Analysis
-
max time kernel
168s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:50
Static task
static1
Behavioral task
behavioral1
Sample
c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe
Resource
win10v2004-20221111-en
General
-
Target
c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe
-
Size
840KB
-
MD5
489e3dbf1fd20f27c6b2717b6b829623
-
SHA1
15523053d4f93fc0f45da028a1090f77fd426b48
-
SHA256
c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77
-
SHA512
2e776cb3e4d68cc52179e1d046c5333f0a4f582eebe8ad2f867317693892f1592d0ecdc92df2537746d513e1219a69713fc5c032a1e100704e507253ac0f468b
-
SSDEEP
12288:kCpyvXFPTfnCvX66h/NYJ9nDW6FApNg3gZqdDUtOuBiMc/j6KRVrxn7Nl4+GtlrL:Zk9P7nCvX6MNYLIbgYJ3chra+GbrL
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
d3WQGzd9.exekoaofo.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d3WQGzd9.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" koaofo.exe -
Executes dropped EXE 9 IoCs
Processes:
d3WQGzd9.exekoaofo.exeawhost.exebwhost.exebwhost.execwhost.execwhost.execwhost.exedwhost.exepid process 2624 d3WQGzd9.exe 1920 koaofo.exe 4708 awhost.exe 4120 bwhost.exe 4840 bwhost.exe 5052 cwhost.exe 3240 cwhost.exe 4664 cwhost.exe 3508 dwhost.exe -
Processes:
resource yara_rule behavioral2/memory/5052-175-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3240-179-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/5052-181-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4664-185-0x0000000000400000-0x0000000000449000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d3WQGzd9.exec953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation d3WQGzd9.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 56 IoCs
Processes:
koaofo.exed3WQGzd9.execwhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /i" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /Y" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /N" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /G" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /L" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /o" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /I" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /H" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /s" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /P" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /S" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /J" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /h" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /k" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /M" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /A" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /v" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /m" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /D" d3WQGzd9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /c" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /O" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /D" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /l" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /f" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /W" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /C" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /x" koaofo.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\ koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /p" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /e" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /U" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /j" koaofo.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d3WQGzd9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /R" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /B" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /K" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /u" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /Q" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /g" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /a" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /t" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /Z" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /q" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /F" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /V" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /z" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /X" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /T" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /y" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /n" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /b" koaofo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Program Files (x86)\\Internet Explorer\\lvvm.exe" cwhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /d" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /E" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /r" koaofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaofo = "C:\\Users\\Admin\\koaofo.exe /w" koaofo.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exeawhost.exebwhost.exebwhost.exedescription pid process target process PID 4568 set thread context of 4904 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe PID 4708 set thread context of 3316 4708 awhost.exe svchost.exe PID 4120 set thread context of 4840 4120 bwhost.exe bwhost.exe PID 4840 set thread context of 4348 4840 bwhost.exe explorer.exe -
Drops file in Program Files directory 1 IoCs
Processes:
cwhost.exedescription ioc process File created C:\Program Files (x86)\Internet Explorer\lvvm.exe cwhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1408 3316 WerFault.exe svchost.exe 4488 4348 WerFault.exe explorer.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 5008 tasklist.exe 2292 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d3WQGzd9.exekoaofo.exepid process 2624 d3WQGzd9.exe 2624 d3WQGzd9.exe 2624 d3WQGzd9.exe 2624 d3WQGzd9.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe 1920 koaofo.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tasklist.exetasklist.exedescription pid process Token: SeDebugPrivilege 5008 tasklist.exe Token: SeDebugPrivilege 2292 tasklist.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exec953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exed3WQGzd9.exekoaofo.exeawhost.exebwhost.exedwhost.exepid process 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe 2624 d3WQGzd9.exe 1920 koaofo.exe 4708 awhost.exe 4120 bwhost.exe 3508 dwhost.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exec953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exed3WQGzd9.execmd.exeawhost.exebwhost.exebwhost.execwhost.execmd.exekoaofo.exedescription pid process target process PID 4568 wrote to memory of 4904 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe PID 4568 wrote to memory of 4904 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe PID 4568 wrote to memory of 4904 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe PID 4568 wrote to memory of 4904 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe PID 4568 wrote to memory of 4904 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe PID 4568 wrote to memory of 4904 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe PID 4568 wrote to memory of 4904 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe PID 4568 wrote to memory of 4904 4568 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe PID 4904 wrote to memory of 2624 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe d3WQGzd9.exe PID 4904 wrote to memory of 2624 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe d3WQGzd9.exe PID 4904 wrote to memory of 2624 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe d3WQGzd9.exe PID 2624 wrote to memory of 1920 2624 d3WQGzd9.exe koaofo.exe PID 2624 wrote to memory of 1920 2624 d3WQGzd9.exe koaofo.exe PID 2624 wrote to memory of 1920 2624 d3WQGzd9.exe koaofo.exe PID 2624 wrote to memory of 1456 2624 d3WQGzd9.exe cmd.exe PID 2624 wrote to memory of 1456 2624 d3WQGzd9.exe cmd.exe PID 2624 wrote to memory of 1456 2624 d3WQGzd9.exe cmd.exe PID 1456 wrote to memory of 5008 1456 cmd.exe tasklist.exe PID 1456 wrote to memory of 5008 1456 cmd.exe tasklist.exe PID 1456 wrote to memory of 5008 1456 cmd.exe tasklist.exe PID 4904 wrote to memory of 4708 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe awhost.exe PID 4904 wrote to memory of 4708 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe awhost.exe PID 4904 wrote to memory of 4708 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe awhost.exe PID 4708 wrote to memory of 3316 4708 awhost.exe svchost.exe PID 4708 wrote to memory of 3316 4708 awhost.exe svchost.exe PID 4708 wrote to memory of 3316 4708 awhost.exe svchost.exe PID 4708 wrote to memory of 3316 4708 awhost.exe svchost.exe PID 4904 wrote to memory of 4120 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe bwhost.exe PID 4904 wrote to memory of 4120 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe bwhost.exe PID 4904 wrote to memory of 4120 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe bwhost.exe PID 4120 wrote to memory of 4840 4120 bwhost.exe bwhost.exe PID 4120 wrote to memory of 4840 4120 bwhost.exe bwhost.exe PID 4120 wrote to memory of 4840 4120 bwhost.exe bwhost.exe PID 4120 wrote to memory of 4840 4120 bwhost.exe bwhost.exe PID 4120 wrote to memory of 4840 4120 bwhost.exe bwhost.exe PID 4120 wrote to memory of 4840 4120 bwhost.exe bwhost.exe PID 4120 wrote to memory of 4840 4120 bwhost.exe bwhost.exe PID 4120 wrote to memory of 4840 4120 bwhost.exe bwhost.exe PID 4120 wrote to memory of 4840 4120 bwhost.exe bwhost.exe PID 4840 wrote to memory of 4348 4840 bwhost.exe explorer.exe PID 4840 wrote to memory of 4348 4840 bwhost.exe explorer.exe PID 4840 wrote to memory of 4348 4840 bwhost.exe explorer.exe PID 4904 wrote to memory of 5052 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe cwhost.exe PID 4904 wrote to memory of 5052 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe cwhost.exe PID 4904 wrote to memory of 5052 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe cwhost.exe PID 5052 wrote to memory of 3240 5052 cwhost.exe cwhost.exe PID 5052 wrote to memory of 3240 5052 cwhost.exe cwhost.exe PID 5052 wrote to memory of 3240 5052 cwhost.exe cwhost.exe PID 5052 wrote to memory of 4664 5052 cwhost.exe cwhost.exe PID 5052 wrote to memory of 4664 5052 cwhost.exe cwhost.exe PID 5052 wrote to memory of 4664 5052 cwhost.exe cwhost.exe PID 4904 wrote to memory of 3508 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe dwhost.exe PID 4904 wrote to memory of 3508 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe dwhost.exe PID 4904 wrote to memory of 3508 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe dwhost.exe PID 4904 wrote to memory of 3516 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe cmd.exe PID 4904 wrote to memory of 3516 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe cmd.exe PID 4904 wrote to memory of 3516 4904 c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe cmd.exe PID 3516 wrote to memory of 2292 3516 cmd.exe tasklist.exe PID 3516 wrote to memory of 2292 3516 cmd.exe tasklist.exe PID 3516 wrote to memory of 2292 3516 cmd.exe tasklist.exe PID 1920 wrote to memory of 2292 1920 koaofo.exe tasklist.exe PID 1920 wrote to memory of 2292 1920 koaofo.exe tasklist.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe"C:\Users\Admin\AppData\Local\Temp\c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe"C:\Users\Admin\AppData\Local\Temp\c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\d3WQGzd9.exeC:\Users\Admin\d3WQGzd9.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\koaofo.exe"C:\Users\Admin\koaofo.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del d3WQGzd9.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\awhost.exeC:\Users\Admin\awhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 845⤵
