smokeloader | b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e

General

Target

b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe
Size

333KB
MD5

b35fd6523045221e87128a6c132a75a8
SHA1

993c1672f4ee6cecdb240473cf802e481b9d033d
SHA256

b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e
SHA512

24cc1df4ef99c86d36f148613ff9859c434f0678323ec73ee27c75fb2018546993c4608bc478a90b734dd65389dcbcacc41e8e80e0a49291d073e7381e235916

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://abpa.at/upload/

http://emaratghajari.com/upload/

http://d7qw.cn/upload/

http://alumik-group.ru/upload/

http://zamkikurgan.ru/upload/

https://oakland-studio.video/search.php

https://seattle-university.video/search.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 3412 created 3668	3412	WerFault.exe	explorer.exe
PID 2816 created 2800	2816	WerFault.exe	DllHost.exe
PID 1620 created 3996	1620	WerFault.exe	DllHost.exe
PID 3988 created 1148	3988	WerFault.exe	DllHost.exe
PID 3416 created 2664	3416	WerFault.exe	DllHost.exe

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

672E.exethfttfc

pid process

532 672E.exe
2552 thfttfc
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe

pid	process
532	672E.exe
2552	thfttfc

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3424	3668	WerFault.exe	explorer.exe
1824	2800	WerFault.exe	DllHost.exe
960	3996	WerFault.exe	DllHost.exe
2236	1148	WerFault.exe	DllHost.exe
8	2664	WerFault.exe	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe672E.exethfttfc

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	672E.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	672E.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	thfttfc
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	672E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	thfttfc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	thfttfc

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30937714"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda00000000020000000000106600000001000020000000c612085a84338bb62568ef932ef9ec9579241ea60ad1cb03604bfab04a681808000000000e80000000020000200000000e5faa70b7de41b8e72d4ce8565930e6587f951562c6b7e4acf90ec3870e3a0920000000bf7700bf633667bcc46b6be1462a6d639579dab48d6778a735c6d3a34372a3af40000000cc234061dddfed4636b10c385a33f9cb629f50ab8e19191ffacdea2b5a484c4e198dcdcc200146d08c94fb8199ed346aee18038ade5d73661397bdc29a072e10	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f6c2647212d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1579409911"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1613316397"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda000000000200000000001066000000010000200000008dff80974db475b8cb7815ef94374431788303c767521617dd82705d8590f9fc000000000e8000000002000020000000b0a3460db464f31eae31b1e84e6e41d2c940a6180116d5c5d42b81350bfccbf32000000001464eafe5347267a40dd61f3a6c8595172c076268569585bc485ede00ed45ec40000000fe2c5e5af29f2e68cd3c52775c3994584ce6eefb2ff5cddeea6a8314978968b5573e8ca6a2fa686720cca33f709b43ee09a923218b61c3cd414bdb2740ee8d91	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1579409911"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30937714"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{893E6063-7E65-11EC-82D0-5ECADF14C037} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30937714"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0419f647212d801	iexplore.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe

pid	process
2236	b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe
2236	b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520
2520

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2520

pid	process
2520

Suspicious behavior: MapViewOfSection 59 IoCs

Processes:

b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe672E.exethfttfcexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
2236	b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe
532	672E.exe
2552	thfttfc
2520
2520
2520
2520
2520
2520
3832	explorer.exe
3832	explorer.exe
2520
2520
3400	explorer.exe
3400	explorer.exe
2520
2520
3088	explorer.exe
3088	explorer.exe
2520
2520
3272	explorer.exe
3272	explorer.exe
2520
2520
3208	explorer.exe
3208	explorer.exe
3208	explorer.exe
3208	explorer.exe
2520
2520
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe
1744	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1872	WMIC.exe
Token: SeSecurityPrivilege	1872	WMIC.exe
Token: SeTakeOwnershipPrivilege	1872	WMIC.exe
Token: SeLoadDriverPrivilege	1872	WMIC.exe
Token: SeSystemProfilePrivilege	1872	WMIC.exe
Token: SeSystemtimePrivilege	1872	WMIC.exe
Token: SeProfSingleProcessPrivilege	1872	WMIC.exe
Token: SeIncBasePriorityPrivilege	1872	WMIC.exe
Token: SeCreatePagefilePrivilege	1872	WMIC.exe
Token: SeBackupPrivilege	1872	WMIC.exe
Token: SeRestorePrivilege	1872	WMIC.exe
Token: SeShutdownPrivilege	1872	WMIC.exe
Token: SeDebugPrivilege	1872	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1872	WMIC.exe
Token: SeRemoteShutdownPrivilege	1872	WMIC.exe
Token: SeUndockPrivilege	1872	WMIC.exe
Token: SeManageVolumePrivilege	1872	WMIC.exe
Token: 33	1872	WMIC.exe
Token: 34	1872	WMIC.exe
Token: 35	1872	WMIC.exe
Token: 36	1872	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1872	WMIC.exe
Token: SeSecurityPrivilege	1872	WMIC.exe
Token: SeTakeOwnershipPrivilege	1872	WMIC.exe
Token: SeLoadDriverPrivilege	1872	WMIC.exe
Token: SeSystemProfilePrivilege	1872	WMIC.exe
Token: SeSystemtimePrivilege	1872	WMIC.exe
Token: SeProfSingleProcessPrivilege	1872	WMIC.exe
Token: SeIncBasePriorityPrivilege	1872	WMIC.exe
Token: SeCreatePagefilePrivilege	1872	WMIC.exe
Token: SeBackupPrivilege	1872	WMIC.exe
Token: SeRestorePrivilege	1872	WMIC.exe
Token: SeShutdownPrivilege	1872	WMIC.exe
Token: SeDebugPrivilege	1872	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1872	WMIC.exe
Token: SeRemoteShutdownPrivilege	1872	WMIC.exe
Token: SeUndockPrivilege	1872	WMIC.exe
Token: SeManageVolumePrivilege	1872	WMIC.exe
Token: 33	1872	WMIC.exe
Token: 34	1872	WMIC.exe
Token: 35	1872	WMIC.exe
Token: 36	1872	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1692	WMIC.exe
Token: SeSecurityPrivilege	1692	WMIC.exe
Token: SeTakeOwnershipPrivilege	1692	WMIC.exe
Token: SeLoadDriverPrivilege	1692	WMIC.exe
Token: SeSystemProfilePrivilege	1692	WMIC.exe
Token: SeSystemtimePrivilege	1692	WMIC.exe
Token: SeProfSingleProcessPrivilege	1692	WMIC.exe
Token: SeIncBasePriorityPrivilege	1692	WMIC.exe
Token: SeCreatePagefilePrivilege	1692	WMIC.exe
Token: SeBackupPrivilege	1692	WMIC.exe
Token: SeRestorePrivilege	1692	WMIC.exe
Token: SeShutdownPrivilege	1692	WMIC.exe
Token: SeDebugPrivilege	1692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1692	WMIC.exe
Token: SeRemoteShutdownPrivilege	1692	WMIC.exe
Token: SeUndockPrivilege	1692	WMIC.exe
Token: SeManageVolumePrivilege	1692	WMIC.exe
Token: 33	1692	WMIC.exe
Token: 34	1692	WMIC.exe
Token: 35	1692	WMIC.exe
Token: 36	1692	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1692	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1856 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1856 iexplore.exe
1856 iexplore.exe
3104 IEXPLORE.EXE
3104 IEXPLORE.EXE

pid	process
1856	iexplore.exe

pid	process
1856	iexplore.exe
1856	iexplore.exe
3104	IEXPLORE.EXE
3104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exeiexplore.exeWerFault.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 2520 wrote to memory of 532	2520		672E.exe
PID 2520 wrote to memory of 532	2520		672E.exe
PID 2520 wrote to memory of 532	2520		672E.exe
PID 2520 wrote to memory of 1888	2520		cmd.exe
PID 2520 wrote to memory of 1888	2520		cmd.exe
PID 1888 wrote to memory of 1872	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 1872	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 1692	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 1692	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 712	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 712	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 3284	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 3284	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 2356	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 2356	1888	cmd.exe	WMIC.exe
PID 1856 wrote to memory of 3104	1856	iexplore.exe	IEXPLORE.EXE
PID 1856 wrote to memory of 3104	1856	iexplore.exe	IEXPLORE.EXE
PID 1856 wrote to memory of 3104	1856	iexplore.exe	IEXPLORE.EXE
PID 2520 wrote to memory of 3668	2520		explorer.exe
PID 2520 wrote to memory of 3668	2520		explorer.exe
PID 2520 wrote to memory of 3668	2520		explorer.exe
PID 2520 wrote to memory of 3668	2520		explorer.exe
PID 2520 wrote to memory of 1368	2520		explorer.exe
PID 2520 wrote to memory of 1368	2520		explorer.exe
PID 2520 wrote to memory of 1368	2520		explorer.exe
PID 3412 wrote to memory of 3668	3412	WerFault.exe	explorer.exe
PID 3412 wrote to memory of 3668	3412	WerFault.exe	explorer.exe
PID 2520 wrote to memory of 3832	2520		explorer.exe
PID 2520 wrote to memory of 3832	2520		explorer.exe
PID 2520 wrote to memory of 3832	2520		explorer.exe
PID 2520 wrote to memory of 3832	2520		explorer.exe
PID 3832 wrote to memory of 3104	3832	explorer.exe	IEXPLORE.EXE
PID 3832 wrote to memory of 3104	3832	explorer.exe	IEXPLORE.EXE
PID 2520 wrote to memory of 3400	2520		explorer.exe
PID 2520 wrote to memory of 3400	2520		explorer.exe
PID 2520 wrote to memory of 3400	2520		explorer.exe
PID 3400 wrote to memory of 1856	3400	explorer.exe	iexplore.exe
PID 3400 wrote to memory of 1856	3400	explorer.exe	iexplore.exe
PID 2520 wrote to memory of 3088	2520		explorer.exe
PID 2520 wrote to memory of 3088	2520		explorer.exe
PID 2520 wrote to memory of 3088	2520		explorer.exe
PID 2520 wrote to memory of 3088	2520		explorer.exe
PID 3088 wrote to memory of 3104	3088	explorer.exe	IEXPLORE.EXE
PID 3088 wrote to memory of 3104	3088	explorer.exe	IEXPLORE.EXE
PID 2520 wrote to memory of 3272	2520		explorer.exe
PID 2520 wrote to memory of 3272	2520		explorer.exe
PID 2520 wrote to memory of 3272	2520		explorer.exe
PID 3272 wrote to memory of 1856	3272	explorer.exe	iexplore.exe
PID 3272 wrote to memory of 1856	3272	explorer.exe	iexplore.exe
PID 2520 wrote to memory of 3208	2520		explorer.exe
PID 2520 wrote to memory of 3208	2520		explorer.exe
PID 2520 wrote to memory of 3208	2520		explorer.exe
PID 2520 wrote to memory of 3208	2520		explorer.exe
PID 3208 wrote to memory of 808	3208	explorer.exe	ielowutil.exe
PID 3208 wrote to memory of 808	3208	explorer.exe	ielowutil.exe
PID 3208 wrote to memory of 3104	3208	explorer.exe	IEXPLORE.EXE
PID 2520 wrote to memory of 1744	2520		explorer.exe
PID 2520 wrote to memory of 1744	2520		explorer.exe
PID 2520 wrote to memory of 1744	2520		explorer.exe
PID 1744 wrote to memory of 2296	1744	explorer.exe	sihost.exe
PID 3208 wrote to memory of 3104	3208	explorer.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 2296	1744	explorer.exe	sihost.exe
PID 1744 wrote to memory of 2320	1744	explorer.exe	svchost.exe
PID 1744 wrote to memory of 2320	1744	explorer.exe	svchost.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2320

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2972

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2908

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:576

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3236

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3060

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2800

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2800 -s 1004
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
1⤵
PID:2612

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2368

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe
"C:\Users\Admin\AppData\Local\Temp\b83c559b04351fdebcbc5c9c5ff033cd783815bb6bd6ff4e4ffa9f953c49ee5e.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2236

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 22a505ca8b43bbbdcd03f331255694a4 1OLgPN8KXEeFI7dsC0Hckw.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2132

C:\Users\Admin\AppData\Local\Temp\672E.exe
C:\Users\Admin\AppData\Local\Temp\672E.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:532

C:\Windows\system32\cmd.exe
cmd
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
2⤵
PID:712

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
2⤵
PID:3284

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
2⤵
PID:2356

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3192

C:\Users\Admin\AppData\Roaming\thfttfc
C:\Users\Admin\AppData\Roaming\thfttfc
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2552

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:808

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:3316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 880
2⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3424

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3668 -ip 3668
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3272

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3208

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 2800 -ip 2800
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2816

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3996 -s 836
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 3996 -ip 3996
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1620

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1148

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1148 -s 812
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 1148 -ip 1148
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3988

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2664

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2664 -s 808
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 2664 -ip 2664
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\672E.exe

MD5
005e445db353075922c066d7a792f78f

SHA1
79aa6671076b491c0b016275161e6145b7a7a7c1

SHA256
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0

SHA512
d355882916d84b8b848394851bd48f9ed74d6c715f09efe0e25b1e392e1bc148d683dc3ef5bb2aa80654bba7f7361c1d9d541b777c81b3f5e02dce3cd251d29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\672E.exe

MD5
005e445db353075922c066d7a792f78f

SHA1
79aa6671076b491c0b016275161e6145b7a7a7c1

SHA256
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0

SHA512
d355882916d84b8b848394851bd48f9ed74d6c715f09efe0e25b1e392e1bc148d683dc3ef5bb2aa80654bba7f7361c1d9d541b777c81b3f5e02dce3cd251d29a

Download Submit
C:\Users\Admin\AppData\Roaming\thfttfc

MD5
005e445db353075922c066d7a792f78f

SHA1
79aa6671076b491c0b016275161e6145b7a7a7c1

SHA256
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0

SHA512
d355882916d84b8b848394851bd48f9ed74d6c715f09efe0e25b1e392e1bc148d683dc3ef5bb2aa80654bba7f7361c1d9d541b777c81b3f5e02dce3cd251d29a

Download Submit
C:\Users\Admin\AppData\Roaming\thfttfc

MD5
005e445db353075922c066d7a792f78f

SHA1
79aa6671076b491c0b016275161e6145b7a7a7c1

SHA256
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0

SHA512
d355882916d84b8b848394851bd48f9ed74d6c715f09efe0e25b1e392e1bc148d683dc3ef5bb2aa80654bba7f7361c1d9d541b777c81b3f5e02dce3cd251d29a

Download Submit
memory/532-138-0x0000000000500000-0x000000000052B000-memory.dmp

Filesize
172KB

Download
memory/532-139-0x00000000004F0000-0x00000000004F9000-memory.dmp

Filesize
36KB

Download
memory/532-140-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/576-276-0x000001EC69110000-0x000001EC69111000-memory.dmp

Filesize
4KB

Download
memory/576-275-0x000001EC69110000-0x000001EC69111000-memory.dmp

Filesize
4KB

Download
memory/808-265-0x00000000045E0000-0x00000000045EB000-memory.dmp

Filesize
44KB

Download
memory/808-264-0x00000000045F0000-0x00000000045F1000-memory.dmp

Filesize
4KB

Download
memory/1368-253-0x00000000012D0000-0x00000000012DC000-memory.dmp

Filesize
48KB

Download
memory/1744-267-0x0000000000570000-0x000000000057D000-memory.dmp

Filesize
52KB

Download
memory/1744-266-0x0000000000580000-0x0000000000587000-memory.dmp

Filesize
28KB

Download
memory/2236-130-0x0000000000720000-0x000000000074B000-memory.dmp

Filesize
172KB

Download
memory/2236-131-0x0000000000710000-0x0000000000719000-memory.dmp

Filesize
36KB

Download
memory/2236-132-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2296-268-0x000001F3AC7D0000-0x000001F3AC7D1000-memory.dmp

Filesize
4KB

Download
memory/2320-269-0x0000023857160000-0x0000023857161000-memory.dmp

Filesize
4KB

Download
memory/2368-270-0x000001B0D63D0000-0x000001B0D63D1000-memory.dmp

Filesize
4KB

Download
memory/2520-141-0x0000000003220000-0x0000000003236000-memory.dmp

Filesize
88KB

Download
memory/2520-133-0x00000000013B0000-0x00000000013C6000-memory.dmp

Filesize
88KB

Download
memory/2552-218-0x0000000000830000-0x000000000085B000-memory.dmp

Filesize
172KB

Download
memory/2552-241-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2612-271-0x0000019E3DA00000-0x0000019E3DA01000-memory.dmp

Filesize
4KB

Download
memory/2908-272-0x000002AD98970000-0x000002AD98971000-memory.dmp

Filesize
4KB

Download
memory/2972-273-0x000002699BAE0000-0x000002699BAE1000-memory.dmp

Filesize
4KB

Download
memory/3088-259-0x00000000030F0000-0x00000000030F9000-memory.dmp

Filesize
36KB

Download
memory/3088-258-0x0000000003100000-0x0000000003105000-memory.dmp

Filesize
20KB

Download
memory/3208-262-0x0000000003100000-0x0000000003106000-memory.dmp

Filesize
24KB

Download
memory/3208-263-0x00000000030F0000-0x00000000030FB000-memory.dmp

Filesize
44KB

Download
memory/3236-274-0x0000021BD08F0000-0x0000021BD08F1000-memory.dmp

Filesize
4KB

Download
memory/3272-261-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/3272-260-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/3400-257-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/3400-256-0x00000000001A0000-0x00000000001A9000-memory.dmp

Filesize
36KB

Download
memory/3668-252-0x0000000000600000-0x000000000066B000-memory.dmp

Filesize
428KB

Download
memory/3668-251-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/3832-255-0x0000000002FF0000-0x0000000002FFB000-memory.dmp

Filesize
44KB

Download
memory/3832-254-0x0000000003200000-0x0000000003207000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads