djvu | a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b

Analysis

max time kernel
150s
max time network
121s
platform
windows10_x64
resource
win10-20220414-en
submitted
11-05-2022 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe
Size

292KB
MD5

8fdbb565db60af13fc39730c9993ff91
SHA1

c318c02da8a4abeb5f2b8c40169e91a3f28395f9
SHA256

a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b
SHA512

a04dd40ae94492ce691101011e0eb56945c78d5fc5c6bd1b3c98dc3f1cb74db29d501c91f1938166540d3e28cd51a4165dc60e51ab54b90a58842d5aabe4f4a8

Score

10^/10

djvu smokeloader vidar 1333 517 backdoor collection discovery persistence ransomware spyware stealer suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://monsutiur4.com/

http://nusurionuy5ff.at/

http://moroitomo4.net/

http://susuerulianita1.net/

http://cucumbetuturel4.com/

http://nunuslushau.com/

http://linislominyt11.at/

http://luxulixionus.net/

http://lilisjjoer44.com/

http://nikogminut88.at/

http://limo00ruling.org/

http://mini55tunul.com/

http://samnutu11nuli.com/

http://nikogkojam.org/

rc4.i32

Extracted

Family

djvu

http://ugll.org/lancer/get.php

Attributes

extension
.egfg
offline_id
QcVY9rkapJoL3nQkZAsvfTFVYLmscrM1v1QxGWt1
payload_url
http://zerit.top/dl/build2.exe
http://ugll.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-6Ti2DxXR3I Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@time2mail.ch Reserve e-mail address to contact us: supportsys@airmail.cc Your personal ID: 0474JIjdm

rsa_pubkey.plain

Extracted

Family

vidar

Version

Botnet

1333

https://t.me/hollandracing

https://busshi.moe/@ronxik321

Attributes

profile_id
1333

Extracted

Family

vidar

Version

52.1

Botnet

517

https://t.me/verstappenf1r

https://climatejustice.social/@ronxik312

Attributes

profile_id
517

Signatures

Detected Djvu ransomware 11 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1712-126-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2376-130-0x0000000002320000-0x000000000243B000-memory.dmp	family_djvu
behavioral1/memory/1712-129-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1712-127-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1712-131-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1712-132-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4728-135-0x0000000000630000-0x000000000077A000-memory.dmp	family_djvu
behavioral1/memory/392-145-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/392-147-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/392-148-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/392-149-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata

Vidar Stealer 8 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/4728-134-0x0000000000630000-0x000000000077A000-memory.dmp	family_vidar
behavioral1/memory/4728-135-0x0000000000630000-0x000000000077A000-memory.dmp	family_vidar
behavioral1/memory/4728-136-0x0000000000400000-0x00000000004FB000-memory.dmp	family_vidar
behavioral1/memory/3976-154-0x000000000042103C-mapping.dmp	family_vidar
behavioral1/memory/3976-153-0x0000000000400000-0x000000000044C000-memory.dmp	family_vidar
behavioral1/memory/3976-156-0x0000000000400000-0x000000000044C000-memory.dmp	family_vidar
behavioral1/memory/3976-158-0x0000000000400000-0x000000000044C000-memory.dmp	family_vidar
behavioral1/memory/3976-159-0x0000000000400000-0x000000000044C000-memory.dmp	family_vidar

Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

FD41.exe706.exeFD41.exeFD41.exeFD41.exebuild2.exebuild2.exe

pid process

2376 FD41.exe
4728 706.exe
1712 FD41.exe
2356 FD41.exe
392 FD41.exe
3480 build2.exe
3976 build2.exe
Deletes itself 1 IoCs

Processes:

pid process

3136
Loads dropped DLL 4 IoCs

Processes:

706.exebuild2.exe

pid process

4728 706.exe
4728 706.exe
3976 build2.exe
3976 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

948 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2376	FD41.exe
4728	706.exe
1712	FD41.exe
2356	FD41.exe
392	FD41.exe
3480	build2.exe
3976	build2.exe

pid	process
3136

pid	process
4728	706.exe
4728	706.exe
3976	build2.exe
3976	build2.exe

pid	process
948	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

FD41.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\72186639-c865-4712-becb-d1b89697d9fa\\FD41.exe\" --AutoStart"	FD41.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 api.2ip.ua
30 api.2ip.ua
31 api.2ip.ua

flow	ioc
19	api.2ip.ua
30	api.2ip.ua
31	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

Processes:

FD41.exeFD41.exebuild2.exe

description	pid	process	target process
PID 2376 set thread context of 1712	2376	FD41.exe	FD41.exe
PID 2356 set thread context of 392	2356	FD41.exe	FD41.exe
PID 3480 set thread context of 3976	3480	build2.exe	build2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

build2.exe706.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	706.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	706.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3788 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3680 taskkill.exe

pid	process
3788	timeout.exe

pid	process
3680	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

FD41.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	FD41.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FD41.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe

pid	process
4316	a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe
4316	a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3136
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe

pid process

4316 a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe
3136
3136
3136
3136

pid	process
3136

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

taskkill.exe

description	pid	process
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeDebugPrivilege	3680	taskkill.exe
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

FD41.exeFD41.exeFD41.exeFD41.exebuild2.exe706.execmd.exe

description	pid	process	target process
PID 3136 wrote to memory of 2376	3136		FD41.exe
PID 3136 wrote to memory of 2376	3136		FD41.exe
PID 3136 wrote to memory of 2376	3136		FD41.exe
PID 3136 wrote to memory of 4728	3136		706.exe
PID 3136 wrote to memory of 4728	3136		706.exe
PID 3136 wrote to memory of 4728	3136		706.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 2376 wrote to memory of 1712	2376	FD41.exe	FD41.exe
PID 3136 wrote to memory of 5108	3136		explorer.exe
PID 3136 wrote to memory of 5108	3136		explorer.exe
PID 3136 wrote to memory of 5108	3136		explorer.exe
PID 3136 wrote to memory of 5108	3136		explorer.exe
PID 3136 wrote to memory of 1328	3136		explorer.exe
PID 3136 wrote to memory of 1328	3136		explorer.exe
PID 3136 wrote to memory of 1328	3136		explorer.exe
PID 1712 wrote to memory of 948	1712	FD41.exe	icacls.exe
PID 1712 wrote to memory of 948	1712	FD41.exe	icacls.exe
PID 1712 wrote to memory of 948	1712	FD41.exe	icacls.exe
PID 1712 wrote to memory of 2356	1712	FD41.exe	FD41.exe
PID 1712 wrote to memory of 2356	1712	FD41.exe	FD41.exe
PID 1712 wrote to memory of 2356	1712	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 2356 wrote to memory of 392	2356	FD41.exe	FD41.exe
PID 392 wrote to memory of 3480	392	FD41.exe	build2.exe
PID 392 wrote to memory of 3480	392	FD41.exe	build2.exe
PID 392 wrote to memory of 3480	392	FD41.exe	build2.exe
PID 3480 wrote to memory of 3976	3480	build2.exe	build2.exe
PID 3480 wrote to memory of 3976	3480	build2.exe	build2.exe
PID 3480 wrote to memory of 3976	3480	build2.exe	build2.exe
PID 3480 wrote to memory of 3976	3480	build2.exe	build2.exe
PID 3480 wrote to memory of 3976	3480	build2.exe	build2.exe
PID 3480 wrote to memory of 3976	3480	build2.exe	build2.exe
PID 3480 wrote to memory of 3976	3480	build2.exe	build2.exe
PID 3480 wrote to memory of 3976	3480	build2.exe	build2.exe
PID 4728 wrote to memory of 1420	4728	706.exe	cmd.exe
PID 4728 wrote to memory of 1420	4728	706.exe	cmd.exe
PID 4728 wrote to memory of 1420	4728	706.exe	cmd.exe
PID 1420 wrote to memory of 3680	1420	cmd.exe	taskkill.exe
PID 1420 wrote to memory of 3680	1420	cmd.exe	taskkill.exe
PID 1420 wrote to memory of 3680	1420	cmd.exe	taskkill.exe
PID 1420 wrote to memory of 3788	1420	cmd.exe	timeout.exe
PID 1420 wrote to memory of 3788	1420	cmd.exe	timeout.exe
PID 1420 wrote to memory of 3788	1420	cmd.exe	timeout.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe
"C:\Users\Admin\AppData\Local\Temp\a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4316

C:\Users\Admin\AppData\Local\Temp\FD41.exe
C:\Users\Admin\AppData\Local\Temp\FD41.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Admin\AppData\Local\Temp\FD41.exe
C:\Users\Admin\AppData\Local\Temp\FD41.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\72186639-c865-4712-becb-d1b89697d9fa" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:948

C:\Users\Admin\AppData\Local\Temp\FD41.exe
"C:\Users\Admin\AppData\Local\Temp\FD41.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\FD41.exe
"C:\Users\Admin\AppData\Local\Temp\FD41.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:392

C:\Users\Admin\AppData\Local\ae46b9ba-c270-4f43-afb7-32e7a1ed67a6\build2.exe
"C:\Users\Admin\AppData\Local\ae46b9ba-c270-4f43-afb7-32e7a1ed67a6\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3480

C:\Users\Admin\AppData\Local\ae46b9ba-c270-4f43-afb7-32e7a1ed67a6\build2.exe
"C:\Users\Admin\AppData\Local\ae46b9ba-c270-4f43-afb7-32e7a1ed67a6\build2.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3976

C:\Users\Admin\AppData\Local\Temp\706.exe
C:\Users\Admin\AppData\Local\Temp\706.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 706.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\706.exe" & del C:\ProgramData\*.dll & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 706.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:3788

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:5108

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\freebl3.dll
Filesize
326KB

MD5
ef2834ac4ee7d6724f255beaf527e635

SHA1
5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

SHA256
a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

SHA512
c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

Download Submit
C:\ProgramData\mozglue.dll
Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\msvcp140.dll
Filesize
429KB

MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\ProgramData\nss3.dll
Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\ProgramData\softokn3.dll
Filesize
141KB

MD5
a2ee53de9167bf0d6c019303b7ca84e5

SHA1
2a3c737fa1157e8483815e98b666408a18c0db42

SHA256
43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

SHA512
45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

Download Submit
C:\ProgramData\vcruntime140.dll
Filesize
81KB

MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize
1KB

MD5
8b54a2999d39094c53f9558153bcf70e

SHA1
97f6facaa042db4b6a0fc625477eb9f6f34cc634

SHA256
8b79e1a3d26603a34ca21a78785a48a393f45cae460079c8d0446f5d1a53fabd

SHA512
989c587a4e1c24a10cf47be38d3403ea53a13287e25ad6186a70767c61b10b76e9b71608f10e536619117c9b052877a245f3807097ab743ba462e1e7eda2c04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\738FBC066DBD9E6001113366624890A3_53C5D34017BDB72400155AC2819BA60D
Filesize
1KB

MD5
4345ae89064f1b8764cdda90c460b37c

SHA1
0b718411796411944956e837d487335cdcb5ebcf

SHA256
3416bc8ca63cba675feae81d1c9acb0dd8323eecb288a02463e05b5363c116e0

SHA512
136463d64d7bf39fe46d71c1e2878ce903b612140a08d10b37103172f9679112776d82d86b7dcea84d02b7d978e83d98c2dba8b3b0fdf38fa611535c1ccd17d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize
1KB

MD5
3de25d07f7425f240094e6d4bdbc302f

SHA1
1804e6c043fe5789af24884a95de301a60685eca

SHA256
ca7e1f24dbd58c8a458b40528d1c61fceec34a2441e601ff5729b3cd3ec4f6e9

SHA512
375d0dc8fce11028f5b2e068ad9972ebe61fc581e51ab3e1cdb7ba63a9cdfabb28a154e141b8aa062554e297a0d4603683c952a98c9bb1d875d3870299945459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize
450B

MD5
2e98e831dcd61a23b2955bd2847e656e

SHA1
f91892de0c1acb2a5d1d275c3fbe05f860ca12d3

SHA256
da0d6cfadd277366d671034c11b582f55a343855d8134758aae0d740d9d18981

SHA512
be73edc5257e5e207d6c7c9c5674e35a17dfc5d4f755a99611f3ca44b6da8e5e0a1a6d7ddf314a8266c1a45228fd6195285dd08572a04ade02271c70c140bd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\738FBC066DBD9E6001113366624890A3_53C5D34017BDB72400155AC2819BA60D
Filesize
474B

MD5
13f470ae3c8775b0f4dd5055e823387d

SHA1
5339fbb29bb56dfca4f7f3ed42fcff2192ca3006

SHA256
d94eace27f2154d48858ff2be0eac6cbfa2acea4c6c6bcebbf6454e7ad740def

SHA512
a0973029f29d4912896600440b98127e77c179738b8af733038051ce07c486c6b93ec4577e57d5e3df0842cc3352dc715b1cd772d83ee2bddd7b12159feecf67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize
458B

MD5
3cfdefc50390e2461c1be795308d63ed

SHA1
1e82b37521ac52e8840b7f1639a319550b716d0e

SHA256
50caf50d1695f26c146205bf90cce134c121a34427acdd70b14052ccbae5936c

SHA512
016c4accd00758227e96388abb687f26e633eaf5097660b93251637427b99b8dedc43bf57b53e597f625d203af586f77d0207d47f9e061c0528d3d5a9ec99867

Download Submit
C:\Users\Admin\AppData\Local\72186639-c865-4712-becb-d1b89697d9fa\FD41.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\P39SA5QR.cookie
Filesize
102B

MD5
712f9a2fc08e3c9d901d7a1fd45b2366

SHA1
7b1494919a90cbfd3f798e0e84115b54e6e948e3

SHA256
b88cd0ab20e26bc89a8050e117a481e69f51bafcfa6943d22f21bf8bd3811eb0

SHA512
869576f3b1a6fe6154dda48e13d1e1636272f66c257bbdffc45d901edc2eebfc868b95b2add44f7d916b6dc73c6a03afeb4580088ac1b6ecb3b5bae4442caedf

Download Submit
C:\Users\Admin\AppData\Local\Temp\706.exe
Filesize
411KB

MD5
4d4aacaaac0146811970c85ce456cc2a

SHA1
bb25d5c6d7a9cc289c5195e13b2a0575289e6134

SHA256
771e19ccac62a39284a2e7e6929b5b3d770c151f0e1e79b54a987e41a02595e9

SHA512
4a0483cb4622240c6d9ad321e3e653f8bb0bc983feb20237473a63865eb5b284710081a06e563af5be69416b0e019c5da22a3bd6fd0dc91f6c009f01032ddef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\706.exe
Filesize
411KB

MD5
4d4aacaaac0146811970c85ce456cc2a

SHA1
bb25d5c6d7a9cc289c5195e13b2a0575289e6134

SHA256
771e19ccac62a39284a2e7e6929b5b3d770c151f0e1e79b54a987e41a02595e9

SHA512
4a0483cb4622240c6d9ad321e3e653f8bb0bc983feb20237473a63865eb5b284710081a06e563af5be69416b0e019c5da22a3bd6fd0dc91f6c009f01032ddef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD41.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD41.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD41.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD41.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD41.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\ae46b9ba-c270-4f43-afb7-32e7a1ed67a6\build2.exe
Filesize
367KB

MD5
3107999f9600f5f2bc88e17282da2773

SHA1
8862f9551fdb7dc30e135c556751b973f441e7b4

SHA256
aacab9cbbf292403a63bcfd1f6f0a9e534ac39aab406f2c9d7aa98b719f3801f

SHA512
50c66565fc457b848014eaf70b3f7cc408e8a818bd29c80daf53597a44c182d26649c249a6e3fe7e6516fc7ff7e7026f3aff4b25ee48645789fa6cd3d3e2f338

Download Submit
C:\Users\Admin\AppData\Local\ae46b9ba-c270-4f43-afb7-32e7a1ed67a6\build2.exe
Filesize
367KB

MD5
3107999f9600f5f2bc88e17282da2773

SHA1
8862f9551fdb7dc30e135c556751b973f441e7b4

SHA256
aacab9cbbf292403a63bcfd1f6f0a9e534ac39aab406f2c9d7aa98b719f3801f

SHA512
50c66565fc457b848014eaf70b3f7cc408e8a818bd29c80daf53597a44c182d26649c249a6e3fe7e6516fc7ff7e7026f3aff4b25ee48645789fa6cd3d3e2f338

Download Submit
C:\Users\Admin\AppData\Local\ae46b9ba-c270-4f43-afb7-32e7a1ed67a6\build2.exe
Filesize
367KB

MD5
3107999f9600f5f2bc88e17282da2773

SHA1
8862f9551fdb7dc30e135c556751b973f441e7b4

SHA256
aacab9cbbf292403a63bcfd1f6f0a9e534ac39aab406f2c9d7aa98b719f3801f

SHA512
50c66565fc457b848014eaf70b3f7cc408e8a818bd29c80daf53597a44c182d26649c249a6e3fe7e6516fc7ff7e7026f3aff4b25ee48645789fa6cd3d3e2f338

Download Submit
\ProgramData\mozglue.dll
Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\mozglue.dll
Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\ProgramData\nss3.dll
Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
memory/392-147-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/392-148-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/392-149-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/392-145-0x0000000000424141-mapping.dmp

Download
memory/948-139-0x0000000000000000-mapping.dmp

Download
memory/1328-138-0x0000000000000000-mapping.dmp

Download
memory/1420-181-0x0000000000000000-mapping.dmp

Download
memory/1712-131-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1712-132-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1712-126-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1712-129-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1712-127-0x0000000000424141-mapping.dmp

Download
memory/2356-141-0x0000000000000000-mapping.dmp

Download
memory/2376-119-0x0000000000000000-mapping.dmp

Download
memory/2376-130-0x0000000002320000-0x000000000243B000-memory.dmp

Filesize
1.1MB

Download
memory/3136-118-0x00000000008B0000-0x00000000008C6000-memory.dmp

Filesize
88KB

Download
memory/3480-157-0x00000000006E3000-0x000000000070E000-memory.dmp

Filesize
172KB

Download
memory/3480-150-0x0000000000000000-mapping.dmp

Download
memory/3680-182-0x0000000000000000-mapping.dmp

Download
memory/3788-183-0x0000000000000000-mapping.dmp

Download
memory/3976-154-0x000000000042103C-mapping.dmp

Download
memory/3976-156-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3976-158-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3976-153-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3976-159-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4316-116-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/4316-117-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4316-115-0x00000000004E0000-0x000000000062A000-memory.dmp

Filesize
1.3MB

Download
memory/4728-160-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/4728-135-0x0000000000630000-0x000000000077A000-memory.dmp

Filesize
1.3MB

Download
memory/4728-123-0x0000000000000000-mapping.dmp

Download
memory/4728-136-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/4728-134-0x0000000000630000-0x000000000077A000-memory.dmp

Filesize
1.3MB

Download
memory/5108-137-0x0000000000000000-mapping.dmp

Download