- Program crash
-
C:\Users\Admin\bwhost.exeC:\Users\Admin\bwhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\bwhost.exe"C:\Users\Admin\bwhost.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe000000DC*5⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4348 -s 6766⤵
- Program crash
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Roaming\conhost.exe%C:\Users\Admin\AppData\Roaming4⤵
- Executes dropped EXE
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Local\Temp\dwm.exe%C:\Users\Admin\AppData\Local\Temp4⤵
- Executes dropped EXE
-
C:\Users\Admin\dwhost.exeC:\Users\Admin\dwhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del c953bbc718fb0d3bfea47305027c59cb821e6f8c80c30f8a8a9d466b6d96ba77.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3316 -ip 33161⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 492 -p 4348 -ip 43481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\awhost.exeFilesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
C:\Users\Admin\awhost.exeFilesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
C:\Users\Admin\bwhost.exeFilesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
C:\Users\Admin\bwhost.exeFilesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
C:\Users\Admin\bwhost.exeFilesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
C:\Users\Admin\cwhost.exeFilesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
C:\Users\Admin\cwhost.exeFilesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
C:\Users\Admin\cwhost.exeFilesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
C:\Users\Admin\cwhost.exeFilesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
C:\Users\Admin\d3WQGzd9.exeFilesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
C:\Users\Admin\d3WQGzd9.exeFilesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
C:\Users\Admin\dwhost.exeFilesize
24KB
MD5aaa893d374547f20f7fdd7c3b6c56b36
SHA1f7aab7bd60af5e948b71abcccbcfb1d62f6580ff
SHA25617c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03
SHA512491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31
-
C:\Users\Admin\dwhost.exeFilesize
24KB
MD5aaa893d374547f20f7fdd7c3b6c56b36
SHA1f7aab7bd60af5e948b71abcccbcfb1d62f6580ff
SHA25617c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03
SHA512491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31
-
C:\Users\Admin\koaofo.exeFilesize
364KB
MD5e17d13d2218d052160cf9894e0180c71
SHA172f82d477173e39e3ef1adc1b14e24e252282f48
SHA256580df8d72eaff59e7270c4cf24b7662dc43a5d80fc3a6193fe6cda7369974ff3
SHA512730d80d805017a78aa61b57eaab21b73cf655178b6ce8c8fa0bf2c672d91dd818fc60a6fdd31e6900cbc19cab761ebb5d449ae6a4c0b9a8631ff757991aed533
-
C:\Users\Admin\koaofo.exeFilesize
364KB
MD5e17d13d2218d052160cf9894e0180c71
SHA172f82d477173e39e3ef1adc1b14e24e252282f48
SHA256580df8d72eaff59e7270c4cf24b7662dc43a5d80fc3a6193fe6cda7369974ff3
SHA512730d80d805017a78aa61b57eaab21b73cf655178b6ce8c8fa0bf2c672d91dd818fc60a6fdd31e6900cbc19cab761ebb5d449ae6a4c0b9a8631ff757991aed533
-
memory/1456-150-0x0000000000000000-mapping.dmp
-
memory/1920-145-0x0000000000000000-mapping.dmp
-
memory/2292-194-0x0000000000000000-mapping.dmp
-
memory/2624-140-0x0000000000000000-mapping.dmp
-
memory/3240-180-0x0000000000784000-0x000000000079C000-memory.dmpFilesize
96KB
-
memory/3240-179-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/3240-177-0x0000000000000000-mapping.dmp
-
memory/3316-157-0x0000000000000000-mapping.dmp
-
memory/3508-187-0x0000000000000000-mapping.dmp
-
memory/3516-192-0x0000000000000000-mapping.dmp
-
memory/4120-159-0x0000000000000000-mapping.dmp
-
memory/4348-169-0x0000000000000000-mapping.dmp
-
memory/4348-171-0x0000000000A10000-0x0000000000A25000-memory.dmpFilesize
84KB
-
memory/4664-186-0x00000000006B3000-0x00000000006CB000-memory.dmpFilesize
96KB
-
memory/4664-185-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/4664-183-0x0000000000000000-mapping.dmp
-
memory/4708-152-0x0000000000000000-mapping.dmp
-
memory/4840-165-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4840-164-0x0000000000000000-mapping.dmp
-
memory/4840-168-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4904-170-0x0000000000400000-0x00000000004C4000-memory.dmpFilesize
784KB
-
memory/4904-134-0x0000000000000000-mapping.dmp
-
memory/4904-139-0x0000000000400000-0x00000000004C4000-memory.dmpFilesize
784KB
-
memory/4904-193-0x0000000000400000-0x00000000004C4000-memory.dmpFilesize
784KB
-
memory/4904-135-0x0000000000400000-0x00000000004C4000-memory.dmpFilesize
784KB
-
memory/5008-151-0x0000000000000000-mapping.dmp
-
memory/5052-182-0x00000000006E2000-0x00000000006FA000-memory.dmpFilesize
96KB
-
memory/5052-181-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/5052-172-0x0000000000000000-mapping.dmp
-
memory/5052-176-0x00000000006E2000-0x00000000006FA000-memory.dmpFilesize
96KB
-
memory/5052-175-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB