adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0

General

Target

adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
Size

120KB
MD5

369284a974fd9dc5fe6a7da812c9d40c
SHA1

407c2ab19dbcb1c883c7167ff7404a2788ee4023
SHA256

adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0
SHA512

b9767fb0e19f757ec268123c5c0304210ae29b66d9dc063341e6a5ed040dcd82605fd337820b6970338c04d1de0394380ec50d714e839a4863bc8b1054d76077
SSDEEP

3072:0Xqc+pYL51ZskXs7IeXRcMjPdqwboU1xY0w+O:0XEpwsk8z9FVz3Y0fO

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

BbrPAbKx.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Program Files (x86)\\Common Files\\dNhTUEPQ.exe"	BbrPAbKx.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

BbrPAbKx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	BbrPAbKx.exe

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

BbrPAbKx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4"	BbrPAbKx.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

BbrPAbKx.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BbrPAbKx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BbrPAbKx.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

BbrPAbKx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	BbrPAbKx.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 4 IoCs

Processes:

BbrPAbKx.exeBbrPAbKx.exeaTPQutuUTW.exeaTPQutuUTW.exe

pid process

4364 BbrPAbKx.exe
660 BbrPAbKx.exe
1992 aTPQutuUTW.exe
5092 aTPQutuUTW.exe

pid	process
4364	BbrPAbKx.exe
660	BbrPAbKx.exe
1992	aTPQutuUTW.exe
5092	aTPQutuUTW.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4804-133-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4804-136-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4804-137-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4804-138-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4804-139-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4804-149-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/660-153-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/5092-160-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/660-165-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/5092-166-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exeBbrPAbKx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	BbrPAbKx.exe

Drops startup file 2 IoCs

Processes:

BbrPAbKx.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ftbSrfWo.exe	BbrPAbKx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ftbSrfWo.exe	BbrPAbKx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

BbrPAbKx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	BbrPAbKx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	BbrPAbKx.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

BbrPAbKx.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	BbrPAbKx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ndYYZKRt = "C:\\Users\\Admin\\AppData\\Local\\PlaceholderTileLogoFolder\\jjMOVsOj.exe"	BbrPAbKx.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

BbrPAbKx.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BbrPAbKx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BbrPAbKx.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exeBbrPAbKx.exeaTPQutuUTW.exe

description	pid	process	target process
PID 3468 set thread context of 4804	3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
PID 4364 set thread context of 660	4364	BbrPAbKx.exe	BbrPAbKx.exe
PID 1992 set thread context of 5092	1992	aTPQutuUTW.exe	aTPQutuUTW.exe

Drops file in Program Files directory 2 IoCs

Processes:

BbrPAbKx.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\dNhTUEPQ.exe	BbrPAbKx.exe
File opened for modification	C:\Program Files (x86)\Common Files\dNhTUEPQ.exe	BbrPAbKx.exe

Drops file in Windows directory 2 IoCs

Processes:

sdbinst.exe

description	ioc	process
File created	C:\Windows\AppPatch\CustomSDB\{36bc1fdc-b862-2e72-a57e-672e3b92ab2c}.sdb	sdbinst.exe
File opened for modification	C:\Windows\AppPatch\CustomSDB\{36bc1fdc-b862-2e72-a57e-672e3b92ab2c}.sdb	sdbinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exeBbrPAbKx.exeaTPQutuUTW.exeBbrPAbKx.exe

pid	process
3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
4364	BbrPAbKx.exe
4364	BbrPAbKx.exe
4364	BbrPAbKx.exe
4364	BbrPAbKx.exe
1992	aTPQutuUTW.exe
1992	aTPQutuUTW.exe
1992	aTPQutuUTW.exe
1992	aTPQutuUTW.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe
660	BbrPAbKx.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exeBbrPAbKx.exeaTPQutuUTW.exe

description	pid	process
Token: SeSecurityPrivilege	4804	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
Token: SeDebugPrivilege	4804	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
Token: SeTcbPrivilege	4804	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
Token: SeSecurityPrivilege	660	BbrPAbKx.exe
Token: SeDebugPrivilege	660	BbrPAbKx.exe
Token: SeTcbPrivilege	660	BbrPAbKx.exe
Token: SeSecurityPrivilege	5092	aTPQutuUTW.exe
Token: SeDebugPrivilege	5092	aTPQutuUTW.exe
Token: SeTcbPrivilege	5092	aTPQutuUTW.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exeBbrPAbKx.exeaTPQutuUTW.exe

pid	process
3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
4364	BbrPAbKx.exe
4364	BbrPAbKx.exe
1992	aTPQutuUTW.exe
1992	aTPQutuUTW.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exeadfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exeBbrPAbKx.exeBbrPAbKx.exeaTPQutuUTW.exe

description	pid	process	target process
PID 3468 wrote to memory of 4804	3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
PID 3468 wrote to memory of 4804	3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
PID 3468 wrote to memory of 4804	3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
PID 3468 wrote to memory of 4804	3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
PID 3468 wrote to memory of 4804	3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
PID 3468 wrote to memory of 4804	3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
PID 3468 wrote to memory of 4804	3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
PID 3468 wrote to memory of 4804	3468	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
PID 4804 wrote to memory of 4364	4804	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	BbrPAbKx.exe
PID 4804 wrote to memory of 4364	4804	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	BbrPAbKx.exe
PID 4804 wrote to memory of 4364	4804	adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe	BbrPAbKx.exe
PID 4364 wrote to memory of 660	4364	BbrPAbKx.exe	BbrPAbKx.exe
PID 4364 wrote to memory of 660	4364	BbrPAbKx.exe	BbrPAbKx.exe
PID 4364 wrote to memory of 660	4364	BbrPAbKx.exe	BbrPAbKx.exe
PID 4364 wrote to memory of 660	4364	BbrPAbKx.exe	BbrPAbKx.exe
PID 4364 wrote to memory of 660	4364	BbrPAbKx.exe	BbrPAbKx.exe
PID 4364 wrote to memory of 660	4364	BbrPAbKx.exe	BbrPAbKx.exe
PID 4364 wrote to memory of 660	4364	BbrPAbKx.exe	BbrPAbKx.exe
PID 4364 wrote to memory of 660	4364	BbrPAbKx.exe	BbrPAbKx.exe
PID 660 wrote to memory of 1992	660	BbrPAbKx.exe	aTPQutuUTW.exe
PID 660 wrote to memory of 1992	660	BbrPAbKx.exe	aTPQutuUTW.exe
PID 660 wrote to memory of 1992	660	BbrPAbKx.exe	aTPQutuUTW.exe
PID 1992 wrote to memory of 5092	1992	aTPQutuUTW.exe	aTPQutuUTW.exe
PID 1992 wrote to memory of 5092	1992	aTPQutuUTW.exe	aTPQutuUTW.exe
PID 1992 wrote to memory of 5092	1992	aTPQutuUTW.exe	aTPQutuUTW.exe
PID 1992 wrote to memory of 5092	1992	aTPQutuUTW.exe	aTPQutuUTW.exe
PID 1992 wrote to memory of 5092	1992	aTPQutuUTW.exe	aTPQutuUTW.exe
PID 1992 wrote to memory of 5092	1992	aTPQutuUTW.exe	aTPQutuUTW.exe
PID 1992 wrote to memory of 5092	1992	aTPQutuUTW.exe	aTPQutuUTW.exe
PID 1992 wrote to memory of 5092	1992	aTPQutuUTW.exe	aTPQutuUTW.exe
PID 660 wrote to memory of 4124	660	BbrPAbKx.exe	sdbinst.exe
PID 660 wrote to memory of 4124	660	BbrPAbKx.exe	sdbinst.exe
PID 660 wrote to memory of 4124	660	BbrPAbKx.exe	sdbinst.exe
PID 660 wrote to memory of 4440	660	BbrPAbKx.exe	ntprint.exe
PID 660 wrote to memory of 4440	660	BbrPAbKx.exe	ntprint.exe
PID 660 wrote to memory of 4440	660	BbrPAbKx.exe	ntprint.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

BbrPAbKx.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BbrPAbKx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BbrPAbKx.exe

C:\Users\Admin\AppData\Local\Temp\adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
"C:\Users\Admin\AppData\Local\Temp\adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468

C:\Users\Admin\AppData\Local\Temp\adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
C:\Users\Admin\AppData\Local\Temp\adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0.exe
2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\BbrPAbKx.exe
"C:\Users\Admin\AppData\Local\Temp\BbrPAbKx.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364

C:\Users\Admin\AppData\Local\Temp\BbrPAbKx.exe
C:\Users\Admin\AppData\Local\Temp\BbrPAbKx.exe
4⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:660

C:\Users\Admin\AppData\Local\Temp\aTPQutuUTW.exe
"C:\Users\Admin\AppData\Local\Temp\aTPQutuUTW.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\aTPQutuUTW.exe
C:\Users\Admin\AppData\Local\Temp\aTPQutuUTW.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\SysWOW64\sdbinst.exe
"C:\Windows\system32\sdbinst.exe" C:\Users\Admin\AppData\Local\Temp\kxakROKb.sdb
5⤵
- Drops file in Windows directory
PID:4124

C:\Windows\SysWOW64\ntprint.exe
"C:\Windows\system32\ntprint.exe"
5⤵
PID:4440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

2

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Modify Registry

8

T1112

Bypass User Account Control

1

T1088

Disabling Security Tools

3

T1089

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BbrPAbKx.exe
Filesize
120KB

MD5
369284a974fd9dc5fe6a7da812c9d40c

SHA1
407c2ab19dbcb1c883c7167ff7404a2788ee4023

SHA256
adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0

SHA512
b9767fb0e19f757ec268123c5c0304210ae29b66d9dc063341e6a5ed040dcd82605fd337820b6970338c04d1de0394380ec50d714e839a4863bc8b1054d76077

Download Submit
C:\Users\Admin\AppData\Local\Temp\BbrPAbKx.exe
Filesize
120KB

MD5
369284a974fd9dc5fe6a7da812c9d40c

SHA1
407c2ab19dbcb1c883c7167ff7404a2788ee4023

SHA256
adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0

SHA512
b9767fb0e19f757ec268123c5c0304210ae29b66d9dc063341e6a5ed040dcd82605fd337820b6970338c04d1de0394380ec50d714e839a4863bc8b1054d76077

Download Submit
C:\Users\Admin\AppData\Local\Temp\BbrPAbKx.exe
Filesize
120KB

MD5
369284a974fd9dc5fe6a7da812c9d40c

SHA1
407c2ab19dbcb1c883c7167ff7404a2788ee4023

SHA256
adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0

SHA512
b9767fb0e19f757ec268123c5c0304210ae29b66d9dc063341e6a5ed040dcd82605fd337820b6970338c04d1de0394380ec50d714e839a4863bc8b1054d76077

Download Submit
C:\Users\Admin\AppData\Local\Temp\aTPQutuUTW.exe
Filesize
120KB

MD5
369284a974fd9dc5fe6a7da812c9d40c

SHA1
407c2ab19dbcb1c883c7167ff7404a2788ee4023

SHA256
adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0

SHA512
b9767fb0e19f757ec268123c5c0304210ae29b66d9dc063341e6a5ed040dcd82605fd337820b6970338c04d1de0394380ec50d714e839a4863bc8b1054d76077

Download Submit
C:\Users\Admin\AppData\Local\Temp\aTPQutuUTW.exe
Filesize
120KB

MD5
369284a974fd9dc5fe6a7da812c9d40c

SHA1
407c2ab19dbcb1c883c7167ff7404a2788ee4023

SHA256
adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0

SHA512
b9767fb0e19f757ec268123c5c0304210ae29b66d9dc063341e6a5ed040dcd82605fd337820b6970338c04d1de0394380ec50d714e839a4863bc8b1054d76077

Download Submit
C:\Users\Admin\AppData\Local\Temp\aTPQutuUTW.exe
Filesize
120KB

MD5
369284a974fd9dc5fe6a7da812c9d40c

SHA1
407c2ab19dbcb1c883c7167ff7404a2788ee4023

SHA256
adfc77638b14b736d74169bcb6943bc9f92a50dea1a0596a36880400cae5fdc0

SHA512
b9767fb0e19f757ec268123c5c0304210ae29b66d9dc063341e6a5ed040dcd82605fd337820b6970338c04d1de0394380ec50d714e839a4863bc8b1054d76077

Download Submit
C:\Users\Admin\AppData\Local\Temp\kxakROKb.sdb
Filesize
736B

MD5
4e4422ddd9366f881cc74f5c4a9441c2

SHA1
b65ed3f07fab87a9737aaa715b9f3d7ea23efcb6

SHA256
8e20fa9b728cefd6c95fea21f6dece9edce9a7379cb7ef3c1a92cfddeab24cb1

SHA512
49fa29b21d48926d513a165ed9424934fa9867b423b5067d85ec3c886604db3a20a2c8dbef9183c11607b9879dd3e66b4709bf80a658a3c853f1aeb5fc2c4743

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629973501-4017243118-3254762364-1000\05a2b5f16b0756621746c4cf35402aaa_e32e1c79-b88e-4709-94fb-81034ca3398e
Filesize
49B

MD5
24dd27efac9edef82a35172610478a72

SHA1
6f311565db90972c4ba85052e4d722d608d5403a

SHA256
c61fa097e13f95b73e8ce6bb5a931f9cf0a2883057cce38940e6bf325dbc7b17

SHA512
482ef138cfa1373ca19c31ad17f91ae8873719dafba66ef5c9253931a6ed82624129174598d868daefa2c5d208ee273b69946f138c2cb6b275609d018d6f57f6

Download Submit
memory/660-143-0x0000000000000000-mapping.dmp

Download
memory/660-153-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/660-165-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1992-150-0x0000000000000000-mapping.dmp

Download
memory/3468-135-0x0000000002370000-0x0000000002374000-memory.dmp

Filesize
16KB

Download
memory/4124-161-0x0000000000000000-mapping.dmp

Download
memory/4364-140-0x0000000000000000-mapping.dmp

Download
memory/4440-164-0x0000000000000000-mapping.dmp

Download
memory/4804-139-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4804-149-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4804-132-0x0000000000000000-mapping.dmp

Download
memory/4804-138-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4804-137-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4804-136-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4804-133-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5092-154-0x0000000000000000-mapping.dmp

Download
memory/5092-160-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5092-166-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads