smokeloader | 6e23c1316c64fd1f4cb9d56f64adcdc29f18705a1c26c42e90cbdafa5cc731dc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
12/04/2022, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
581a84b899a7e45579283fbdfa321d73.exe
Size 410KB
Sample220412-p2cbaabdhj
SHA256 6e23c1316c64fd1f4cb9d56f64adcdc29f18705a1c26c42e90cbdafa5cc731dc
MD5 581a84b899a7e45579283fbdfa321d73
SHA1 daa65d31c6032603048a7e1c5a00290e6e3e4779
SHA512 53e286189a5fd6d33728f6a94dd31f896c4c439e5e48c8bbdb0399827ec82614c4678fdfdd1a36874bb6b6ce369517edde0b1dfd02650646d7852f09dafff3e7
MD5 SHA1 SHA512

Score

10^/10

smokeloader backdoor evasion suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

https://oakland-studio.video/search.php
https://seattle-university.video/search.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata

Executes dropped EXE 1 IoCs

pid	Process
1376	frusguf

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	756	WerFault.exe	139

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frusguf
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frusguf
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	581a84b899a7e45579283fbdfa321d73.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	581a84b899a7e45579283fbdfa321d73.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	581a84b899a7e45579283fbdfa321d73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frusguf

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4208	tasklist.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
4048	ipconfig.exe
4244	NETSTAT.EXE
4060	NETSTAT.EXE
4740	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2152	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00628ae86b4ed801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01c8fe86b4ed801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3869666722"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{124D9467-BA5F-11EC-B9A4-6A21FC562FD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30953067"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000783b789192fbc0b08fdd6d914151e8010f6ea8d32c3023c5d5619f95a4d610dd000000000e8000000002000020000000cae2c35e6e100aa0eb6d30bb2bb826118ce508c36e85381508ebc548e20c92a7200000008543568f3a55fe3a3adc8eea723215e48c6f4e2ddbf7bece3b82e58f960731df40000000eb0d992cf9322fe31cee486dbd35fb0d28dc0d8aa3bbd823979db9f3683ff5c58fb4afc878acdcb2f198cf881145318735c961ca834a71bc815bebb65465d8ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3869666722"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3873885364"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356532778"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30953067"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30953067"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000077ce72a55f1d74babc382ab641e506b0356d2bf92e7d7e8bb777455f9f182c7000000000e8000000002000020000000bebd9e45e9e17cde27b5253e832dfd628c78abc49c0a7e50b682e6ada608aea620000000889b3379a30f14587ea3221e3b9fc17fec57ff92e3132032fa981c4ceb1360ec400000007fe0c97717dd96f44a5de7442b3d1cdb215b2898091e4c28ca9320d4781277d6e3763d8c1839bf561969670102e085206fc9be8ac77113912bbdb9856e3d4283	iexplore.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1564	581a84b899a7e45579283fbdfa321d73.exe
1564	581a84b899a7e45579283fbdfa321d73.exe
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	Process not Found

Suspicious behavior: MapViewOfSection 52 IoCs

pid	Process
1564	581a84b899a7e45579283fbdfa321d73.exe
1376	frusguf
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3692	explorer.exe
3692	explorer.exe
3024	Process not Found
3024	Process not Found
3212	explorer.exe
3212	explorer.exe
3024	Process not Found
3024	Process not Found
5052	explorer.exe
5052	explorer.exe
3024	Process not Found
3024	Process not Found
1256	explorer.exe
1256	explorer.exe
3024	Process not Found
3024	Process not Found
1176	explorer.exe
1176	explorer.exe
1176	explorer.exe
1176	explorer.exe
3024	Process not Found
3024	Process not Found
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe
4032	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4248	WMIC.exe
Token: SeSecurityPrivilege	4248	WMIC.exe
Token: SeTakeOwnershipPrivilege	4248	WMIC.exe
Token: SeLoadDriverPrivilege	4248	WMIC.exe
Token: SeSystemProfilePrivilege	4248	WMIC.exe
Token: SeSystemtimePrivilege	4248	WMIC.exe
Token: SeProfSingleProcessPrivilege	4248	WMIC.exe
Token: SeIncBasePriorityPrivilege	4248	WMIC.exe
Token: SeCreatePagefilePrivilege	4248	WMIC.exe
Token: SeBackupPrivilege	4248	WMIC.exe
Token: SeRestorePrivilege	4248	WMIC.exe
Token: SeShutdownPrivilege	4248	WMIC.exe
Token: SeDebugPrivilege	4248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4248	WMIC.exe
Token: SeRemoteShutdownPrivilege	4248	WMIC.exe
Token: SeUndockPrivilege	4248	WMIC.exe
Token: SeManageVolumePrivilege	4248	WMIC.exe
Token: 33	4248	WMIC.exe
Token: 34	4248	WMIC.exe
Token: 35	4248	WMIC.exe
Token: 36	4248	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4248	WMIC.exe
Token: SeSecurityPrivilege	4248	WMIC.exe
Token: SeTakeOwnershipPrivilege	4248	WMIC.exe
Token: SeLoadDriverPrivilege	4248	WMIC.exe
Token: SeSystemProfilePrivilege	4248	WMIC.exe
Token: SeSystemtimePrivilege	4248	WMIC.exe
Token: SeProfSingleProcessPrivilege	4248	WMIC.exe
Token: SeIncBasePriorityPrivilege	4248	WMIC.exe
Token: SeCreatePagefilePrivilege	4248	WMIC.exe
Token: SeBackupPrivilege	4248	WMIC.exe
Token: SeRestorePrivilege	4248	WMIC.exe
Token: SeShutdownPrivilege	4248	WMIC.exe
Token: SeDebugPrivilege	4248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4248	WMIC.exe
Token: SeRemoteShutdownPrivilege	4248	WMIC.exe
Token: SeUndockPrivilege	4248	WMIC.exe
Token: SeManageVolumePrivilege	4248	WMIC.exe
Token: 33	4248	WMIC.exe
Token: 34	4248	WMIC.exe
Token: 35	4248	WMIC.exe
Token: 36	4248	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1272	WMIC.exe
Token: SeSecurityPrivilege	1272	WMIC.exe
Token: SeTakeOwnershipPrivilege	1272	WMIC.exe
Token: SeLoadDriverPrivilege	1272	WMIC.exe
Token: SeSystemProfilePrivilege	1272	WMIC.exe
Token: SeSystemtimePrivilege	1272	WMIC.exe
Token: SeProfSingleProcessPrivilege	1272	WMIC.exe
Token: SeIncBasePriorityPrivilege	1272	WMIC.exe
Token: SeCreatePagefilePrivilege	1272	WMIC.exe
Token: SeBackupPrivilege	1272	WMIC.exe
Token: SeRestorePrivilege	1272	WMIC.exe
Token: SeShutdownPrivilege	1272	WMIC.exe
Token: SeDebugPrivilege	1272	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1272	WMIC.exe
Token: SeRemoteShutdownPrivilege	1272	WMIC.exe
Token: SeUndockPrivilege	1272	WMIC.exe
Token: SeManageVolumePrivilege	1272	WMIC.exe
Token: 33	1272	WMIC.exe
Token: 34	1272	WMIC.exe
Token: 35	1272	WMIC.exe
Token: 36	1272	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1272	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1568	iexplore.exe
1568	iexplore.exe
224	IEXPLORE.EXE
224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4296	3024	Process not Found	88
PID 3024 wrote to memory of 4296	3024	Process not Found	88
PID 4296 wrote to memory of 4248	4296	cmd.exe	90
PID 4296 wrote to memory of 4248	4296	cmd.exe	90
PID 4296 wrote to memory of 1272	4296	cmd.exe	92
PID 4296 wrote to memory of 1272	4296	cmd.exe	92
PID 4296 wrote to memory of 4736	4296	cmd.exe	93
PID 4296 wrote to memory of 4736	4296	cmd.exe	93
PID 4296 wrote to memory of 2328	4296	cmd.exe	94
PID 4296 wrote to memory of 2328	4296	cmd.exe	94
PID 4296 wrote to memory of 2396	4296	cmd.exe	95
PID 4296 wrote to memory of 2396	4296	cmd.exe	95
PID 4296 wrote to memory of 4524	4296	cmd.exe	98
PID 4296 wrote to memory of 4524	4296	cmd.exe	98
PID 4296 wrote to memory of 2220	4296	cmd.exe	99
PID 4296 wrote to memory of 2220	4296	cmd.exe	99
PID 4296 wrote to memory of 3560	4296	cmd.exe	100
PID 4296 wrote to memory of 3560	4296	cmd.exe	100
PID 4296 wrote to memory of 3720	4296	cmd.exe	101
PID 4296 wrote to memory of 3720	4296	cmd.exe	101
PID 4296 wrote to memory of 3680	4296	cmd.exe	102
PID 4296 wrote to memory of 3680	4296	cmd.exe	102
PID 4296 wrote to memory of 632	4296	cmd.exe	103
PID 4296 wrote to memory of 632	4296	cmd.exe	103
PID 4296 wrote to memory of 952	4296	cmd.exe	104
PID 4296 wrote to memory of 952	4296	cmd.exe	104
PID 4296 wrote to memory of 60	4296	cmd.exe	105
PID 4296 wrote to memory of 60	4296	cmd.exe	105
PID 4296 wrote to memory of 2168	4296	cmd.exe	106
PID 4296 wrote to memory of 2168	4296	cmd.exe	106
PID 4296 wrote to memory of 4048	4296	cmd.exe	107
PID 4296 wrote to memory of 4048	4296	cmd.exe	107
PID 4296 wrote to memory of 1788	4296	cmd.exe	108
PID 4296 wrote to memory of 1788	4296	cmd.exe	108
PID 4296 wrote to memory of 1208	4296	cmd.exe	109
PID 4296 wrote to memory of 1208	4296	cmd.exe	109
PID 4296 wrote to memory of 2152	4296	cmd.exe	110
PID 4296 wrote to memory of 2152	4296	cmd.exe	110
PID 4296 wrote to memory of 4208	4296	cmd.exe	114
PID 4296 wrote to memory of 4208	4296	cmd.exe	114
PID 4296 wrote to memory of 3088	4296	cmd.exe	115
PID 4296 wrote to memory of 3088	4296	cmd.exe	115
PID 3088 wrote to memory of 1564	3088	net.exe	116
PID 3088 wrote to memory of 1564	3088	net.exe	116
PID 4296 wrote to memory of 3436	4296	cmd.exe	117
PID 4296 wrote to memory of 3436	4296	cmd.exe	117
PID 3436 wrote to memory of 2284	3436	net.exe	118
PID 3436 wrote to memory of 2284	3436	net.exe	118
PID 4296 wrote to memory of 2316	4296	cmd.exe	119
PID 4296 wrote to memory of 2316	4296	cmd.exe	119
PID 2316 wrote to memory of 2756	2316	net.exe	120
PID 2316 wrote to memory of 2756	2316	net.exe	120
PID 4296 wrote to memory of 2960	4296	cmd.exe	121
PID 4296 wrote to memory of 2960	4296	cmd.exe	121
PID 2960 wrote to memory of 2752	2960	net.exe	122
PID 2960 wrote to memory of 2752	2960	net.exe	122
PID 4296 wrote to memory of 404	4296	cmd.exe	123
PID 4296 wrote to memory of 404	4296	cmd.exe	123
PID 4296 wrote to memory of 3184	4296	cmd.exe	124
PID 4296 wrote to memory of 3184	4296	cmd.exe	124
PID 3184 wrote to memory of 3572	3184	net.exe	125
PID 3184 wrote to memory of 3572	3184	net.exe	125
PID 4296 wrote to memory of 744	4296	cmd.exe	126
PID 4296 wrote to memory of 744	4296	cmd.exe	126

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2356

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2432

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3420

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3352

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2800

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:384

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3748

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3496

C:\Users\Admin\AppData\Local\Temp\581a84b899a7e45579283fbdfa321d73.exe
"C:\Users\Admin\AppData\Local\Temp\581a84b899a7e45579283fbdfa321d73.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1564

C:\Windows\system32\cmd.exe
cmd
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
  2⤵
  PID:4736
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
  2⤵
  PID:2328
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
  2⤵
  PID:2396
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
  2⤵
  PID:4524
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
  2⤵
  PID:2220
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
  2⤵
  PID:3560
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
  2⤵
  PID:3720
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
  2⤵
  PID:3680
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
  2⤵
  PID:632
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
  2⤵
  PID:952
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
  2⤵
  PID:60
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
  2⤵
  PID:2168
- C:\Windows\system32\ipconfig.exe
  ipconfig /displaydns
  2⤵
  - Gathers network information
  PID:4048
- C:\Windows\system32\ROUTE.EXE
  route print
  2⤵
  PID:1788
- C:\Windows\system32\netsh.exe
  netsh firewall show state
  2⤵
  PID:1208
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:2152
- C:\Windows\system32\tasklist.exe
  tasklist /v
  2⤵
  - Enumerates processes with tasklist
  PID:4208
- C:\Windows\system32\net.exe
  net accounts /domain
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts /domain
    3⤵
    PID:1564
- C:\Windows\system32\net.exe
  net share
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    PID:2284
- C:\Windows\system32\net.exe
  net user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:2756
- C:\Windows\system32\net.exe
  net user /domain
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /domain
    3⤵
    PID:2752
- C:\Windows\system32\net.exe
  net use
  2⤵
  PID:404
- C:\Windows\system32\net.exe
  net group
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 group
    3⤵
    PID:3572
- C:\Windows\system32\net.exe
  net localgroup
  2⤵
  PID:744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup
    3⤵
    PID:3324
- C:\Windows\system32\NETSTAT.EXE
  netstat -r
  2⤵
  - Gathers network information
  PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
    3⤵
    PID:524
  - - C:\Windows\system32\ROUTE.EXE
      C:\Windows\system32\route.exe print
      4⤵
      PID:3928
- C:\Windows\system32\NETSTAT.EXE
  netstat -nao
  2⤵
  - Gathers network information
  PID:4060
- C:\Windows\system32\schtasks.exe
  schtasks /query
  2⤵
  PID:2428
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:4740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4100

C:\Users\Admin\AppData\Roaming\frusguf
C:\Users\Admin\AppData\Roaming\frusguf
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1376

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:1212

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:224

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 880
  2⤵
  - Program crash
  PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 756 -ip 756
1⤵
PID:2408

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3588

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:3692

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:3212

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5052

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:1256

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:1176

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 26dce13feda2a3246817e7763b4b5ecc05be9701b9865c327934afa71d582be1
MD5 a5295b4e1f55f566e97f538a9686daf4
SHA1 c0c0252c0d7d516d49d1e2a0d20622cb8b6a2e3b
SHA512 731884bc5aae84b09411d32eff7b076a5b2ee38a216517f175be71812118658ee46a3e33ea6f25745973ecea9181ec472b8ca4d43a105f1630c44bb324be4901
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 434B
SHA256 5f1c697775f8e6a8ed12fd66963da446a119ad6ebb02962e96cc0ce36ee6991f
MD5 36f8bab23a36265507017c7e890c22b2
SHA1 a51ad94f3a2af675d96906997473bc8880e7747f
SHA512 98b0b8dd6d6086108971be299448066cfc29626ce0fee804d5ee32995e8c6713bcbb2ac1479edc5bcca7b2e5b0eeb5215c9ecbe78b6e581cec3009705d53cd59
MD5 SHA1 SHA512

Submit Download

frusguf

Path C:\Users\Admin\AppData\Roaming\frusguf
Size 410KB
SHA256 6e23c1316c64fd1f4cb9d56f64adcdc29f18705a1c26c42e90cbdafa5cc731dc
MD5 581a84b899a7e45579283fbdfa321d73
SHA1 daa65d31c6032603048a7e1c5a00290e6e3e4779
SHA512 53e286189a5fd6d33728f6a94dd31f896c4c439e5e48c8bbdb0399827ec82614c4678fdfdd1a36874bb6b6ce369517edde0b1dfd02650646d7852f09dafff3e7
SSDEEP 6144:r/eOsMTLvp6u+YL4iCk5/kFYH3s38PC+63dOz8pyNY6EEAXEGiEadOR:SMt+YjJ3s3GC+IO8wDEbX7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

frusguf

Path C:\Users\Admin\AppData\Roaming\frusguf
Size 410KB
SHA256 6e23c1316c64fd1f4cb9d56f64adcdc29f18705a1c26c42e90cbdafa5cc731dc
MD5 581a84b899a7e45579283fbdfa321d73
SHA1 daa65d31c6032603048a7e1c5a00290e6e3e4779
SHA512 53e286189a5fd6d33728f6a94dd31f896c4c439e5e48c8bbdb0399827ec82614c4678fdfdd1a36874bb6b6ce369517edde0b1dfd02650646d7852f09dafff3e7
SSDEEP 6144:r/eOsMTLvp6u+YL4iCk5/kFYH3s38PC+63dOz8pyNY6EEAXEGiEadOR:SMt+YjJ3s3GC+IO8wDEbX7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1376-173-0x00000000007D0000-0x00000000007D9000-memory.dmp

Download

memory/1564-130-0x00000000009B0000-0x00000000009BA000-memory.dmp

Download

memory/1564-131-0x00000000009C0000-0x00000000009C9000-memory.dmp

Download

memory/3024-132-0x0000000001280000-0x0000000001296000-memory.dmp

Download

memory/3024-133-0x0000000008430000-0x000000000843F000-memory.dmp

Download

memory/3024-176-0x0000000008460000-0x0000000008476000-memory.dmp

Download