SeRestorePrivilege	856	WMIC.exe
Token: SeShutdownPrivilege	856	WMIC.exe
Token: SeDebugPrivilege	856	WMIC.exe
Token: SeSystemEnvironmentPrivilege	856	WMIC.exe
Token: SeRemoteShutdownPrivilege	856	WMIC.exe
Token: SeUndockPrivilege	856	WMIC.exe
Token: SeManageVolumePrivilege	856	WMIC.exe
Token: 33	856	WMIC.exe
Token: 34	856	WMIC.exe
Token: 35	856	WMIC.exe
Token: 36	856	WMIC.exe
Token: SeIncreaseQuotaPrivilege	980	WMIC.exe
Token: SeSecurityPrivilege	980	WMIC.exe
Token: SeTakeOwnershipPrivilege	980	WMIC.exe
Token: SeLoadDriverPrivilege	980	WMIC.exe
Token: SeSystemProfilePrivilege	980	WMIC.exe
Token: SeSystemtimePrivilege	980	WMIC.exe
Token: SeProfSingleProcessPrivilege	980	WMIC.exe
Token: SeIncBasePriorityPrivilege	980	WMIC.exe
Token: SeCreatePagefilePrivilege	980	WMIC.exe
Token: SeBackupPrivilege	980	WMIC.exe
Token: SeRestorePrivilege	980	WMIC.exe
Token: SeShutdownPrivilege	980	WMIC.exe
Token: SeDebugPrivilege	980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	980	WMIC.exe
Token: SeRemoteShutdownPrivilege	980	WMIC.exe
Token: SeUndockPrivilege	980	WMIC.exe
Token: SeManageVolumePrivilege	980	WMIC.exe
Token: 33	980	WMIC.exe
Token: 34	980	WMIC.exe
Token: 35	980	WMIC.exe
Token: 36	980	WMIC.exe
Token: SeIncreaseQuotaPrivilege	980	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3468	3036	Process not Found	69
PID 3036 wrote to memory of 3468	3036	Process not Found	69
PID 3036 wrote to memory of 3468	3036	Process not Found	69
PID 3036 wrote to memory of 3692	3036	Process not Found	73
PID 3036 wrote to memory of 3692	3036	Process not Found	73
PID 3692 wrote to memory of 856	3692	cmd.exe	75
PID 3692 wrote to memory of 856	3692	cmd.exe	75
PID 3692 wrote to memory of 980	3692	cmd.exe	76
PID 3692 wrote to memory of 980	3692	cmd.exe	76
PID 3692 wrote to memory of 3416	3692	cmd.exe	77
PID 3692 wrote to memory of 3416	3692	cmd.exe	77
PID 3692 wrote to memory of 1372	3692	cmd.exe	78
PID 3692 wrote to memory of 1372	3692	cmd.exe	78
PID 3692 wrote to memory of 1476	3692	cmd.exe	79
PID 3692 wrote to memory of 1476	3692	cmd.exe	79
PID 3692 wrote to memory of 3556	3692	cmd.exe	82
PID 3692 wrote to memory of 3556	3692	cmd.exe	82
PID 3692 wrote to memory of 2728	3692	cmd.exe	83
PID 3692 wrote to memory of 2728	3692	cmd.exe	83
PID 3692 wrote to memory of 3636	3692	cmd.exe	84
PID 3692 wrote to memory of 3636	3692	cmd.exe	84
PID 3692 wrote to memory of 3608	3692	cmd.exe	85
PID 3692 wrote to memory of 3608	3692	cmd.exe	85
PID 3692 wrote to memory of 3632	3692	cmd.exe	86
PID 3692 wrote to memory of 3632	3692	cmd.exe	86
PID 3692 wrote to memory of 1808	3692	cmd.exe	87
PID 3692 wrote to memory of 1808	3692	cmd.exe	87
PID 3692 wrote to memory of 3852	3692	cmd.exe	88
PID 3692 wrote to memory of 3852	3692	cmd.exe	88
PID 3692 wrote to memory of 2644	3692	cmd.exe	89
PID 3692 wrote to memory of 2644	3692	cmd.exe	89
PID 3692 wrote to memory of 2972	3692	cmd.exe	90
PID 3692 wrote to memory of 2972	3692	cmd.exe	90
PID 3692 wrote to memory of 1176	3692	cmd.exe	91
PID 3692 wrote to memory of 1176	3692	cmd.exe	91
PID 3692 wrote to memory of 3944	3692	cmd.exe	92
PID 3692 wrote to memory of 3944	3692	cmd.exe	92
PID 3692 wrote to memory of 616	3692	cmd.exe	93
PID 3692 wrote to memory of 616	3692	cmd.exe	93
PID 3692 wrote to memory of 2744	3692	cmd.exe	94
PID 3692 wrote to memory of 2744	3692	cmd.exe	94
PID 3692 wrote to memory of 2676	3692	cmd.exe	96
PID 3692 wrote to memory of 2676	3692	cmd.exe	96
PID 3692 wrote to memory of 2688	3692	cmd.exe	97
PID 3692 wrote to memory of 2688	3692	cmd.exe	97
PID 2688 wrote to memory of 528	2688	net.exe	98
PID 2688 wrote to memory of 528	2688	net.exe	98
PID 3692 wrote to memory of 1268	3692	cmd.exe	99
PID 3692 wrote to memory of 1268	3692	cmd.exe	99
PID 1268 wrote to memory of 936	1268	net.exe	100
PID 1268 wrote to memory of 936	1268	net.exe	100
PID 3692 wrote to memory of 3000	3692	cmd.exe	101
PID 3692 wrote to memory of 3000	3692	cmd.exe	101
PID 3000 wrote to memory of 2408	3000	net.exe	102
PID 3000 wrote to memory of 2408	3000	net.exe	102
PID 3692 wrote to memory of 424	3692	cmd.exe	103
PID 3692 wrote to memory of 424	3692	cmd.exe	103
PID 424 wrote to memory of 1308	424	net.exe	104
PID 424 wrote to memory of 1308	424	net.exe	104
PID 3692 wrote to memory of 3312	3692	cmd.exe	105
PID 3692 wrote to memory of 3312	3692	cmd.exe	105
PID 3692 wrote to memory of 2772	3692	cmd.exe	106
PID 3692 wrote to memory of 2772	3692	cmd.exe	106
PID 2772 wrote to memory of 1404	2772	net.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3276

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2764

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3292

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3504

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3780
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3780 -s 900
  2⤵
  - Program crash
  PID:1372

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2496

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2416

C:\Users\Admin\AppData\Local\Temp\05f70f02dc8c7054afd3ff2b7b730921.exe
"C:\Users\Admin\AppData\Local\Temp\05f70f02dc8c7054afd3ff2b7b730921.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3792

C:\Users\Admin\AppData\Local\Temp\850A.exe
C:\Users\Admin\AppData\Local\Temp\850A.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3468

C:\Windows\system32\cmd.exe
cmd
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:980
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
  2⤵
  PID:3416
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
  2⤵
  PID:1372
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
  2⤵
  PID:1476
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
  2⤵
  PID:3556
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
  2⤵
  PID:2728
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
  2⤵
  PID:3636
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
  2⤵
  PID:3608
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
  2⤵
  PID:3632
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
  2⤵
  PID:1808
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
  2⤵
  PID:3852
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
  2⤵
  PID:2644
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
  2⤵
  PID:2972
- C:\Windows\system32\ipconfig.exe
  ipconfig /displaydns
  2⤵
  - Gathers network information
  PID:1176
- C:\Windows\system32\ROUTE.EXE
  route print
  2⤵
  PID:3944
- C:\Windows\system32\netsh.exe
  netsh firewall show state
  2⤵
  PID:616
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:2744
- C:\Windows\system32\tasklist.exe
  tasklist /v
  2⤵
  - Enumerates processes with tasklist
  PID:2676
- C:\Windows\system32\net.exe
  net accounts /domain
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts /domain
    3⤵
    PID:528
- C:\Windows\system32\net.exe
  net share
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    PID:936
- C:\Windows\system32\net.exe
  net user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:2408
- C:\Windows\system32\net.exe
  net user /domain
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /domain
    3⤵
    PID:1308
- C:\Windows\system32\net.exe
  net use
  2⤵
  PID:3312
- C:\Windows\system32\net.exe
  net group
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 group
    3⤵
    PID:1404
- C:\Windows\system32\net.exe
  net localgroup
  2⤵
  PID:3984
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup
    3⤵
    PID:1812
- C:\Windows\system32\NETSTAT.EXE
  netstat -r
  2⤵
  - Gathers network information
  PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
    3⤵
    PID:2592
  - - C:\Windows\system32\ROUTE.EXE
      C:\Windows\system32\route.exe print
      4⤵
      PID:3796
- C:\Windows\system32\NETSTAT.EXE
  netstat -nao
  2⤵
  - Gathers network information
  PID:2856
- C:\Windows\system32\schtasks.exe
  schtasks /query
  2⤵
  PID:3576
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:3212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1824

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3844

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2396

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:3832

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:1852

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:888

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:3060

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:1952

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:3696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/888-145-0x0000000000650000-0x0000000000659000-memory.dmp

Download

memory/888-144-0x0000000000660000-0x0000000000665000-memory.dmp

Download

memory/1372-157-0x0000028EF82B0000-0x0000028EF82B1000-memory.dmp

Download

memory/1852-143-0x0000000000BD0000-0x0000000000BDE000-memory.dmp

Download

memory/1852-142-0x0000000000BE0000-0x0000000000BE9000-memory.dmp

Download

memory/1952-148-0x0000000000820000-0x0000000000826000-memory.dmp

Download

memory/1952-149-0x0000000000810000-0x000000000081B000-memory.dmp

Download

memory/2396-139-0x0000000000350000-0x000000000035C000-memory.dmp

Download

memory/2416-152-0x000001D820380000-0x000001D820381000-memory.dmp

Download

memory/2496-153-0x000001C742380000-0x000001C742381000-memory.dmp

Download

memory/2764-154-0x00000292D0C50000-0x00000292D0C51000-memory.dmp

Download

memory/2764-156-0x00000292D0F90000-0x00000292D0F91000-memory.dmp

Download

memory/3036-127-0x0000000002A90000-0x0000000002AA6000-memory.dmp

Download

memory/3036-130-0x0000000002B50000-0x0000000002B5F000-memory.dmp

Download

memory/3036-121-0x0000000000A30000-0x0000000000A46000-memory.dmp

Download

memory/3060-147-0x0000000000EE0000-0x0000000000EEC000-memory.dmp

Download

memory/3060-146-0x0000000000EF0000-0x0000000000EF6000-memory.dmp

Download

memory/3468-126-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3468-125-0x0000000000870000-0x0000000000879000-memory.dmp

Download

memory/3468-124-0x0000000000030000-0x0000000000038000-memory.dmp

Download

memory/3504-155-0x000001EAA17A0000-0x000001EAA17A1000-memory.dmp

Download

memory/3696-150-0x0000000000CB0000-0x0000000000CB7000-memory.dmp

Download

memory/3696-151-0x0000000000CA0000-0x0000000000CAD000-memory.dmp

Download

memory/3792-118-0x0000000000030000-0x0000000000038000-memory.dmp

Download

memory/3792-120-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3792-119-0x0000000000490000-0x0000000000499000-memory.dmp

Download

memory/3832-141-0x0000000000A10000-0x0000000000A1B000-memory.dmp

Download

memory/3832-140-0x0000000000A20000-0x0000000000A27000-memory.dmp

Download

memory/3844-138-0x0000000000600000-0x000000000066B000-memory.dmp

Download

memory/3844-137-0x0000000000670000-0x00000000006E5000-memory.dmp

Download