Analysis
-
max time kernel
153s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:51
Static task
static1
Behavioral task
behavioral1
Sample
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe
Resource
win10v2004-20220812-en
General
-
Target
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe
-
Size
622KB
-
MD5
49bf94707e8c8f9bd40e617165be5b52
-
SHA1
f4f5b6cd9c87acd6619ee76e4c0ac388583ff7c5
-
SHA256
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f
-
SHA512
a0090c396c230f7c51b53e4b947556f26e887e1ea186e0c076ab840fc633db4697c947d8950a2aa3ec54717b88b12ade4f43538cd2fed9144d431c7e65a2221b
-
SSDEEP
12288:A8w7gYZ4+Rutkdy2oqvdT406LGrkGE4Qiujc+zNNZcy:tw7pXktkHT40BFE77FzKy
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
glfjdvzcsbfwvmtr
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/4956-152-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4956-150-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4956-153-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral2/memory/8-142-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral2/memory/8-144-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral2/memory/8-145-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral2/memory/4956-152-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4956-150-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4956-153-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
Dnscache.exeAdobe.exeAdobe.exeDnscache.exepid process 1192 Dnscache.exe 4052 Adobe.exe 3628 Adobe.exe 1620 Dnscache.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exeDnscache.exeAdobe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Dnscache.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Adobe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Dnscache.exeDnscache.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Network List Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Dnscache.exe" Dnscache.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Network List Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Dnscache.exe" Dnscache.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 bot.whatismyipaddress.com 29 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exeAdobe.exedescription pid process target process PID 3004 set thread context of 1372 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe PID 1372 set thread context of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 set thread context of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 4052 set thread context of 3628 4052 Adobe.exe Adobe.exe -
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedw20.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
dw20.exedw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exepid process 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exedw20.exeDnscache.exeAdobe.exeAdobe.exedw20.exeDnscache.exedescription pid process Token: SeDebugPrivilege 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe Token: SeDebugPrivilege 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe Token: SeRestorePrivilege 4396 dw20.exe Token: SeBackupPrivilege 4396 dw20.exe Token: SeBackupPrivilege 4396 dw20.exe Token: SeBackupPrivilege 4396 dw20.exe Token: SeBackupPrivilege 4396 dw20.exe Token: SeDebugPrivilege 1192 Dnscache.exe Token: SeDebugPrivilege 4052 Adobe.exe Token: SeDebugPrivilege 3628 Adobe.exe Token: SeBackupPrivilege 3096 dw20.exe Token: SeBackupPrivilege 3096 dw20.exe Token: SeDebugPrivilege 1620 Dnscache.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exeAdobe.exepid process 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 3628 Adobe.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exeDnscache.exeAdobe.exeAdobe.exedescription pid process target process PID 3004 wrote to memory of 1372 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe PID 3004 wrote to memory of 1372 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe PID 3004 wrote to memory of 1372 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe PID 3004 wrote to memory of 1372 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe PID 3004 wrote to memory of 1372 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe PID 3004 wrote to memory of 1372 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe PID 3004 wrote to memory of 1372 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe PID 3004 wrote to memory of 1372 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe PID 3004 wrote to memory of 1192 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe Dnscache.exe PID 3004 wrote to memory of 1192 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe Dnscache.exe PID 3004 wrote to memory of 1192 3004 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe Dnscache.exe PID 1372 wrote to memory of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 8 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4956 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe vbc.exe PID 1372 wrote to memory of 4396 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe dw20.exe PID 1372 wrote to memory of 4396 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe dw20.exe PID 1372 wrote to memory of 4396 1372 1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe dw20.exe PID 1192 wrote to memory of 4052 1192 Dnscache.exe Adobe.exe PID 1192 wrote to memory of 4052 1192 Dnscache.exe Adobe.exe PID 1192 wrote to memory of 4052 1192 Dnscache.exe Adobe.exe PID 4052 wrote to memory of 3628 4052 Adobe.exe Adobe.exe PID 4052 wrote to memory of 3628 4052 Adobe.exe Adobe.exe PID 4052 wrote to memory of 3628 4052 Adobe.exe Adobe.exe PID 4052 wrote to memory of 3628 4052 Adobe.exe Adobe.exe PID 4052 wrote to memory of 3628 4052 Adobe.exe Adobe.exe PID 4052 wrote to memory of 3628 4052 Adobe.exe Adobe.exe PID 4052 wrote to memory of 3628 4052 Adobe.exe Adobe.exe PID 4052 wrote to memory of 3628 4052 Adobe.exe Adobe.exe PID 4052 wrote to memory of 1620 4052 Adobe.exe Dnscache.exe PID 4052 wrote to memory of 1620 4052 Adobe.exe Dnscache.exe PID 4052 wrote to memory of 1620 4052 Adobe.exe Dnscache.exe PID 3628 wrote to memory of 3096 3628 Adobe.exe dw20.exe PID 3628 wrote to memory of 3096 3628 Adobe.exe dw20.exe PID 3628 wrote to memory of 3096 3628 Adobe.