blackmoon | 8d7fe37f9a184c4dbda76633eb0b33f03b49a557f924f23883a8955975987ca4

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-09-2022 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

706d8d2f9bc001d3369661e52e89e93792f73730a49dea07d878b33846605f9f.msi
Size

13.6MB
MD5

757e30a40a2c0428cbdc45531b6266d1
SHA1

100e93213987e07ae20e835a304de2b325c5c3aa
SHA256

706d8d2f9bc001d3369661e52e89e93792f73730a49dea07d878b33846605f9f
SHA512

80f90be70faa431f5cad452f5bbc78ca1168560e8142126dd4c531bef1a1be956fe74f53479c2ebe3b65c54f679185816a6ce722266eb09677fd23039b6e18b4
SSDEEP

393216:q+Fve+AYu1hvR7q+c8KbeTQdLi560QUhlr2XJk:RXAD1hvRJ3uL01lhh2Xu

Score

10^/10

blackmoon gh0strat purplefox banker rat rootkit trojan vmprotect

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2028-60-0x0000000000400000-0x0000000001DEB000-memory.dmp	family_blackmoon

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/1464-90-0x0000000010000000-0x0000000010192000-memory.dmp	purplefox_rootkit
behavioral1/memory/1464-93-0x0000000000400000-0x00000000006AC000-memory.dmp	purplefox_rootkit
behavioral1/memory/1464-99-0x0000000000400000-0x00000000006AC000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1464-90-0x0000000010000000-0x0000000010192000-memory.dmp	family_gh0strat
behavioral1/memory/1464-93-0x0000000000400000-0x00000000006AC000-memory.dmp	family_gh0strat
behavioral1/memory/1464-99-0x0000000000400000-0x00000000006AC000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

MSICA25.tmpaaaa.exeletsvpn-latest.exeact.exeact.exelsp.exe

pid process

2028 MSICA25.tmp
1532 aaaa.exe
1484 letsvpn-latest.exe
1888 act.exe
1440 act.exe
1464 lsp.exe

pid	process
2028	MSICA25.tmp
1532	aaaa.exe
1484	letsvpn-latest.exe
1888	act.exe
1440	act.exe
1464	lsp.exe

VMProtect packed file 9 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Windows\Installer\MSICA25.tmp	vmprotect
behavioral1/memory/2028-60-0x0000000000400000-0x0000000001DEB000-memory.dmp	vmprotect
\Users\Public\Videos\lsp.exe	vmprotect
\Users\Public\Videos\lsp.exe	vmprotect
C:\Users\Public\Videos\lsp.exe	vmprotect
C:\Users\Public\Videos\lsp.exe	vmprotect
behavioral1/memory/1464-87-0x0000000000400000-0x00000000006AC000-memory.dmp	vmprotect
behavioral1/memory/1464-93-0x0000000000400000-0x00000000006AC000-memory.dmp	vmprotect
behavioral1/memory/1464-99-0x0000000000400000-0x00000000006AC000-memory.dmp	vmprotect

Loads dropped DLL 8 IoCs

Processes:

MSICA25.tmpletsvpn-latest.exeaaaa.exe

pid process

2028 MSICA25.tmp
2028 MSICA25.tmp
2028 MSICA25.tmp
1484 letsvpn-latest.exe
1484 letsvpn-latest.exe
1532 aaaa.exe
1532 aaaa.exe
1532 aaaa.exe

pid	process
2028	MSICA25.tmp
2028	MSICA25.tmp
2028	MSICA25.tmp
1484	letsvpn-latest.exe
1484	letsvpn-latest.exe
1532	aaaa.exe
1532	aaaa.exe
1532	aaaa.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\6cc63f.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\6cc63d.msi	msiexec.exe
File created	C:\Windows\Installer\6cc63f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA25.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6cc63d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC91A.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

SCHTASKS.exe

pid process

824 SCHTASKS.exe

pid	process
824	SCHTASKS.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeaaaa.exeact.exe

pid	process
1756	msiexec.exe
1756	msiexec.exe
1532	aaaa.exe
1532	aaaa.exe
1532	aaaa.exe
1532	aaaa.exe
1532	aaaa.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe
1888	act.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2044	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeSecurityPrivilege	1756	msiexec.exe
Token: SeCreateTokenPrivilege	2044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2044	msiexec.exe
Token: SeLockMemoryPrivilege	2044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2044	msiexec.exe
Token: SeMachineAccountPrivilege	2044	msiexec.exe
Token: SeTcbPrivilege	2044	msiexec.exe
Token: SeSecurityPrivilege	2044	msiexec.exe
Token: SeTakeOwnershipPrivilege	2044	msiexec.exe
Token: SeLoadDriverPrivilege	2044	msiexec.exe
Token: SeSystemProfilePrivilege	2044	msiexec.exe
Token: SeSystemtimePrivilege	2044	msiexec.exe
Token: SeProfSingleProcessPrivilege	2044	msiexec.exe
Token: SeIncBasePriorityPrivilege	2044	msiexec.exe
Token: SeCreatePagefilePrivilege	2044	msiexec.exe
Token: SeCreatePermanentPrivilege	2044	msiexec.exe
Token: SeBackupPrivilege	2044	msiexec.exe
Token: SeRestorePrivilege	2044	msiexec.exe
Token: SeShutdownPrivilege	2044	msiexec.exe
Token: SeDebugPrivilege	2044	msiexec.exe
Token: SeAuditPrivilege	2044	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2044	msiexec.exe
Token: SeChangeNotifyPrivilege	2044	msiexec.exe
Token: SeRemoteShutdownPrivilege	2044	msiexec.exe
Token: SeUndockPrivilege	2044	msiexec.exe
Token: SeSyncAgentPrivilege	2044	msiexec.exe
Token: SeEnableDelegationPrivilege	2044	msiexec.exe
Token: SeManageVolumePrivilege	2044	msiexec.exe
Token: SeImpersonatePrivilege	2044	msiexec.exe
Token: SeCreateGlobalPrivilege	2044	msiexec.exe
Token: SeBackupPrivilege	1396	vssvc.exe
Token: SeRestorePrivilege	1396	vssvc.exe
Token: SeAuditPrivilege	1396	vssvc.exe
Token: SeBackupPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeLoadDriverPrivilege	1628	DrvInst.exe
Token: SeLoadDriverPrivilege	1628	DrvInst.exe
Token: SeLoadDriverPrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2044 msiexec.exe
2044 msiexec.exe

pid	process
2044	msiexec.exe
2044	msiexec.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

msiexec.exeMSICA25.tmpaaaa.exe

description	pid	process	target process
PID 1756 wrote to memory of 2028	1756	msiexec.exe	MSICA25.tmp
PID 1756 wrote to memory of 2028	1756	msiexec.exe	MSICA25.tmp
PID 1756 wrote to memory of 2028	1756	msiexec.exe	MSICA25.tmp
PID 1756 wrote to memory of 2028	1756	msiexec.exe	MSICA25.tmp
PID 2028 wrote to memory of 1532	2028	MSICA25.tmp	aaaa.exe
PID 2028 wrote to memory of 1532	2028	MSICA25.tmp	aaaa.exe
PID 2028 wrote to memory of 1532	2028	MSICA25.tmp	aaaa.exe
PID 2028 wrote to memory of 1532	2028	MSICA25.tmp	aaaa.exe
PID 2028 wrote to memory of 1484	2028	MSICA25.tmp	letsvpn-latest.exe
PID 2028 wrote to memory of 1484	2028	MSICA25.tmp	letsvpn-latest.exe
PID 2028 wrote to memory of 1484	2028	MSICA25.tmp	letsvpn-latest.exe
PID 2028 wrote to memory of 1484	2028	MSICA25.tmp	letsvpn-latest.exe
PID 1532 wrote to memory of 1888	1532	aaaa.exe	act.exe
PID 1532 wrote to memory of 1888	1532	aaaa.exe	act.exe
PID 1532 wrote to memory of 1888	1532	aaaa.exe	act.exe
PID 1532 wrote to memory of 1888	1532	aaaa.exe	act.exe
PID 1532 wrote to memory of 1440	1532	aaaa.exe	act.exe
PID 1532 wrote to memory of 1440	1532	aaaa.exe	act.exe
PID 1532 wrote to memory of 1440	1532	aaaa.exe	act.exe
PID 1532 wrote to memory of 1440	1532	aaaa.exe	act.exe
PID 1532 wrote to memory of 1464	1532	aaaa.exe	lsp.exe
PID 1532 wrote to memory of 1464	1532	aaaa.exe	lsp.exe
PID 1532 wrote to memory of 1464	1532	aaaa.exe	lsp.exe
PID 1532 wrote to memory of 1464	1532	aaaa.exe	lsp.exe
PID 1532 wrote to memory of 824	1532	aaaa.exe	SCHTASKS.exe
PID 1532 wrote to memory of 824	1532	aaaa.exe	SCHTASKS.exe
PID 1532 wrote to memory of 824	1532	aaaa.exe	SCHTASKS.exe
PID 1532 wrote to memory of 824	1532	aaaa.exe	SCHTASKS.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\706d8d2f9bc001d3369661e52e89e93792f73730a49dea07d878b33846605f9f.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\Installer\MSICA25.tmp
"C:\Windows\Installer\MSICA25.tmp"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\aaaa.exe
C:\Users\Admin\AppData\Local\Temp\aaaa.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1532

C:\Users\Public\Pictures\38142\act.exe
C:\Users\Public\Pictures\38142\act.exe 6 23321 fds01234fs56789123afds
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1888

C:\Users\Public\Pictures\38142\act.exe
C:\Users\Public\Pictures\38142\act.exe 6 23321 fds01234fs56789123afds
4⤵
- Executes dropped EXE
PID:1440

C:\Users\Public\Videos\lsp.exe
C:\Users\Public\Videos\lsp.exe
4⤵
- Executes dropped EXE
PID:1464

C:\Windows\SysWOW64\SCHTASKS.exe
SCHTASKS /Create /SC ONLOGON /TN active /F /RL HIGHEST /TR C:\Users\Public\Pictures\38142\ttvip.exe
4⤵
- Creates scheduled task(s)
PID:824

C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E8" "00000000000003EC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aaaa.exe
Filesize
71KB

MD5
c1955aac4a572955188089ffa6c07b8b

SHA1
4b9a0e72146e255d2ef232a1b18effdf2d322e8d

SHA256
20502f70180bc1164f2b90240c3aca2150d29c0be682b573c7a3f714877d60dc

SHA512
a0dba7ffb6cdde64f96740e8bbe5f5b3f0099910767d223fbc6afe34aa977ac17cc3df6d1084d55e469bc1b159b0cb1156ee5c46acd0d0efce4514ad05b64bf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaaa.exe
Filesize
71KB

MD5
c1955aac4a572955188089ffa6c07b8b

SHA1
4b9a0e72146e255d2ef232a1b18effdf2d322e8d

SHA256
20502f70180bc1164f2b90240c3aca2150d29c0be682b573c7a3f714877d60dc

SHA512
a0dba7ffb6cdde64f96740e8bbe5f5b3f0099910767d223fbc6afe34aa977ac17cc3df6d1084d55e469bc1b159b0cb1156ee5c46acd0d0efce4514ad05b64bf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
Filesize
12.3MB

MD5
9ff45607c5b3092e6a248ead6275362c

SHA1
137aa72f09ef8367b14175f21eb436471c28b5d2

SHA256
021631c179ecd37953f3e8eecc1297d24110411c297f04b63e9e9801e747bd64

SHA512
9ffcf767c40b37041f747b1e4fb90f25d5ca97c2eea2553920919addb78f4ed0391efa5fbc6562b1d97aa4555a9110fdc83c7792c820eb3ef2787e4103b2d380

Download Submit
C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
Filesize
12.3MB

MD5
9ff45607c5b3092e6a248ead6275362c

SHA1
137aa72f09ef8367b14175f21eb436471c28b5d2

SHA256
021631c179ecd37953f3e8eecc1297d24110411c297f04b63e9e9801e747bd64

SHA512
9ffcf767c40b37041f747b1e4fb90f25d5ca97c2eea2553920919addb78f4ed0391efa5fbc6562b1d97aa4555a9110fdc83c7792c820eb3ef2787e4103b2d380

Download Submit
C:\Users\Public\Pictures\38142\act.exe
Filesize
149KB

MD5
dd0edcf63868f4de86bf7f93d3553937

SHA1
b61c024ab6b5bf0448a6d1ff64f3a49d77f5abeb

SHA256
22b546b89af77f0f1c92ecc9ebf06c211f28f71edea43d6daab0bfcb9577fff4

SHA512
a303f092026eb8079a378250452720bcdcd470149cf584e867353accb7a988d00b31bbab0acc931bfbf936906c95e7c258be62564cb318d81b522c34276f7a70

Download Submit
C:\Users\Public\Pictures\38142\act.exe
Filesize
149KB

MD5
dd0edcf63868f4de86bf7f93d3553937

SHA1
b61c024ab6b5bf0448a6d1ff64f3a49d77f5abeb

SHA256
22b546b89af77f0f1c92ecc9ebf06c211f28f71edea43d6daab0bfcb9577fff4

SHA512
a303f092026eb8079a378250452720bcdcd470149cf584e867353accb7a988d00b31bbab0acc931bfbf936906c95e7c258be62564cb318d81b522c34276f7a70

Download Submit
C:\Users\Public\Videos\lsp.exe
Filesize
1.0MB

MD5
070c095092e76b68426d855225499856

SHA1
97bb03cf42246f877e59664134ead3765766cbe5

SHA256
ea487c06dec84b8f2b275d1446fba0e4a49819b4470247c8b3407d7470710141

SHA512
8e9c16b66fca62a24702fcab51d4e32e248247942f60205a1d2b973ec634a7172927235f97deeb0883f1cfb17b025a8f59f795b27d6e3393d51d401e8cbfedf9

Download Submit
C:\Users\Public\Videos\lsp.exe
Filesize
1.0MB

MD5
070c095092e76b68426d855225499856

SHA1
97bb03cf42246f877e59664134ead3765766cbe5

SHA256
ea487c06dec84b8f2b275d1446fba0e4a49819b4470247c8b3407d7470710141

SHA512
8e9c16b66fca62a24702fcab51d4e32e248247942f60205a1d2b973ec634a7172927235f97deeb0883f1cfb17b025a8f59f795b27d6e3393d51d401e8cbfedf9

Download Submit
C:\Windows\Installer\MSICA25.tmp
Filesize
13.5MB

MD5
d6350db9a0cf509cd27ee1958dd1405b

SHA1
88382e529bf7d033c87acdbfc616234dbe3d3ede

SHA256
4ebfb3278b99d2d3b8e8759280e9dea094818c02e60ae426c269c05d3882e1d2

SHA512
a6ebbd4c957d4c6f8e3892b7b8e89318aaad2d9cc292e93a1c850f12c7ac4f3d3ce02aa6698dc135a32b21a7d6393e3a8b9b3c99597a4b24f8855be37223fec8

Download Submit
\Users\Admin\AppData\Local\Temp\aaaa.exe
Filesize
71KB

MD5
c1955aac4a572955188089ffa6c07b8b

SHA1
4b9a0e72146e255d2ef232a1b18effdf2d322e8d

SHA256
20502f70180bc1164f2b90240c3aca2150d29c0be682b573c7a3f714877d60dc

SHA512
a0dba7ffb6cdde64f96740e8bbe5f5b3f0099910767d223fbc6afe34aa977ac17cc3df6d1084d55e469bc1b159b0cb1156ee5c46acd0d0efce4514ad05b64bf7

Download Submit
\Users\Admin\AppData\Local\Temp\aaaa.exe
Filesize
71KB

MD5
c1955aac4a572955188089ffa6c07b8b

SHA1
4b9a0e72146e255d2ef232a1b18effdf2d322e8d

SHA256
20502f70180bc1164f2b90240c3aca2150d29c0be682b573c7a3f714877d60dc

SHA512
a0dba7ffb6cdde64f96740e8bbe5f5b3f0099910767d223fbc6afe34aa977ac17cc3df6d1084d55e469bc1b159b0cb1156ee5c46acd0d0efce4514ad05b64bf7

Download Submit
\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
Filesize
12.3MB

MD5
9ff45607c5b3092e6a248ead6275362c

SHA1
137aa72f09ef8367b14175f21eb436471c28b5d2

SHA256
021631c179ecd37953f3e8eecc1297d24110411c297f04b63e9e9801e747bd64

SHA512
9ffcf767c40b37041f747b1e4fb90f25d5ca97c2eea2553920919addb78f4ed0391efa5fbc6562b1d97aa4555a9110fdc83c7792c820eb3ef2787e4103b2d380

Download Submit
\Users\Admin\AppData\Local\Temp\nstE62C.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
\Users\Admin\AppData\Local\Temp\nstE62C.tmp\nsDialogs.dll
Filesize
9KB

MD5
ca95c9da8cef7062813b989ab9486201

SHA1
c555af25df3de51aa18d487d47408d5245dba2d1

SHA256
feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be

SHA512
a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9

Download Submit
\Users\Public\Pictures\38142\act.exe
Filesize
149KB

MD5
dd0edcf63868f4de86bf7f93d3553937

SHA1
b61c024ab6b5bf0448a6d1ff64f3a49d77f5abeb

SHA256
22b546b89af77f0f1c92ecc9ebf06c211f28f71edea43d6daab0bfcb9577fff4

SHA512
a303f092026eb8079a378250452720bcdcd470149cf584e867353accb7a988d00b31bbab0acc931bfbf936906c95e7c258be62564cb318d81b522c34276f7a70

Download Submit
\Users\Public\Videos\lsp.exe
Filesize
1.0MB

MD5
070c095092e76b68426d855225499856

SHA1
97bb03cf42246f877e59664134ead3765766cbe5

SHA256
ea487c06dec84b8f2b275d1446fba0e4a49819b4470247c8b3407d7470710141

SHA512
8e9c16b66fca62a24702fcab51d4e32e248247942f60205a1d2b973ec634a7172927235f97deeb0883f1cfb17b025a8f59f795b27d6e3393d51d401e8cbfedf9

Download Submit
\Users\Public\Videos\lsp.exe
Filesize
1.0MB

MD5
070c095092e76b68426d855225499856

SHA1
97bb03cf42246f877e59664134ead3765766cbe5

SHA256
ea487c06dec84b8f2b275d1446fba0e4a49819b4470247c8b3407d7470710141

SHA512
8e9c16b66fca62a24702fcab51d4e32e248247942f60205a1d2b973ec634a7172927235f97deeb0883f1cfb17b025a8f59f795b27d6e3393d51d401e8cbfedf9

Download Submit
memory/824-89-0x0000000000000000-mapping.dmp

Download
memory/1440-80-0x0000000000000000-mapping.dmp

Download
memory/1464-84-0x0000000000000000-mapping.dmp

Download
memory/1464-99-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/1464-93-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/1464-90-0x0000000010000000-0x0000000010192000-memory.dmp

Filesize
1.6MB

Download
memory/1464-87-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/1484-70-0x0000000000000000-mapping.dmp

Download
memory/1532-63-0x0000000000000000-mapping.dmp

Download
memory/1532-71-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1532-91-0x0000000003420000-0x00000000036CC000-memory.dmp

Filesize
2.7MB

Download
memory/1532-66-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1888-78-0x0000000000000000-mapping.dmp

Download
memory/2028-68-0x00000000002A0000-0x00000000002D6000-memory.dmp

Filesize
216KB

Download
memory/2028-59-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2028-58-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/2028-60-0x0000000000400000-0x0000000001DEB000-memory.dmp

Filesize
25.9MB

Download
memory/2028-69-0x00000000002A0000-0x00000000002D6000-memory.dmp

Filesize
216KB

Download
memory/2028-56-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download