danabot | 57f45a71581be8db1677109dc507d8421632e9bd0f8ecbf22b73ada97aeecd84

Analysis

max time kernel
151s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2022, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 224KB
Sample221023-aq69ysffbp
SHA256 57f45a71581be8db1677109dc507d8421632e9bd0f8ecbf22b73ada97aeecd84
MD5 5904fc1c9ecfc145e86303dee2e17877
SHA1 b464455c61e2d6bb3c5834bd636536bad298f749
SHA512 e4a3695c574d7d54f304ec7d3f4bbb23658892626cab56ef969f4b5e20f83d9ffdb7f52d62f2057328467e0f7ab7aa71369a539401e022ead8c8162102967b05
SSDEEP 3072:vXGgeLHJsqSvUZ5FvfvJtsJ8kEtJjibEmrjY+z1jMhs0:fxeL2qKUZvXJ68k4JjsEwz6K0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot nymaim smokeloader vidar 1735 backdoor banker bootkit discovery persistence spyware stealer trojan

Malware Config

Extracted

Family

danabot

49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535

Attributes

embedded_hash
569235DCA8F16ED8310BBACCB674F896
type
loader

Extracted

Family

vidar

Version

55.1

Botnet

1735

https://t.me/tg_privatetalk
https://nerdculture.de/@yixehi33

Attributes

profile_id
1735

Extracted

Family

nymaim

45.139.105.171
85.31.46.167

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/4584-133-0x00000000001F0000-0x00000000001F9000-memory.dmp	family_smokeloader

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
98	4904	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
4648	1369.exe
4468	7EE5.exe
1840	84A3.exe
2284	8ABE.exe
3892	build.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	84A3.exe

Loads dropped DLL 2 IoCs

pid	Process
3892	build.exe
3892	build.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	7EE5.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2284 set thread context of 3184	2284	8ABE.exe	99
PID 4648 set thread context of 4904	4648	1369.exe	149

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 20 IoCs

pid	pid_target	Process	procid_target
4456	3184	WerFault.exe	99
1616	1840	WerFault.exe	96
2028	1840	WerFault.exe	96
5100	1840	WerFault.exe	96
2620	1840	WerFault.exe	96
1264	1840	WerFault.exe	96
4008	1840	WerFault.exe	96
4364	1840	WerFault.exe	96
1992	1840	WerFault.exe	96
2156	1840	WerFault.exe	96
4620	4648	WerFault.exe	90
4920	4648	WerFault.exe	90
3032	4648	WerFault.exe	90
2756	4648	WerFault.exe	90
2732	4648	WerFault.exe	90
3016	4648	WerFault.exe	90
1280	4648	WerFault.exe	90
4252	4648	WerFault.exe	90
4444	4648	WerFault.exe	90
3824	4648	WerFault.exe	90

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe

Checks processor information in registry 2 TTPs 47 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	1369.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	1369.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	1369.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	1369.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4584	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3260	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	1369.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3040	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4584	file.exe
4584	file.exe
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4584	file.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3608	svchost.exe
Token: SeShutdownPrivilege	3608	svchost.exe
Token: SeCreatePagefilePrivilege	3608	svchost.exe
Token: SeDebugPrivilege	2284	8ABE.exe
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeDebugPrivilege	3260	taskkill.exe
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4904	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4696	OpenWith.exe
3040	Process not Found
3040	Process not Found

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4648	3040	Process not Found	90
PID 3040 wrote to memory of 4648	3040	Process not Found	90
PID 3040 wrote to memory of 4648	3040	Process not Found	90
PID 4648 wrote to memory of 1604	4648	1369.exe	91
PID 4648 wrote to memory of 1604	4648	1369.exe	91
PID 4648 wrote to memory of 1604	4648	1369.exe	91
PID 3040 wrote to memory of 4468	3040	Process not Found	95
PID 3040 wrote to memory of 4468	3040	Process not Found	95
PID 3040 wrote to memory of 4468	3040	Process not Found	95
PID 3040 wrote to memory of 1840	3040	Process not Found	96
PID 3040 wrote to memory of 1840	3040	Process not Found	96
PID 3040 wrote to memory of 1840	3040	Process not Found	96
PID 3040 wrote to memory of 2284	3040	Process not Found	97
PID 3040 wrote to memory of 2284	3040	Process not Found	97
PID 2284 wrote to memory of 1852	2284	8ABE.exe	98
PID 2284 wrote to memory of 1852	2284	8ABE.exe	98
PID 2284 wrote to memory of 1852	2284	8ABE.exe	98
PID 2284 wrote to memory of 3184	2284	8ABE.exe	99
PID 2284 wrote to memory of 3184	2284	8ABE.exe	99
PID 2284 wrote to memory of 3184	2284	8ABE.exe	99
PID 2284 wrote to memory of 3184	2284	8ABE.exe	99
PID 2284 wrote to memory of 3184	2284	8ABE.exe	99
PID 2284 wrote to memory of 3184	2284	8ABE.exe	99
PID 2284 wrote to memory of 3184	2284	8ABE.exe	99
PID 2284 wrote to memory of 3184	2284	8ABE.exe	99
PID 3184 wrote to memory of 3892	3184	CasPol.exe	100
PID 3184 wrote to memory of 3892	3184	CasPol.exe	100
PID 3184 wrote to memory of 3892	3184	CasPol.exe	100
PID 3892 wrote to memory of 4340	3892	build.exe	118
PID 3892 wrote to memory of 4340	3892	build.exe	118
PID 3892 wrote to memory of 4340	3892	build.exe	118
PID 4340 wrote to memory of 4584	4340	cmd.exe	120
PID 4340 wrote to memory of 4584	4340	cmd.exe	120
PID 4340 wrote to memory of 4584	4340	cmd.exe	120
PID 1840 wrote to memory of 1020	1840	84A3.exe	123
PID 1840 wrote to memory of 1020	1840	84A3.exe	123
PID 1840 wrote to memory of 1020	1840	84A3.exe	123
PID 1020 wrote to memory of 3260	1020	cmd.exe	127
PID 1020 wrote to memory of 3260	1020	cmd.exe	127
PID 1020 wrote to memory of 3260	1020	cmd.exe	127
PID 4648 wrote to memory of 4904	4648	1369.exe	149
PID 4648 wrote to memory of 4904	4648	1369.exe	149
PID 4648 wrote to memory of 4904	4648	1369.exe	149
PID 4648 wrote to memory of 4904	4648	1369.exe	149

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4584

C:\Users\Admin\AppData\Local\Temp\1369.exe
C:\Users\Admin\AppData\Local\Temp\1369.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\agentactivationruntimestarter.exe
  C:\Windows\system32\agentactivationruntimestarter.exe
  2⤵
  PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 652
  2⤵
  - Program crash
  PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1048
  2⤵
  - Program crash
  PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1056
  2⤵
  - Program crash
  PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1056
  2⤵
  - Program crash
  PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1144
  2⤵
  - Program crash
  PID:2732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1152
  2⤵
  - Program crash
  PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1188
  2⤵
  - Program crash
  PID:1280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1168
  2⤵
  - Program crash
  PID:4252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1036
  2⤵
  - Program crash
  PID:4444
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1444
  2⤵
  - Program crash
  PID:3824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x308
1⤵
PID:4892

C:\Users\Admin\AppData\Local\Temp\7EE5.exe
C:\Users\Admin\AppData\Local\Temp\7EE5.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4468

C:\Users\Admin\AppData\Local\Temp\84A3.exe
C:\Users\Admin\AppData\Local\Temp\84A3.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 452
  2⤵
  - Program crash
  PID:1616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 764
  2⤵
  - Program crash
  PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 764
  2⤵
  - Program crash
  PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 816
  2⤵
  - Program crash
  PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 824
  2⤵
  - Program crash
  PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 984
  2⤵
  - Program crash
  PID:4008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 1016
  2⤵
  - Program crash
  PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 1356
  2⤵
  - Program crash
  PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "84A3.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\84A3.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "84A3.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 492
  2⤵
  - Program crash
  PID:2156

C:\Users\Admin\AppData\Local\Temp\8ABE.exe
C:\Users\Admin\AppData\Local\Temp\8ABE.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:1852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\build.exe" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 1524
    3⤵
    - Program crash
    PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3184 -ip 3184
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1840 -ip 1840
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1840 -ip 1840
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1840 -ip 1840
1⤵
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1840 -ip 1840
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1840 -ip 1840
1⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1840 -ip 1840
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1840 -ip 1840
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1840 -ip 1840
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1840 -ip 1840
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4648 -ip 4648
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4648 -ip 4648
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4648 -ip 4648
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4648 -ip 4648
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4648 -ip 4648
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4648 -ip 4648
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4648 -ip 4648
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4648 -ip 4648
1⤵
PID:3412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4648 -ip 4648
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4648 -ip 4648
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

1369.exe

Path C:\Users\Admin\AppData\Local\Temp\1369.exe
Size 8.4MB
SHA256 eb61cd6d9e13064f19066b6f02d0e4de74a5dfd26f22c2a8b5665ff2eedabf3a
MD5 35109cc08a149b756c563488362f3d8b
SHA1 9ff0995a9545863b5025248d43cbd1825aab5ef3
SHA512 9468b515d3243c5f17b3af78a6a0e5efe0e513f0d84b8377f4338d8216f16cc1dc363b0ae8c374c547e5e6525ec812579bf5ee42d18e420e261ffe6c6e591762
SSDEEP 196608:Hg8NUtCT7FTwnly7/qJvHRKxOcxYdqjokDw4V6k4P7dRnAtt:A8N4C39wnlIMHRKsa8M6kK7vs
MD5 SHA1 SHA512 SSDEEP

Submit Download

1369.exe

Path C:\Users\Admin\AppData\Local\Temp\1369.exe
Size 8.4MB
SHA256 eb61cd6d9e13064f19066b6f02d0e4de74a5dfd26f22c2a8b5665ff2eedabf3a
MD5 35109cc08a149b756c563488362f3d8b
SHA1 9ff0995a9545863b5025248d43cbd1825aab5ef3
SHA512 9468b515d3243c5f17b3af78a6a0e5efe0e513f0d84b8377f4338d8216f16cc1dc363b0ae8c374c547e5e6525ec812579bf5ee42d18e420e261ffe6c6e591762
SSDEEP 196608:Hg8NUtCT7FTwnly7/qJvHRKxOcxYdqjokDw4V6k4P7dRnAtt:A8N4C39wnlIMHRKsa8M6kK7vs
MD5 SHA1 SHA512 SSDEEP

Submit Download

7EE5.exe

Path C:\Users\Admin\AppData\Local\Temp\7EE5.exe
Size 525KB
SHA256 31c8cdab9066ba2523324577d8c163b952745115f131d2915da6ae2aa626e18c
MD5 ce8659b870612224430543f10d0d69f1
SHA1 acacc48184237add22fa4aad945ea0960d082641
SHA512 3dcbbe615353e45d1d8f1f51d98997b3e90727bd84436f9cb902904721d04a7786a742ed51a7b6f8751a7afa5b6903ab042f3538be2ee32d66c26dda6dac31ee
SSDEEP 12288:t+OuntFw+YdAPUEi/IOQvZCy9CP9V/4n:tqtu+mmUE+I7xaVy
MD5 SHA1 SHA512 SSDEEP

Submit Download

7EE5.exe

Path C:\Users\Admin\AppData\Local\Temp\7EE5.exe
Size 525KB
SHA256 31c8cdab9066ba2523324577d8c163b952745115f131d2915da6ae2aa626e18c
MD5 ce8659b870612224430543f10d0d69f1
SHA1 acacc48184237add22fa4aad945ea0960d082641
SHA512 3dcbbe615353e45d1d8f1f51d98997b3e90727bd84436f9cb902904721d04a7786a742ed51a7b6f8751a7afa5b6903ab042f3538be2ee32d66c26dda6dac31ee
SSDEEP 12288:t+OuntFw+YdAPUEi/IOQvZCy9CP9V/4n:tqtu+mmUE+I7xaVy
MD5 SHA1 SHA512 SSDEEP

Submit Download

84A3.exe

Path C:\Users\Admin\AppData\Local\Temp\84A3.exe
Size 293KB
SHA256 d59f0a77feade396ba4a90f43642255ae09e4e8bbd537d39eed12e6a6f3537a7
MD5 8ae0204ead6d13adf8ee8397a8df79dc
SHA1 67725fd332244daa2ee0025e2c98775df2d42ee2
SHA512 64b7e5835f6716df24c4cc3ad74cbf8b9db855c72ee32b9e2c17f0964a554c3d15490f94c69bfe40bdf3232737615364f000252f7cb85de75bf7f71dd2794ab9
SSDEEP 3072:HXjmDLwTnlAeBZ52lQJ/hIfE/pKGvp4eQW8CnxzYfSaiXuQ7Z1NL0nl6uFivKpam:3qDLWlxBiShpVHh1xWSOOqqaaJzTDg
MD5 SHA1 SHA512 SSDEEP

Submit Download

84A3.exe

Path C:\Users\Admin\AppData\Local\Temp\84A3.exe
Size 293KB
SHA256 d59f0a77feade396ba4a90f43642255ae09e4e8bbd537d39eed12e6a6f3537a7
MD5 8ae0204ead6d13adf8ee8397a8df79dc
SHA1 67725fd332244daa2ee0025e2c98775df2d42ee2
SHA512 64b7e5835f6716df24c4cc3ad74cbf8b9db855c72ee32b9e2c17f0964a554c3d15490f94c69bfe40bdf3232737615364f000252f7cb85de75bf7f71dd2794ab9
SSDEEP 3072:HXjmDLwTnlAeBZ52lQJ/hIfE/pKGvp4eQW8CnxzYfSaiXuQ7Z1NL0nl6uFivKpam:3qDLWlxBiShpVHh1xWSOOqqaaJzTDg
MD5 SHA1 SHA512 SSDEEP

Submit Download

84c7bf32-db39-40e7-95b4-e9bdddb0a182.tmp

Path C:\Users\Admin\AppData\Local\Temp\84c7bf32-db39-40e7-95b4-e9bdddb0a182.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

8ABE.exe

Path C:\Users\Admin\AppData\Local\Temp\8ABE.exe
Size 4.3MB
SHA256 5a5b44ef899f97cdd2df2d9b2f0428d2c3db07dc41c38c607d78ebc6d43bb142
MD5 8e180f337cc75d400905eac4d02bf3e1
SHA1 0eaee08bdfc6f1d342fd24046ef792328bd570df
SHA512 f4beb84a4b623e99b470e1e61dd816e87f35203f08d0efa5f8d4b9b5c7c0e439d14e7d67c03c3db4095cdca2978c29f2e8ac843aa338c187c21c7db2f46650e2
SSDEEP 98304:jnF1NTUZ3ZQrSOwHiIhSIADFKG9FM2vQ/5d:TF1hUZ3KSOhD4
MD5 SHA1 SHA512 SSDEEP

Submit Download

8ABE.exe

Path C:\Users\Admin\AppData\Local\Temp\8ABE.exe
Size 4.3MB
SHA256 5a5b44ef899f97cdd2df2d9b2f0428d2c3db07dc41c38c607d78ebc6d43bb142
MD5 8e180f337cc75d400905eac4d02bf3e1
SHA1 0eaee08bdfc6f1d342fd24046ef792328bd570df
SHA512 f4beb84a4b623e99b470e1e61dd816e87f35203f08d0efa5f8d4b9b5c7c0e439d14e7d67c03c3db4095cdca2978c29f2e8ac843aa338c187c21c7db2f46650e2
SSDEEP 98304:jnF1NTUZ3ZQrSOwHiIhSIADFKG9FM2vQ/5d:TF1hUZ3KSOhD4
MD5 SHA1 SHA512 SSDEEP

Submit Download

93ae4977-351e-4d12-8e91-5a7da1d83e8a.tmp

Path C:\Users\Admin\AppData\Local\Temp\93ae4977-351e-4d12-8e91-5a7da1d83e8a.tmp
Size 23KB
SHA256 3884df97009ac7e97143743660ed8e010d5f77edcf611bf85276e876fc70754b
MD5 2e0a52964e4f43a9830f01775bcb061b
SHA1 deedc2124380dcc834798466b7ae8ca986aba82f
SHA512 56c28175bfeb1adfa70761dbf3d46f60b3545de1dd879b346658a2701a173c5fd1959dcb6ecb931f7589f8178fa46d026da0edcfef0471f0fc9d65df7bc6ea44
SSDEEP 384:Kf8dqwQFeqz/pS6LK+0DQDIjRdaB9t84OfwSduIf:LMeXJDfK9+4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Syhidsduo.tmp

Path C:\Users\Admin\AppData\Local\Temp\Syhidsduo.tmp
Size 3.3MB
SHA256 db9190e9eb5298547a3d266f298ec1e7ede0426841da9512f2827f1e7c027520
MD5 13d0ff809f24a408728fd6fe00241020
SHA1 fde8484da982eceb86cf6959460ffc4ce33271a9
SHA512 38dd1c523eb9f5aa1c3da0e95f4064f22fc191ce8cea20803c5f60fcbc40d83f5c3545529863ca18f4e65b3ea7a8eddc247ae0db11c6ffa70af560998611e768
SSDEEP 98304:SxlplP5DXkQtCgfAKRToMtYwEh1D33K6m:SxnlRlCg/ToSMDnKr
MD5 SHA1 SHA512 SSDEEP

Submit Download

aria-debug-4828.log

Path C:\Users\Admin\AppData\Local\Temp\aria-debug-4828.log
Size 470B
SHA256 0f035931511a1d11c2da08546aed273d58fea487cb98b68fced70f1fd86f82ec
MD5 27f209a8bfb57ca10cd2a6d4457f0c20
SHA1 48b2cf6bbdc5207c573f23c910a6b48f8438bc8f
SHA512 1bf063f27e134fd77588fc39d9594dee01757fe29fa393af410a40ce96e99f8a1f8dbe5df86732d1d81f8155a123ddbace5df21f88ab1bfffe427a0390030b16
MD5 SHA1 SHA512

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\build.exe
Size 285KB
SHA256 b294f97e52a09919cd8965d575065fb96063bf69f1f342908e3b10830e577ef7
MD5 430876ed9d085ffb5964666df46270b6
SHA1 b9672a3d97170a0b9b4e2771702b46c0bbc6e424
SHA512 565de076ded828b29986026720ee6b11cf121b2651d0ef83d2e3a8109df3a60a1822d33700cee88063f802b4b78dfa462493a66abd21760dd14d0634d28bc211
SSDEEP 3072:aYs160x9eknPYSobj+rV9NSMir/XvnfL8nDhBqQ7FQMb3w1ndzQMzqd27ZUXBCHs:ionQx7rL/Q6ezz7ZURV9FT
MD5 SHA1 SHA512 SSDEEP

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\build.exe
Size 285KB
SHA256 b294f97e52a09919cd8965d575065fb96063bf69f1f342908e3b10830e577ef7
MD5 430876ed9d085ffb5964666df46270b6
SHA1 b9672a3d97170a0b9b4e2771702b46c0bbc6e424
SHA512 565de076ded828b29986026720ee6b11cf121b2651d0ef83d2e3a8109df3a60a1822d33700cee88063f802b4b78dfa462493a66abd21760dd14d0634d28bc211
SSDEEP 3072:aYs160x9eknPYSobj+rV9NSMir/XvnfL8nDhBqQ7FQMb3w1ndzQMzqd27ZUXBCHs:ionQx7rL/Q6ezz7ZURV9FT
MD5 SHA1 SHA512 SSDEEP

Submit Download

photo_2022-10-19_12-03-07.jpg

Path C:\Users\Admin\AppData\Local\Temp\photo_2022-10-19_12-03-07.jpg
Size 72KB
SHA256 401427aec234d97bb6e6fc2f4b8b1c7f5f4a1b334aa6febc151ad4afd5b34096
MD5 14429fb2d41cdedec2835defd5ead4d1
SHA1 0ea75b51797928252347bb547a100875d9dbfceb
SHA512 cb7293469294954c7dd197fc3704e0295ea8ee30e71a9529d9b3ebe04088b94ff737a6830edaee2518e4a71c3083823c8f995e272fb093b9613ccc2367433118
SSDEEP 1536:5KlbGSa/hSGXP83vXVCshdkdJeGO3/Rw7i0JWRKxa/Fm3XQJKlefhc:5kblAh503oszAfu/Vf6a/FeXQJ3fW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1840-166-0x0000000000400000-0x0000000002C37000-memory.dmp

Download

memory/1840-194-0x0000000002F93000-0x0000000002FBA000-memory.dmp

Download

memory/1840-164-0x0000000002F93000-0x0000000002FBA000-memory.dmp

Download

memory/1840-195-0x0000000000400000-0x0000000002C37000-memory.dmp

Download

memory/1840-165-0x0000000002D60000-0x0000000002DA0000-memory.dmp

Download

memory/2284-153-0x0000000000C40000-0x0000000001090000-memory.dmp

Download

memory/2284-156-0x00007FF9478E0000-0x00007FF9483A1000-memory.dmp

Download

memory/2284-187-0x00007FF9478E0000-0x00007FF9483A1000-memory.dmp

Download

memory/3184-154-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3892-167-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4468-190-0x0000000000400000-0x0000000002C71000-memory.dmp

Download

memory/4468-163-0x0000000002CE3000-0x0000000002D44000-memory.dmp

Download

memory/4468-159-0x0000000000400000-0x0000000002C71000-memory.dmp

Download

memory/4468-192-0x0000000002CE3000-0x0000000002D44000-memory.dmp

Download

memory/4468-157-0x00000000048B0000-0x000000000491B000-memory.dmp

Download

memory/4584-134-0x0000000000400000-0x0000000002C26000-memory.dmp

Download

memory/4584-135-0x0000000000400000-0x0000000002C26000-memory.dmp

Download

memory/4584-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

Download

memory/4584-132-0x0000000002E33000-0x0000000002E49000-memory.dmp

Download

memory/4648-204-0x00000000080B0000-0x00000000081F0000-memory.dmp

Download

memory/4648-209-0x00000000080B0000-0x00000000081F0000-memory.dmp

Download

memory/4648-140-0x000000000379D000-0x0000000003FD8000-memory.dmp

Download

memory/4648-199-0x0000000000400000-0x000000000344D000-memory.dmp

Download

memory/4648-200-0x0000000007410000-0x0000000007EC2000-memory.dmp

Download

memory/4648-201-0x0000000007410000-0x0000000007EC2000-memory.dmp

Download

memory/4648-202-0x0000000007410000-0x0000000007EC2000-memory.dmp

Download

memory/4648-203-0x00000000080B0000-0x00000000081F0000-memory.dmp

Download

memory/4648-196-0x0000000000400000-0x000000000344D000-memory.dmp

Download

memory/4648-205-0x00000000080B0000-0x00000000081F0000-memory.dmp

Download

memory/4648-206-0x00000000080B0000-0x00000000081F0000-memory.dmp

Download

memory/4648-208-0x00000000080B0000-0x00000000081F0000-memory.dmp

Download

memory/4648-207-0x00000000080B0000-0x00000000081F0000-memory.dmp

Download

memory/4648-197-0x0000000000400000-0x000000000344D000-memory.dmp

Download

memory/4648-210-0x00000000080B0000-0x00000000081F0000-memory.dmp

Download

memory/4648-222-0x0000000007410000-0x0000000007EC2000-memory.dmp

Download

memory/4648-143-0x0000000000400000-0x000000000344D000-memory.dmp

Download

memory/4648-142-0x0000000000400000-0x000000000344D000-memory.dmp

Download

memory/4648-141-0x0000000005980000-0x0000000006356000-memory.dmp

Download

memory/4904-215-0x0000000004280000-0x00000000043C0000-memory.dmp

Download

memory/4904-216-0x0000000004280000-0x00000000043C0000-memory.dmp

Download

memory/4904-214-0x00000000037C0000-0x0000000004272000-memory.dmp

Download

memory/4904-213-0x00000000037C0000-0x0000000004272000-memory.dmp

Download

memory/4904-212-0x0000000001270000-0x0000000001C02000-memory.dmp

Download

memory/4904-221-0x00000000037C0000-0x0000000004272000-memory.dmp

Download