Analysis
-
max time kernel
302s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-06-2022 13:52
Static task
static1
Behavioral task
behavioral1
Sample
12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe
Resource
win7-20220414-en
General
-
Target
12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe
-
Size
929KB
-
MD5
93b07745eaf59eb167bfd31d9fd2d57c
-
SHA1
832b665f85fb2ff1161ee8e11ec668c099e3dc2f
-
SHA256
12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a
-
SHA512
350267c3f59b39280f649e0ca3bfbfe0d1b3637002d4e866c7af88d6acd82509ca1d0c7e08ac5d0fe6628fa17d777ab9d37d5b1cd48fa140ac9675d6b88e8577
Malware Config
Extracted
xloader
2.6
uj3c
copimetro.com
choonchain.com
luxxwireless.com
fashionweekofcincinnati.com
campingshare.net
suncochina.com
kidsfundoor.com
testingnyc.co
lovesoe.com
vehiclesbeenrecord.com
socialpearmarketing.com
maxproductdji.com
getallarticle.online
forummind.com
arenamarenostrum.com
trisuaka.xyz
designgamagazine.com
chateaulehotel.com
huangse5.com
esginvestment.tech
intercontinentalship.com
moneytaoism.com
agardenfortwo.com
trendiddas.com
fjuoomw.xyz
dantvilla.com
shopwithtrooperdavecom.com
lanwenzong.com
xpertsrealty.com
gamelabsmash.com
nomaxdic.com
chillyracing.com
mypleasure-blog.com
projectkyla.com
florurbana.com
oneplacemexico.com
gografic.com
giantht.com
dotombori-base.com
westlifinance.online
maacsecurity.com
lydas.info
instapandas.com
labustiadepaper.net
unglue52.com
onurnet.net
wellkept.info
6111.site
platinumroofingsusa.com
bodyplex.fitness
empireapothecary.com
meigsbuilds.online
garygrover.com
nicholasnikas.com
yd9992.com
protections-clients.info
sueyhzx.com
naturathome.info
superinformatico.net
printsgarden.com
xn--qn1b03fy2b841b.com
preferable.info
ozzyconstructionma.com
10stopp.online
nutricognition.com
Extracted
formbook
4.1
n7ak
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
citromudas3a.com
plasticstone.icu
pawchamamapet.com
beautybybby.com
mor-n-mor.com
getoffyourhighhorses.com
chieucaochoban9.xyz
grahamevansmp.com
amplaassessoria.net
nutricookindia.com
wazymbex.icu
joansironing.com
hallforless.com
mycourseprofits.com
precps.com
cookislandstourismpodcast.com
bestonlinedealslive.com
bug.chat
ptjbtoqonjtrwpvkfgmjvwp.com
tortniespodzianka.store
qxkbjgj.icu
aurashape.com
guinealive.com
mondialeresources.com
offthebreak.site
maxamproductivity.com
thebiztip.com
thelocalrea.com
laeducacionadistancia.com
inpakgroup.com
lvgang360.com
allvegangoods.com
tymudanzaramos.com
simpleframeswork.com
thehappycars.com
directfenetres.net
norskatferdsterapi.com
hostingcnx.com
ksmh5x.com
thespiritworldinvitational.com
jetsetwilly3.com
gameflexdev.com
tryhuge.com
vaporvspaper.com
kmresults.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2408-249-0x0000000000000000-mapping.dmp formbook behavioral2/memory/2408-270-0x0000000010410000-0x000000001043E000-memory.dmp formbook behavioral2/memory/1444-276-0x0000000000720000-0x000000000074E000-memory.dmp formbook behavioral2/memory/1444-281-0x0000000000720000-0x000000000074E000-memory.dmp formbook -
ModiLoader Second Stage 56 IoCs
Processes:
resource yara_rule behavioral2/memory/2136-140-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-141-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-143-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-142-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-145-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-146-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-147-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-144-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-149-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-150-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-151-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-148-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-153-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-152-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-154-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-155-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-156-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-157-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-159-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-158-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-160-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-161-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-162-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-163-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-164-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-165-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-169-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-170-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-172-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-171-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-173-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-181-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-182-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-180-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-183-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-184-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-185-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-186-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/2136-187-0x0000000003AF0000-0x0000000003B42000-memory.dmp modiloader_stage2 behavioral2/memory/4008-221-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-222-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-224-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-223-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-226-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-227-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-228-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-225-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-230-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-231-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-232-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-229-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-234-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-233-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-235-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-236-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 behavioral2/memory/4008-237-0x00000000039D0000-0x0000000003A24000-memory.dmp modiloader_stage2 -
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2136-167-0x0000000010410000-0x000000001043B000-memory.dmp xloader behavioral2/memory/4408-168-0x0000000000000000-mapping.dmp xloader behavioral2/memory/4408-193-0x0000000010410000-0x000000001043B000-memory.dmp xloader behavioral2/memory/1692-197-0x00000000007D0000-0x00000000007FB000-memory.dmp xloader behavioral2/memory/1692-200-0x00000000007D0000-0x00000000007FB000-memory.dmp xloader -
Blocklisted process makes network request 4 IoCs
Processes:
cmd.exeflow pid process 77 1692 cmd.exe 97 1692 cmd.exe 102 1692 cmd.exe 111 1692 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
h8tpnr.exevdbxnonst.exeej7p5zix.exepid process 4008 h8tpnr.exe 4532 vdbxnonst.exe 2544 ej7p5zix.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
h8tpnr.exe12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.execmd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gsnaatekuq = "C:\\Users\\Public\\Libraries\\quketaansG.url" h8tpnr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ixknjgjdxi = "C:\\Users\\Public\\Libraries\\ixdjgjnkxI.url" 12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ODCXTXTPO6 = "C:\\Program Files (x86)\\Eohl\\vdbxnonst.exe" cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
logagent.execmd.exeDpiScaling.exemsdt.exedescription pid process target process PID 4408 set thread context of 8 4408 logagent.exe Explorer.EXE PID 1692 set thread context of 8 1692 cmd.exe Explorer.EXE PID 2408 set thread context of 8 2408 DpiScaling.exe Explorer.EXE PID 1444 set thread context of 8 1444 msdt.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
cmd.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Eohl\vdbxnonst.exe cmd.exe File opened for modification C:\Program Files (x86)\Eohl Explorer.EXE File created C:\Program Files (x86)\Eohl\vdbxnonst.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Eohl\vdbxnonst.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
cmd.exedescription ioc process Key created \Registry\User\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
logagent.execmd.exeDpiScaling.exemsdt.exepid process 4408 logagent.exe 4408 logagent.exe 4408 logagent.exe 4408 logagent.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 2408 DpiScaling.exe 2408 DpiScaling.exe 2408 DpiScaling.exe 2408 DpiScaling.exe 1692 cmd.exe 1692 cmd.exe 1444 msdt.exe 1444 msdt.exe 1444 msdt.exe 1444 msdt.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1444 msdt.exe 1444 msdt.exe 1692 cmd.exe 1692 cmd.exe 1444 msdt.exe 1444 msdt.exe 1692 cmd.exe 1692 cmd.exe 1444 msdt.exe 1444 msdt.exe 1692 cmd.exe 1692 cmd.exe 1444 msdt.exe 1444 msdt.exe 1692 cmd.exe 1692 cmd.exe 1444 msdt.exe 1444 msdt.exe 1692 cmd.exe 1692 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE -
Suspicious behavior: MapViewOfSection 12 IoCs
Processes:
logagent.execmd.exeDpiScaling.exemsdt.exepid process 4408 logagent.exe 4408 logagent.exe 4408 logagent.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 1692 cmd.exe 2408 DpiScaling.exe 2408 DpiScaling.exe 2408 DpiScaling.exe 1444 msdt.exe 1444 msdt.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
logagent.execmd.exeExplorer.EXEDpiScaling.exemsdt.exedescription pid process Token: SeDebugPrivilege 4408 logagent.exe Token: SeDebugPrivilege 1692 cmd.exe Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeDebugPrivilege 2408 DpiScaling.exe Token: SeDebugPrivilege 1444 msdt.exe Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exeExplorer.EXEcmd.exeh8tpnr.exemsdt.exedescription pid process target process PID 2136 wrote to memory of 4408 2136 12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe logagent.exe PID 2136 wrote to memory of 4408 2136 12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe logagent.exe PID 2136 wrote to memory of 4408 2136 12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe logagent.exe PID 2136 wrote to memory of 4408 2136 12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe logagent.exe PID 2136 wrote to memory of 4408 2136 12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe logagent.exe PID 2136 wrote to memory of 4408 2136 12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe logagent.exe PID 8 wrote to memory of 1692 8 Explorer.EXE cmd.exe PID 8 wrote to memory of 1692 8 Explorer.EXE cmd.exe PID 8 wrote to memory of 1692 8 Explorer.EXE cmd.exe PID 1692 wrote to memory of 2684 1692 cmd.exe cmd.exe PID 1692 wrote to memory of 2684 1692 cmd.exe cmd.exe PID 1692 wrote to memory of 2684 1692 cmd.exe cmd.exe PID 1692 wrote to memory of 4616 1692 cmd.exe cmd.exe PID 1692 wrote to memory of 4616 1692 cmd.exe cmd.exe PID 1692 wrote to memory of 4616 1692 cmd.exe cmd.exe PID 1692 wrote to memory of 1128 1692 cmd.exe cmd.exe PID 1692 wrote to memory of 1128 1692 cmd.exe cmd.exe PID 1692 wrote to memory of 1128 1692 cmd.exe cmd.exe PID 1692 wrote to memory of 764 1692 cmd.exe Firefox.exe PID 1692 wrote to memory of 764 1692 cmd.exe Firefox.exe PID 1692 wrote to memory of 764 1692 cmd.exe Firefox.exe PID 1692 wrote to memory of 4008 1692 cmd.exe h8tpnr.exe PID 1692 wrote to memory of 4008 1692 cmd.exe h8tpnr.exe PID 1692 wrote to memory of 4008 1692 cmd.exe h8tpnr.exe PID 4008 wrote to memory of 2408 4008 h8tpnr.exe DpiScaling.exe PID 4008 wrote to memory of 2408 4008 h8tpnr.exe DpiScaling.exe PID 4008 wrote to memory of 2408 4008 h8tpnr.exe DpiScaling.exe PID 4008 wrote to memory of 2408 4008 h8tpnr.exe DpiScaling.exe PID 4008 wrote to memory of 2408 4008 h8tpnr.exe DpiScaling.exe PID 4008 wrote to memory of 2408 4008 h8tpnr.exe DpiScaling.exe PID 8 wrote to memory of 1444 8 Explorer.EXE msdt.exe PID 8 wrote to memory of 1444 8 Explorer.EXE msdt.exe PID 8 wrote to memory of 1444 8 Explorer.EXE msdt.exe PID 1444 wrote to memory of 4592 1444 msdt.exe cmd.exe PID 1444 wrote to memory of 4592 1444 msdt.exe cmd.exe PID 1444 wrote to memory of 4592 1444 msdt.exe cmd.exe PID 8 wrote to memory of 4532 8 Explorer.EXE vdbxnonst.exe PID 8 wrote to memory of 4532 8 Explorer.EXE vdbxnonst.exe PID 8 wrote to memory of 4532 8 Explorer.EXE vdbxnonst.exe PID 1692 wrote to memory of 2544 1692 cmd.exe ej7p5zix.exe PID 1692 wrote to memory of 2544 1692 cmd.exe ej7p5zix.exe PID 1692 wrote to memory of 2544 1692 cmd.exe ej7p5zix.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe"C:\Users\Admin\AppData\Local\Temp\12fd21cbec194aad7f97eb21ca373742d6992b18c7f54eab1c71ecef3d874f3a.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\h8tpnr.exe"C:\Users\Admin\AppData\Local\Temp\h8tpnr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ej7p5zix.exe"C:\Users\Admin\AppData\Local\Temp\ej7p5zix.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
-
C:\Program Files (x86)\Eohl\vdbxnonst.exe"C:\Program Files (x86)\Eohl\vdbxnonst.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Eohl\vdbxnonst.exeFilesize
86KB
MD5523a40703dd9e7da957aa92a204cb1c4
SHA12a069bff58a87f7d2b405fdf87634fb2ce213b21
SHA256058e1a4389ae837fafc6a7bdfca2abf33ceb6915410edbc4b2ebca052e4f13a6
SHA512ca5002ebddb39acd0dbbeb77297ffb719a36bc8288ad6f2732247a28cbf1a6fe7cd238ef126f6b1cca3f259cab55a5c01e3bfcd9bda3d25097233093bdb940bf
-
C:\Program Files (x86)\Eohl\vdbxnonst.exeFilesize
86KB
MD5523a40703dd9e7da957aa92a204cb1c4
SHA12a069bff58a87f7d2b405fdf87634fb2ce213b21
SHA256058e1a4389ae837fafc6a7bdfca2abf33ceb6915410edbc4b2ebca052e4f13a6
SHA512ca5002ebddb39acd0dbbeb77297ffb719a36bc8288ad6f2732247a28cbf1a6fe7cd238ef126f6b1cca3f259cab55a5c01e3bfcd9bda3d25097233093bdb940bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442Filesize
1KB
MD521cd26f84067808d04d9cc2612519723
SHA1ff4b88b954eb688f9a509fce25a1b9a758b7b833
SHA256d64140cdb8de87a068eccd819a98c89c6bfbc39c0e62082f309070fc80760dda
SHA5124a1093382dc198dbf1bc1bf2a6804f474170d837edbdfc1b85f1a2c3e8c5120c0c8b16452463a55fc817e5e32f15df4ff4de4ddc3d501e033bbef388e3f42615
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442Filesize
416B
MD56a3754b90534ddcef2946a8610b09010
SHA19b067045acdd21d1aa86acf5a51dbd3cd7569a2e
SHA2564e6216bc0120f35899cd381c721e686a778288fa198d720121058dc04845f801
SHA51289fa0e942c1583c1ca6561d795b70b3637da1b91415cc650bd73481948fc052d9699bca6c8eb7f1f90ef1b2c2aeee2e6ef5da89f9ee5f15c7bead5ea84d64fc9
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\ej7p5zix.exeFilesize
892KB
MD51586ba86228b75478e39c18a4414cea0
SHA175467b96d2a138df8ee42355dd228212d60c6c51
SHA2567a33326911b7cc7ba3dc7c64feeda67e8b396f261bc5789833dfac686c4d7748
SHA512a6ac5b85d5c0960e04c80c86c4347c7a6d8751920ef02d8c058fb81a4ec86779d38a1beb7564c36f0926f8f57045610b7e5a5bed9a128df54b722a0ed56eb667
-
C:\Users\Admin\AppData\Local\Temp\h8tpnr.exeFilesize
892KB
MD51586ba86228b75478e39c18a4414cea0
SHA175467b96d2a138df8ee42355dd228212d60c6c51
SHA2567a33326911b7cc7ba3dc7c64feeda67e8b396f261bc5789833dfac686c4d7748
SHA512a6ac5b85d5c0960e04c80c86c4347c7a6d8751920ef02d8c058fb81a4ec86779d38a1beb7564c36f0926f8f57045610b7e5a5bed9a128df54b722a0ed56eb667
-
C:\Users\Admin\AppData\Local\Temp\h8tpnr.exeFilesize
892KB
MD51586ba86228b75478e39c18a4414cea0
SHA175467b96d2a138df8ee42355dd228212d60c6c51
SHA2567a33326911b7cc7ba3dc7c64feeda67e8b396f261bc5789833dfac686c4d7748
SHA512a6ac5b85d5c0960e04c80c86c4347c7a6d8751920ef02d8c058fb81a4ec86779d38a1beb7564c36f0926f8f57045610b7e5a5bed9a128df54b722a0ed56eb667
-
memory/8-201-0x0000000008360000-0x000000000849C000-memory.dmpFilesize
1.2MB
-
memory/8-191-0x0000000007D90000-0x0000000007EF7000-memory.dmpFilesize
1.4MB
-
memory/8-273-0x00000000084A0000-0x00000000085F6000-memory.dmpFilesize
1.3MB
-
memory/8-280-0x00000000086D0000-0x000000000880A000-memory.dmpFilesize
1.2MB
-
memory/8-199-0x0000000008360000-0x000000000849C000-memory.dmpFilesize
1.2MB
-
memory/8-282-0x00000000086D0000-0x000000000880A000-memory.dmpFilesize
1.2MB
-
memory/1128-204-0x0000000000000000-mapping.dmp
-
memory/1444-279-0x0000000002830000-0x00000000028C3000-memory.dmpFilesize
588KB
-
memory/1444-274-0x0000000000000000-mapping.dmp
-
memory/1444-276-0x0000000000720000-0x000000000074E000-memory.dmpFilesize
184KB
-
memory/1444-275-0x0000000000FD0000-0x0000000001027000-memory.dmpFilesize
348KB
-
memory/1444-278-0x0000000002AF0000-0x0000000002E3A000-memory.dmpFilesize
3.3MB
-
memory/1444-281-0x0000000000720000-0x000000000074E000-memory.dmpFilesize
184KB
-
memory/1692-200-0x00000000007D0000-0x00000000007FB000-memory.dmpFilesize
172KB
-
memory/1692-198-0x0000000001240000-0x00000000012D0000-memory.dmpFilesize
576KB
-
memory/1692-197-0x00000000007D0000-0x00000000007FB000-memory.dmpFilesize
172KB
-
memory/1692-196-0x0000000000F40000-0x0000000000F9A000-memory.dmpFilesize
360KB
-
memory/1692-195-0x0000000001510000-0x000000000185A000-memory.dmpFilesize
3.3MB
-
memory/1692-192-0x0000000000000000-mapping.dmp
-
memory/2136-164-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-162-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-172-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-171-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-173-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-181-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-182-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-180-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-183-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-184-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-185-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-186-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-187-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-141-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-153-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-169-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-143-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-142-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-170-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-167-0x0000000010410000-0x000000001043B000-memory.dmpFilesize
172KB
-
memory/2136-165-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-140-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-163-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-148-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-161-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-160-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-145-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-158-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-159-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-157-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-146-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-156-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-155-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-154-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-152-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-147-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-144-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-149-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-150-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2136-151-0x0000000003AF0000-0x0000000003B42000-memory.dmpFilesize
328KB
-
memory/2408-249-0x0000000000000000-mapping.dmp
-
memory/2408-272-0x0000000002B90000-0x0000000002BA4000-memory.dmpFilesize
80KB
-
memory/2408-271-0x0000000002C80000-0x0000000002FCA000-memory.dmpFilesize
3.3MB
-
memory/2408-270-0x0000000010410000-0x000000001043E000-memory.dmpFilesize
184KB
-
memory/2544-286-0x0000000000000000-mapping.dmp
-
memory/2684-194-0x0000000000000000-mapping.dmp
-
memory/4008-226-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-222-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-228-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-235-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-223-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-237-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-232-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-234-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-230-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-233-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-229-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-227-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-225-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-236-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-231-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-224-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4008-206-0x0000000000000000-mapping.dmp
-
memory/4008-221-0x00000000039D0000-0x0000000003A24000-memory.dmpFilesize
336KB
-
memory/4408-190-0x0000000003130000-0x0000000003141000-memory.dmpFilesize
68KB
-
memory/4408-189-0x00000000032F0000-0x000000000363A000-memory.dmpFilesize
3.3MB
-
memory/4408-193-0x0000000010410000-0x000000001043B000-memory.dmpFilesize
172KB
-
memory/4408-168-0x0000000000000000-mapping.dmp
-
memory/4532-283-0x0000000000000000-mapping.dmp
-
memory/4592-277-0x0000000000000000-mapping.dmp
-
memory/4616-202-0x0000000000000000-mapping.dmp