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe"C:\Users\Admin\AppData\Local\Temp\1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe"C:\Users\Admin\AppData\Local\Temp\1bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\logff.txt3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\logmail.txt3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 20603⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 19925⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Dnscache.exe.logFilesize
128B
MD5a5dcc7c9c08af7dddd82be5b036a4416
SHA14f998ca1526d199e355ffb435bae111a2779b994
SHA256e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA51256035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
-
C:\Users\Admin\AppData\Local\Temp\logff.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exeFilesize
622KB
MD549bf94707e8c8f9bd40e617165be5b52
SHA1f4f5b6cd9c87acd6619ee76e4c0ac388583ff7c5
SHA2561bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f
SHA512a0090c396c230f7c51b53e4b947556f26e887e1ea186e0c076ab840fc633db4697c947d8950a2aa3ec54717b88b12ade4f43538cd2fed9144d431c7e65a2221b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exeFilesize
622KB
MD549bf94707e8c8f9bd40e617165be5b52
SHA1f4f5b6cd9c87acd6619ee76e4c0ac388583ff7c5
SHA2561bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f
SHA512a0090c396c230f7c51b53e4b947556f26e887e1ea186e0c076ab840fc633db4697c947d8950a2aa3ec54717b88b12ade4f43538cd2fed9144d431c7e65a2221b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exeFilesize
622KB
MD549bf94707e8c8f9bd40e617165be5b52
SHA1f4f5b6cd9c87acd6619ee76e4c0ac388583ff7c5
SHA2561bb23fb612b0e226c7c5ef11bba8967cf997fd11d33cffcd68ffdba2733efa0f
SHA512a0090c396c230f7c51b53e4b947556f26e887e1ea186e0c076ab840fc633db4697c947d8950a2aa3ec54717b88b12ade4f43538cd2fed9144d431c7e65a2221b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exeFilesize
7KB
MD534560fe55cedf502185ee393c9a7cbad
SHA18f889c0dfd81cc45b7c1ed7e02c2ac218bdd1b88
SHA256c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534
SHA51245837ddb402d5c1ecca90068d439f9216b9efae08b49f887c5e2ee8754ff9acb14aea2aa7cd705d5f95ba1e8c4069dd87ff5dddcf6caee9b71d66dfbd060f382
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exeFilesize
7KB
MD534560fe55cedf502185ee393c9a7cbad
SHA18f889c0dfd81cc45b7c1ed7e02c2ac218bdd1b88
SHA256c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534
SHA51245837ddb402d5c1ecca90068d439f9216b9efae08b49f887c5e2ee8754ff9acb14aea2aa7cd705d5f95ba1e8c4069dd87ff5dddcf6caee9b71d66dfbd060f382
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exeFilesize
7KB
MD534560fe55cedf502185ee393c9a7cbad
SHA18f889c0dfd81cc45b7c1ed7e02c2ac218bdd1b88
SHA256c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534
SHA51245837ddb402d5c1ecca90068d439f9216b9efae08b49f887c5e2ee8754ff9acb14aea2aa7cd705d5f95ba1e8c4069dd87ff5dddcf6caee9b71d66dfbd060f382
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exeFilesize
7KB
MD534560fe55cedf502185ee393c9a7cbad
SHA18f889c0dfd81cc45b7c1ed7e02c2ac218bdd1b88
SHA256c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534
SHA51245837ddb402d5c1ecca90068d439f9216b9efae08b49f887c5e2ee8754ff9acb14aea2aa7cd705d5f95ba1e8c4069dd87ff5dddcf6caee9b71d66dfbd060f382
-
memory/8-142-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/8-144-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/8-145-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/8-141-0x0000000000000000-mapping.dmp
-
memory/1192-140-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/1192-147-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/1192-136-0x0000000000000000-mapping.dmp
-
memory/1192-161-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/1372-146-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/1372-134-0x0000000000000000-mapping.dmp
-
memory/1372-135-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1372-139-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/1372-155-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/1620-166-0x0000000000000000-mapping.dmp
-
memory/1620-174-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/1620-171-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/3004-132-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/3004-133-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/3004-162-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/3096-172-0x0000000000000000-mapping.dmp
-
memory/3628-170-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/3628-163-0x0000000000000000-mapping.dmp
-
memory/3628-173-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/4052-157-0x0000000000000000-mapping.dmp
-
memory/4052-160-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/4052-159-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/4396-154-0x0000000000000000-mapping.dmp
-
memory/4956-150-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4956-152-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4956-149-0x0000000000000000-mapping.dmp
-
memory/4956-153-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB