poullight | a456f1d4fa5aa51e8605e6fcb43579c41593c6ae7eb110c5bbdddd071b3ab1f8

General

Target

salikhack.exe
Size

6.8MB
MD5

92290d3c06e414319fb42fc0f7d981d0
SHA1

6396501c4acd9e06a44f75f136528535e8003dce
SHA256

3d10fcb6f54d01863d35000decd99bc4234266b668263035c55597e09c885f43
SHA512

2d59d0121b48e442ba2d2af2639afe928664238ef51e819a634c7c71aebfbaf87f3e8a033285111046d2f50c9a286b611143aac5c227a000ec5d4be65e5bc294

Score

10^/10

poullight persistence spyware stealer suricata trojan

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\build.exe	family_poullight
C:\Users\Admin\AppData\Local\Temp\build.exe	family_poullight
behavioral2/memory/4080-133-0x0000025333C00000-0x0000025333C20000-memory.dmp	family_poullight

suricata: ET MALWARE Likely Malware CnC Hosted on 000webhostapp - POST to gate.php
suricata: ET MALWARE Likely Malware CnC Hosted on 000webhostapp - POST to gate.php
suricata
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata
Executes dropped EXE 3 IoCs

Processes:

build.exesakl.exeasx0.dll

pid process

4080 build.exe
448 sakl.exe
364 asx0.dll

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

salikhack.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	salikhack.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs

Processes:

asx0.dll

pid	process
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll
364	asx0.dll

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2b6ced14-b747-4ec2-a7b9-07ad883e10dd.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220520080845.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3100 364 WerFault.exe asx0.dll

pid	pid_target	process	target process
3100	364	WerFault.exe	asx0.dll

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

asx0.dllmsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	asx0.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	asx0.dll

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

build.exesakl.exe

pid	process
4080	build.exe
4080	build.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe
448	sakl.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

5004 msedge.exe
5004 msedge.exe
5004 msedge.exe
5004 msedge.exe
5004 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

build.exe

description pid process

Token: SeDebugPrivilege 4080 build.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

5004 msedge.exe
5004 msedge.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

sakl.exeasx0.dll

pid process

448 sakl.exe
448 sakl.exe
364 asx0.dll
364 asx0.dll

pid	process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

description	pid	process
Token: SeDebugPrivilege	4080	build.exe

pid	process
5004	msedge.exe
5004	msedge.exe

pid	process
448	sakl.exe
448	sakl.exe
364	asx0.dll
364	asx0.dll

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

salikhack.exesakl.exemsedge.exe

description	pid	process	target process
PID 3864 wrote to memory of 4080	3864	salikhack.exe	build.exe
PID 3864 wrote to memory of 4080	3864	salikhack.exe	build.exe
PID 3864 wrote to memory of 448	3864	salikhack.exe	sakl.exe
PID 3864 wrote to memory of 448	3864	salikhack.exe	sakl.exe
PID 3864 wrote to memory of 448	3864	salikhack.exe	sakl.exe
PID 448 wrote to memory of 5004	448	sakl.exe	msedge.exe
PID 448 wrote to memory of 5004	448	sakl.exe	msedge.exe
PID 5004 wrote to memory of 716	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 716	5004	msedge.exe	msedge.exe
PID 448 wrote to memory of 364	448	sakl.exe	asx0.dll
PID 448 wrote to memory of 364	448	sakl.exe	asx0.dll
PID 448 wrote to memory of 364	448	sakl.exe	asx0.dll
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 1872	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 3756	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 3756	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 2760	5004	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\salikhack.exe
"C:\Users\Admin\AppData\Local\Temp\salikhack.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3864

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Users\Admin\AppData\Local\Temp\sakl.exe
"C:\Users\Admin\AppData\Local\Temp\sakl.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://jq.qq.com/?_wv=1027&k=57Cts1S
3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe156246f8,0x7ffe15624708,0x7ffe15624718
4⤵
PID:716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2480 /prefetch:2
4⤵
PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
4⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3088 /prefetch:8
4⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
4⤵
PID:660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
4⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4384 /prefetch:8
4⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5480 /prefetch:8
4⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
4⤵
PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
4⤵
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
4⤵
PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
4⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
- Drops file in Program Files directory
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff7e2be5460,0x7ff7e2be5470,0x7ff7e2be5480
5⤵
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
4⤵
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6044 /prefetch:8
4⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1688 /prefetch:8
4⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,2455958903178951283,15677626279087264564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1724 /prefetch:8
4⤵
PID:4952

C:\Users\Admin\AppData\Local\Temp\asx0.dll
"C:\Users\Admin\AppData\Local\Temp\asx0.dll"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 696
4⤵
- Program crash
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 364 -ip 364
1⤵
PID:2592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asx0.dll
Filesize
5.9MB

MD5
8d7cfce5a4716b167952e569a04ad5dc

SHA1
def4fa116d274403626ba33edc2604137689842f

SHA256
87979231d7f6bc01754071903035f784ffcb0a246a926b1d0b1e10493241907e

SHA512
d27123dacedca9933b484fcb432a411bb66ae5073fc6b3e2e178a5f554b69d84cf069bdddf35b83921670506bc2c0764e60310c6ca64adc89dd68e9fa90be26e

Download Submit
C:\Users\Admin\AppData\Local\Temp\asx0.dll
Filesize
5.9MB

MD5
8d7cfce5a4716b167952e569a04ad5dc

SHA1
def4fa116d274403626ba33edc2604137689842f

SHA256
87979231d7f6bc01754071903035f784ffcb0a246a926b1d0b1e10493241907e

SHA512
d27123dacedca9933b484fcb432a411bb66ae5073fc6b3e2e178a5f554b69d84cf069bdddf35b83921670506bc2c0764e60310c6ca64adc89dd68e9fa90be26e

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
Filesize
100KB

MD5
446afe801f9738ee2bfcb6791bdcf801

SHA1
fc43f35cd105e8954d77d8f7a48234e2576fe98e

SHA256
ba098b19bb32b3224c759d7853f4e0ebd5751f8cf5615bcdca3d52440fa07ccc

SHA512
f7748de18d35523aab05879944c1bfdda9a78c0b49e9b82c96b78f2e9dc8902848706857771c29cd769288d6ab98fb4b2398a92c240eca09e8dd27f297ebe92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
Filesize
100KB

MD5
446afe801f9738ee2bfcb6791bdcf801

SHA1
fc43f35cd105e8954d77d8f7a48234e2576fe98e

SHA256
ba098b19bb32b3224c759d7853f4e0ebd5751f8cf5615bcdca3d52440fa07ccc

SHA512
f7748de18d35523aab05879944c1bfdda9a78c0b49e9b82c96b78f2e9dc8902848706857771c29cd769288d6ab98fb4b2398a92c240eca09e8dd27f297ebe92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\sakl.exe
Filesize
6.7MB

MD5
06dcffb60e21650a7853af9a88b9a04e

SHA1
0021f7ae05f12f54ba5edfb2fb0c957f12fb5f4f

SHA256
f60632e252f6fae33c0f9b4cbff4a646d35d1504d1ed0c32cb03884bd900befe

SHA512
2b9e599c5e6fd498d7120e5c17cf70f79b7d15c27f820305ea0a17b1612a6aee72a07d7a85a8ec35c8a9f9eeedc3e829cea6d6d7c9dcb86f58aa76137a4a17c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\sakl.exe
Filesize
6.7MB

MD5
06dcffb60e21650a7853af9a88b9a04e

SHA1
0021f7ae05f12f54ba5edfb2fb0c957f12fb5f4f

SHA256
f60632e252f6fae33c0f9b4cbff4a646d35d1504d1ed0c32cb03884bd900befe

SHA512
2b9e599c5e6fd498d7120e5c17cf70f79b7d15c27f820305ea0a17b1612a6aee72a07d7a85a8ec35c8a9f9eeedc3e829cea6d6d7c9dcb86f58aa76137a4a17c6

Download Submit
\??\pipe\LOCAL\crashpad_5004_XSNAHOKFVMNQUQYE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/364-1511-0x0000000000400000-0x0000000000A5D000-memory.dmp

Filesize
6.4MB

Download
memory/364-1497-0x0000000000400000-0x0000000000A5D000-memory.dmp

Filesize
6.4MB

Download
memory/364-1495-0x0000000000400000-0x0000000000A5D000-memory.dmp

Filesize
6.4MB

Download
memory/364-1494-0x0000000000400000-0x0000000000A5D000-memory.dmp

Filesize
6.4MB

Download
memory/364-1493-0x0000000000400000-0x0000000000A5D000-memory.dmp

Filesize
6.4MB

Download
memory/364-142-0x0000000000000000-mapping.dmp

Download
memory/364-1492-0x0000000000400000-0x0000000000A5D000-memory.dmp

Filesize
6.4MB

Download
memory/364-149-0x00000000765A0000-0x000000007661A000-memory.dmp

Filesize
488KB

Download
memory/364-145-0x00000000774B0000-0x0000000077653000-memory.dmp

Filesize
1.6MB

Download
memory/364-146-0x0000000076AB0000-0x0000000076CC5000-memory.dmp

Filesize
2.1MB

Download
memory/364-148-0x0000000075550000-0x00000000756F0000-memory.dmp

Filesize
1.6MB

Download
memory/448-134-0x0000000000000000-mapping.dmp

Download
memory/448-138-0x0000000002740000-0x000000000284D000-memory.dmp

Filesize
1.1MB

Download
memory/648-1523-0x0000000000000000-mapping.dmp

Download
memory/660-1508-0x0000000000000000-mapping.dmp

Download
memory/716-140-0x0000000000000000-mapping.dmp

Download
memory/1172-1522-0x0000000000000000-mapping.dmp

Download
memory/1236-1517-0x0000000000000000-mapping.dmp

Download
memory/1872-1502-0x0000000000000000-mapping.dmp

Download
memory/2760-1506-0x0000000000000000-mapping.dmp

Download
memory/3160-1521-0x0000000000000000-mapping.dmp

Download
memory/3252-1515-0x0000000000000000-mapping.dmp

Download
memory/3324-1526-0x0000000000000000-mapping.dmp

Download
memory/3756-1503-0x0000000000000000-mapping.dmp

Download
memory/3832-1510-0x0000000000000000-mapping.dmp

Download
memory/3840-1519-0x0000000000000000-mapping.dmp

Download
memory/4080-130-0x0000000000000000-mapping.dmp

Download
memory/4080-1499-0x000002534FEF0000-0x0000025350418000-memory.dmp

Filesize
5.2MB

Download
memory/4080-1498-0x000002534F7F0000-0x000002534F9B2000-memory.dmp

Filesize
1.8MB

Download
memory/4080-133-0x0000025333C00000-0x0000025333C20000-memory.dmp

Filesize
128KB

Download
memory/4080-137-0x00007FFE1A130000-0x00007FFE1ABF1000-memory.dmp

Filesize
10.8MB

Download
memory/4080-141-0x0000025335870000-0x000002533587A000-memory.dmp

Filesize
40KB

Download
memory/4080-1500-0x000002534F3A0000-0x000002534F3B2000-memory.dmp

Filesize
72KB

Download
memory/4348-1524-0x0000000000000000-mapping.dmp

Download
memory/4356-1513-0x0000000000000000-mapping.dmp

Download
memory/4952-1530-0x0000000000000000-mapping.dmp

Download
memory/4996-1528-0x0000000000000000-mapping.dmp

Download
memory/5004-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads