Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2022 08:48
Static task
static1
General
-
Target
6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe
-
Size
657KB
-
MD5
408866829065c70ccb93d6af75b2f04b
-
SHA1
c2abb3f1434d1f1996dc6569f1d289eda41edcca
-
SHA256
6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667
-
SHA512
724ed56fc9409f77e8c804101f45de8ccf453642b59f124c647dc3ef5936ce2adbb74befdd5d1590cc3b9fe7ef1f9a864128b545ae5746cb822f22c19244af45
-
SSDEEP
6144:VoxIpwTnoNlR/DU7yhezwmQsrmMxzG8pCoHM3g:VoxIpwTnoDR/DUmhwxQspo8VsQ
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Detectes Phoenix Miner Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\MSEdge\svchost.exe miner_phoenix C:\Users\Admin\AppData\Roaming\MSEdge\svchost.exe miner_phoenix -
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
conhost.execonhost.exemsedge.exesvchost.exe608BGFDB8FBMCHF.exetmp5A36.tmp.exetmp5A36.tmp.exeGE612F263IJMH73.exetmp6DFC.tmp.exetmp6DFC.tmp.exetmp6DFC.tmp.exeAGLGB1MJABH92IA.exe94MI9B1DD1EIKG6.exepid process 312 conhost.exe 364 conhost.exe 1888 msedge.exe 220 svchost.exe 3124 608BGFDB8FBMCHF.exe 3900 tmp5A36.tmp.exe 4668 tmp5A36.tmp.exe 1152 GE612F263IJMH73.exe 2380 tmp6DFC.tmp.exe 3868 tmp6DFC.tmp.exe 2684 tmp6DFC.tmp.exe 3812 AGLGB1MJABH92IA.exe 4316 94MI9B1DD1EIKG6.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
608BGFDB8FBMCHF.exeGE612F263IJMH73.exeAGLGB1MJABH92IA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 608BGFDB8FBMCHF.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation GE612F263IJMH73.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation AGLGB1MJABH92IA.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 856 rundll32.exe 4508 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdge = "C:\\Users\\Admin\\AppData\\Roaming\\MSEdge\\msedge.exe" 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
svchost.exepid process 220 svchost.exe 220 svchost.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.execonhost.exe6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exetmp5A36.tmp.exetmp6DFC.tmp.exedescription pid process target process PID 4648 set thread context of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 312 set thread context of 364 312 conhost.exe conhost.exe PID 1580 set thread context of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 3900 set thread context of 4668 3900 tmp5A36.tmp.exe tmp5A36.tmp.exe PID 3868 set thread context of 2684 3868 tmp6DFC.tmp.exe tmp6DFC.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
94MI9B1DD1EIKG6.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 94MI9B1DD1EIKG6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 94MI9B1DD1EIKG6.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync 94MI9B1DD1EIKG6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 94MI9B1DD1EIKG6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
608BGFDB8FBMCHF.exeGE612F263IJMH73.exepid process 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 1152 GE612F263IJMH73.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe 3124 608BGFDB8FBMCHF.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
608BGFDB8FBMCHF.exeGE612F263IJMH73.exedescription pid process Token: SeDebugPrivilege 3124 608BGFDB8FBMCHF.exe Token: SeDebugPrivilege 1152 GE612F263IJMH73.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
94MI9B1DD1EIKG6.exepid process 4316 94MI9B1DD1EIKG6.exe 4316 94MI9B1DD1EIKG6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.execonhost.exe6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.execmd.exemsedge.exe608BGFDB8FBMCHF.exetmp5A36.tmp.exeGE612F263IJMH73.exetmp6DFC.tmp.exetmp6DFC.tmp.exedescription pid process target process PID 4648 wrote to memory of 312 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe conhost.exe PID 4648 wrote to memory of 312 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe conhost.exe PID 4648 wrote to memory of 312 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe conhost.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 312 wrote to memory of 364 312 conhost.exe conhost.exe PID 312 wrote to memory of 364 312 conhost.exe conhost.exe PID 312 wrote to memory of 364 312 conhost.exe conhost.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 4648 wrote to memory of 1580 4648 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 312 wrote to memory of 364 312 conhost.exe conhost.exe PID 312 wrote to memory of 364 312 conhost.exe conhost.exe PID 312 wrote to memory of 364 312 conhost.exe conhost.exe PID 312 wrote to memory of 364 312 conhost.exe conhost.exe PID 1580 wrote to memory of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 1580 wrote to memory of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 1580 wrote to memory of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 1580 wrote to memory of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 1580 wrote to memory of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 1580 wrote to memory of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 1580 wrote to memory of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 1580 wrote to memory of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 1580 wrote to memory of 4444 1580 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe PID 4444 wrote to memory of 2064 4444 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe cmd.exe PID 4444 wrote to memory of 2064 4444 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe cmd.exe PID 4444 wrote to memory of 2064 4444 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe cmd.exe PID 2064 wrote to memory of 1888 2064 cmd.exe msedge.exe PID 2064 wrote to memory of 1888 2064 cmd.exe msedge.exe PID 1888 wrote to memory of 220 1888 msedge.exe svchost.exe PID 1888 wrote to memory of 220 1888 msedge.exe svchost.exe PID 4444 wrote to memory of 3124 4444 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 608BGFDB8FBMCHF.exe PID 4444 wrote to memory of 3124 4444 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe 608BGFDB8FBMCHF.exe PID 3124 wrote to memory of 3900 3124 608BGFDB8FBMCHF.exe tmp5A36.tmp.exe PID 3124 wrote to memory of 3900 3124 608BGFDB8FBMCHF.exe tmp5A36.tmp.exe PID 3124 wrote to memory of 3900 3124 608BGFDB8FBMCHF.exe tmp5A36.tmp.exe PID 3900 wrote to memory of 4668 3900 tmp5A36.tmp.exe tmp5A36.tmp.exe PID 3900 wrote to memory of 4668 3900 tmp5A36.tmp.exe tmp5A36.tmp.exe PID 3900 wrote to memory of 4668 3900 tmp5A36.tmp.exe tmp5A36.tmp.exe PID 3900 wrote to memory of 4668 3900 tmp5A36.tmp.exe tmp5A36.tmp.exe PID 3900 wrote to memory of 4668 3900 tmp5A36.tmp.exe tmp5A36.tmp.exe PID 3900 wrote to memory of 4668 3900 tmp5A36.tmp.exe tmp5A36.tmp.exe PID 3900 wrote to memory of 4668 3900 tmp5A36.tmp.exe tmp5A36.tmp.exe PID 4444 wrote to memory of 1152 4444 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe GE612F263IJMH73.exe PID 4444 wrote to memory of 1152 4444 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe GE612F263IJMH73.exe PID 1152 wrote to memory of 2380 1152 GE612F263IJMH73.exe tmp6DFC.tmp.exe PID 1152 wrote to memory of 2380 1152 GE612F263IJMH73.exe tmp6DFC.tmp.exe PID 1152 wrote to memory of 2380 1152 GE612F263IJMH73.exe tmp6DFC.tmp.exe PID 2380 wrote to memory of 3868 2380 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 2380 wrote to memory of 3868 2380 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 2380 wrote to memory of 3868 2380 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 3868 wrote to memory of 2684 3868 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 3868 wrote to memory of 2684 3868 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 3868 wrote to memory of 2684 3868 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 3868 wrote to memory of 2684 3868 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 3868 wrote to memory of 2684 3868 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 3868 wrote to memory of 2684 3868 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 3868 wrote to memory of 2684 3868 tmp6DFC.tmp.exe tmp6DFC.tmp.exe PID 4444 wrote to memory of 3812 4444 6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe AGLGB1MJABH92IA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe"C:\Users\Admin\AppData\Local\Temp\6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\conhost.exe"C:\ProgramData\conhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\conhost.exe"C:\ProgramData\conhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe"C:\Users\Admin\AppData\Local\Temp\6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe"C:\Users\Admin\AppData\Local\Temp\6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exeC:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MSEdge\svchost.exe-pool us-eth.2miners.com:2020 -wal 0x298a98736156cdffdfaf4580afc4966904f1e12e -worker ferma -epsw x -mode 1 -log 0 -mport 0 -etha 0 -ftime 55 -retrydelay 1 -coin eth6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\608BGFDB8FBMCHF.exe"C:\Users\Admin\AppData\Local\Temp\608BGFDB8FBMCHF.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp5A36.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5A36.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp5A36.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5A36.tmp.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\GE612F263IJMH73.exe"C:\Users\Admin\AppData\Local\Temp\GE612F263IJMH73.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AGLGB1MJABH92IA.exe"C:\Users\Admin\AppData\Local\Temp\AGLGB1MJABH92IA.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" .\S7DcYBD2.Ze5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\S7DcYBD2.Ze6⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\S7DcYBD2.Ze7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\S7DcYBD2.Ze8⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\94MI9B1DD1EIKG6.exehttps://iplogger.org/1x5az74⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Users\Admin\AppData\Local\Temp\608BGFDB8FBMCHF.exeFilesize
464KB
MD567b8e6e6b35a05a52fed62e201f146df
SHA13839d4e4dff0be17ff39e8138391f48f2ecc7f6c
SHA2568deb5eeccb0143ed1756e783d1a2401f39a7d8fe9c9c282af31421243432ef9b
SHA5123e6ea796b79a8c7e9b5843f09e5281d32dfb6b025ac9e4c9a89b7046a282f73065b6708ba51108b910805dbc65e13c10e15b4e62530ba356d1f9e23fe0804284
-
C:\Users\Admin\AppData\Local\Temp\608BGFDB8FBMCHF.exeFilesize
464KB
MD567b8e6e6b35a05a52fed62e201f146df
SHA13839d4e4dff0be17ff39e8138391f48f2ecc7f6c
SHA2568deb5eeccb0143ed1756e783d1a2401f39a7d8fe9c9c282af31421243432ef9b
SHA5123e6ea796b79a8c7e9b5843f09e5281d32dfb6b025ac9e4c9a89b7046a282f73065b6708ba51108b910805dbc65e13c10e15b4e62530ba356d1f9e23fe0804284
-
C:\Users\Admin\AppData\Local\Temp\94MI9B1DD1EIKG6.exeFilesize
8KB
MD58719ce641e7c777ac1b0eaec7b5fa7c7
SHA1c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA2566283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
SHA5127be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
-
C:\Users\Admin\AppData\Local\Temp\94MI9B1DD1EIKG6.exeFilesize
8KB
MD58719ce641e7c777ac1b0eaec7b5fa7c7
SHA1c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA2566283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
SHA5127be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
-
C:\Users\Admin\AppData\Local\Temp\AGLGB1MJABH92IA.exeFilesize
1.5MB
MD50b429b506411a8cd58fe962441b9fc71
SHA1febd47c9379e0c3f0bf35e315ef66b3d8f0bf0be
SHA2564f138e66438db3f1e782e20b2f22f0efb006750e21adaa7c532cdb7b44ccdaf0
SHA51296feca33753f9b0f023ce0d3835ca0cc51353b12a185803a42383656562a1b3edba33bfa0bf03ef7437489ddadb2cee8210d5d9dee12117c471600b554242fc7
-
C:\Users\Admin\AppData\Local\Temp\AGLGB1MJABH92IA.exeFilesize
1.5MB
MD50b429b506411a8cd58fe962441b9fc71
SHA1febd47c9379e0c3f0bf35e315ef66b3d8f0bf0be
SHA2564f138e66438db3f1e782e20b2f22f0efb006750e21adaa7c532cdb7b44ccdaf0
SHA51296feca33753f9b0f023ce0d3835ca0cc51353b12a185803a42383656562a1b3edba33bfa0bf03ef7437489ddadb2cee8210d5d9dee12117c471600b554242fc7
-
C:\Users\Admin\AppData\Local\Temp\GE612F263IJMH73.exeFilesize
462KB
MD5ae7cc1189b80126e475874dd29faaebc
SHA1c9aca4f3f3fcc7de5e0c2192f6b477965f09c306
SHA25630c326f71e997020daa35c672f67dccb69495855f9ed0797bfb53218eb4d8051
SHA51205c83f9aa0e5b5264f67fcf32915cdc2240245b1c001bb408d61e6c2bb6a2d4b3930d3132faba6505544cee3ecebc96c7efa779b70623caa98daec3cd1f35059
-
C:\Users\Admin\AppData\Local\Temp\GE612F263IJMH73.exeFilesize
462KB
MD5ae7cc1189b80126e475874dd29faaebc
SHA1c9aca4f3f3fcc7de5e0c2192f6b477965f09c306
SHA25630c326f71e997020daa35c672f67dccb69495855f9ed0797bfb53218eb4d8051
SHA51205c83f9aa0e5b5264f67fcf32915cdc2240245b1c001bb408d61e6c2bb6a2d4b3930d3132faba6505544cee3ecebc96c7efa779b70623caa98daec3cd1f35059
-
C:\Users\Admin\AppData\Local\Temp\S7DcYBD2.ZeFilesize
1.6MB
MD5e10c11e23972e5fa15a1a92f2a235c19
SHA17904fa24a5bea8eb34e2bdb879ce28f26b0f6785
SHA256c233978c3e819640a972a4fcc83bfd21e5a00926fb8d9d96207d2bf6c8f56943
SHA5124329dee8c7880caa56864efc29c904f1b6690e0dcd03e061fb8dd819742fe88125152bfcc35227521474a9e8d8acc0d395ddec034c719737871bbdd17ae782c2
-
C:\Users\Admin\AppData\Local\Temp\S7dcybd2.zeFilesize
1.6MB
MD5e10c11e23972e5fa15a1a92f2a235c19
SHA17904fa24a5bea8eb34e2bdb879ce28f26b0f6785
SHA256c233978c3e819640a972a4fcc83bfd21e5a00926fb8d9d96207d2bf6c8f56943
SHA5124329dee8c7880caa56864efc29c904f1b6690e0dcd03e061fb8dd819742fe88125152bfcc35227521474a9e8d8acc0d395ddec034c719737871bbdd17ae782c2
-
C:\Users\Admin\AppData\Local\Temp\S7dcybd2.zeFilesize
1.6MB
MD5e10c11e23972e5fa15a1a92f2a235c19
SHA17904fa24a5bea8eb34e2bdb879ce28f26b0f6785
SHA256c233978c3e819640a972a4fcc83bfd21e5a00926fb8d9d96207d2bf6c8f56943
SHA5124329dee8c7880caa56864efc29c904f1b6690e0dcd03e061fb8dd819742fe88125152bfcc35227521474a9e8d8acc0d395ddec034c719737871bbdd17ae782c2
-
C:\Users\Admin\AppData\Local\Temp\tmp5A36.tmp.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Users\Admin\AppData\Local\Temp\tmp5A36.tmp.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Users\Admin\AppData\Local\Temp\tmp5A36.tmp.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Users\Admin\AppData\Local\Temp\tmp6DFC.tmp.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exeFilesize
16KB
MD5e8ac4929d4ef413e3c45abe2531cae95
SHA19ccd6320f053402699c802425e395010ef915740
SHA2567245d7d5573bfbd93e7939ad685b071d7755ebb62d8411f1984ce9dcc195f588
SHA512be3e14f1441839001f41f7c62ce3a5b7fb26927a0d8cd532eab7d000382e143b4f5b5468a60f6223dfecae3d4ad556a7f72b7e5d318783fc1d1858241bfb93e7
-
C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exeFilesize
16KB
MD5e8ac4929d4ef413e3c45abe2531cae95
SHA19ccd6320f053402699c802425e395010ef915740
SHA2567245d7d5573bfbd93e7939ad685b071d7755ebb62d8411f1984ce9dcc195f588
SHA512be3e14f1441839001f41f7c62ce3a5b7fb26927a0d8cd532eab7d000382e143b4f5b5468a60f6223dfecae3d4ad556a7f72b7e5d318783fc1d1858241bfb93e7
-
C:\Users\Admin\AppData\Roaming\MSEdge\svchost.exeFilesize
8.1MB
MD551ff42d909a879d42eb5f0e643aab806
SHA1affce62499d0f923f115228643a87ba5daece4e5
SHA256c0e187a0974b337fe6990e9a929c472dcf491282b8171322291a0ed6c1c653c3
SHA512bc948edfb59e58cc7f9a4c8e9052989e8d655323f79b29ac1a0ae5152bffd0847f8838091a51a33ffd0d1414b5afeed34870587931801f47da1ecff8915f9baf
-
C:\Users\Admin\AppData\Roaming\MSEdge\svchost.exeFilesize
8.1MB
MD551ff42d909a879d42eb5f0e643aab806
SHA1affce62499d0f923f115228643a87ba5daece4e5
SHA256c0e187a0974b337fe6990e9a929c472dcf491282b8171322291a0ed6c1c653c3
SHA512bc948edfb59e58cc7f9a4c8e9052989e8d655323f79b29ac1a0ae5152bffd0847f8838091a51a33ffd0d1414b5afeed34870587931801f47da1ecff8915f9baf
-
memory/220-162-0x0000000000000000-mapping.dmp
-
memory/312-136-0x0000000000750000-0x0000000000753000-memory.dmpFilesize
12KB
-
memory/312-132-0x0000000000000000-mapping.dmp
-
memory/364-140-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/364-157-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/364-137-0x0000000000000000-mapping.dmp
-
memory/856-222-0x0000000003340000-0x00000000033E8000-memory.dmpFilesize
672KB
-
memory/856-217-0x0000000002FE0000-0x0000000002FE6000-memory.dmpFilesize
24KB
-
memory/856-212-0x0000000000400000-0x00000000005A7000-memory.dmpFilesize
1.7MB
-
memory/856-221-0x0000000002FF0000-0x00000000030AD000-memory.dmpFilesize
756KB
-
memory/856-208-0x0000000000000000-mapping.dmp
-
memory/1152-181-0x0000000000000000-mapping.dmp
-
memory/1152-184-0x0000000000CB0000-0x0000000000D28000-memory.dmpFilesize
480KB
-
memory/1152-197-0x000000001E8B0000-0x000000001E900000-memory.dmpFilesize
320KB
-
memory/1152-218-0x00007FFF7B1F0000-0x00007FFF7BCB1000-memory.dmpFilesize
10.8MB
-
memory/1152-185-0x00007FFF7B1F0000-0x00007FFF7BCB1000-memory.dmpFilesize
10.8MB
-
memory/1580-142-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-144-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-149-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-143-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-138-0x0000000000000000-mapping.dmp
-
memory/1580-139-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1888-159-0x0000000000000000-mapping.dmp
-
memory/2064-158-0x0000000000000000-mapping.dmp
-
memory/2380-186-0x0000000000000000-mapping.dmp
-
memory/2684-192-0x0000000000000000-mapping.dmp
-
memory/3124-180-0x000000001E7B0000-0x000000001E7CE000-memory.dmpFilesize
120KB
-
memory/3124-203-0x00007FFF7B1F0000-0x00007FFF7BCB1000-memory.dmpFilesize
10.8MB
-
memory/3124-201-0x00007FFF7B1F0000-0x00007FFF7BCB1000-memory.dmpFilesize
10.8MB
-
memory/3124-168-0x00000000006D0000-0x0000000000748000-memory.dmpFilesize
480KB
-
memory/3124-196-0x000000001F280000-0x000000001F7A8000-memory.dmpFilesize
5.2MB
-
memory/3124-165-0x0000000000000000-mapping.dmp
-
memory/3124-171-0x0000000001080000-0x00000000010BC000-memory.dmpFilesize
240KB
-
memory/3124-170-0x0000000000FE0000-0x0000000000FF2000-memory.dmpFilesize
72KB
-
memory/3124-172-0x00007FFF7B1F0000-0x00007FFF7BCB1000-memory.dmpFilesize
10.8MB
-
memory/3124-169-0x000000001CFB0000-0x000000001D0BA000-memory.dmpFilesize
1.0MB
-
memory/3124-195-0x000000001EB80000-0x000000001ED42000-memory.dmpFilesize
1.8MB
-
memory/3124-179-0x000000001E830000-0x000000001E8A6000-memory.dmpFilesize
472KB
-
memory/3544-207-0x0000000000000000-mapping.dmp
-
memory/3800-225-0x0000000000000000-mapping.dmp
-
memory/3812-198-0x0000000000000000-mapping.dmp
-
memory/3868-189-0x0000000000000000-mapping.dmp
-
memory/3868-191-0x00000000008D4000-0x00000000008D7000-memory.dmpFilesize
12KB
-
memory/3900-173-0x0000000000000000-mapping.dmp
-
memory/4316-220-0x00007FFF7B1F0000-0x00007FFF7BCB1000-memory.dmpFilesize
10.8MB
-
memory/4316-219-0x0000023180710000-0x0000023180EB6000-memory.dmpFilesize
7.6MB
-
memory/4316-209-0x00007FFF7B1F0000-0x00007FFF7BCB1000-memory.dmpFilesize
10.8MB
-
memory/4316-202-0x0000000000000000-mapping.dmp
-
memory/4316-206-0x000002297A420000-0x000002297A426000-memory.dmpFilesize
24KB
-
memory/4444-156-0x0000000000600000-0x0000000000636000-memory.dmpFilesize
216KB
-
memory/4444-147-0x0000000000000000-mapping.dmp
-
memory/4444-153-0x0000000000600000-0x0000000000636000-memory.dmpFilesize
216KB
-
memory/4444-148-0x0000000000600000-0x0000000000636000-memory.dmpFilesize
216KB
-
memory/4508-226-0x0000000000000000-mapping.dmp
-
memory/4508-230-0x0000000000CB0000-0x0000000000CB6000-memory.dmpFilesize
24KB
-
memory/4508-233-0x0000000002C90000-0x0000000002D4D000-memory.dmpFilesize
756KB
-
memory/4508-234-0x0000000002D50000-0x0000000002DF8000-memory.dmpFilesize
672KB
-
memory/4648-133-0x0000000001595000-0x00000000015A8000-memory.dmpFilesize
76KB
-
memory/4668-176-0x0000000000000000-mapping.dmp