blackmoon | a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289

Analysis

max time kernel
206s
max time network
211s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
Size

1.7MB
MD5

03f2cc5579453efedb3a98f9b7387d42
SHA1

85a1565b26f15e36f6799e9907cf820700e7dff7
SHA256

a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289
SHA512

30f0e51b3f03eb429904bf15b2e8a15b7781715fff388cb64312cc1bdf13973a1e1304cb470de8cac10d2da6de8ba6acd43ac3c6aa3b4adcbab40864f5d6ba03
SSDEEP

49152:OG7UzKxGCJ/rD7GcHgA2EJUuTHIyPdbqvAoztFbG5d:OGmKxGSD7GcHgNEVTo2dbqvrzSd

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

resource	yara_rule
behavioral1/memory/904-70-0x0000000000400000-0x0000000000785000-memory.dmp	family_blackmoon
behavioral1/memory/904-72-0x0000000000400000-0x0000000000785000-memory.dmp	family_blackmoon
behavioral1/memory/904-84-0x0000000000400000-0x0000000000785000-memory.dmp	family_blackmoon
behavioral1/memory/1828-87-0x0000000000400000-0x0000000000785000-memory.dmp	family_blackmoon
behavioral1/memory/1828-88-0x0000000000400000-0x0000000000785000-memory.dmp	family_blackmoon

Executes dropped EXE 2 IoCs

pid	Process
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
904	data.dll

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000014b98-62.dat	upx
behavioral1/files/0x000a000000014b98-65.dat	upx
behavioral1/files/0x000a000000014b98-63.dat	upx
behavioral1/files/0x000a000000014b98-67.dat	upx
behavioral1/memory/904-70-0x0000000000400000-0x0000000000785000-memory.dmp	upx
behavioral1/memory/904-72-0x0000000000400000-0x0000000000785000-memory.dmp	upx
behavioral1/memory/1828-74-0x0000000000400000-0x0000000000785000-memory.dmp	upx
behavioral1/memory/1828-77-0x0000000000400000-0x0000000000785000-memory.dmp	upx
behavioral1/memory/1828-80-0x0000000000400000-0x0000000000785000-memory.dmp	upx
behavioral1/memory/904-84-0x0000000000400000-0x0000000000785000-memory.dmp	upx
behavioral1/memory/1828-86-0x0000000000400000-0x0000000000785000-memory.dmp	upx
behavioral1/memory/1828-87-0x0000000000400000-0x0000000000785000-memory.dmp	upx
behavioral1/memory/1828-88-0x0000000000400000-0x0000000000785000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SysimtmS.db	data.dll
File created	C:\Windows\SysWOW64\ÅäÖÃ.db	cmd.exe
File created	C:\Windows\SysWOW64\Skin.jpg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ÅäÖÃ.db	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Ê¹ÓÃ½Ì³ÌÓë¸üÐÂËµÃ÷.txt	NOTEPAD.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 904 set thread context of 1828	904	data.dll	35

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000069f05204cba3b506b9d0bfb6232995a4411dbc28229afbaff67b02eef5460155000000000e8000000002000020000000bbe6e3adb8d974446bf43e70320bee4e1203c08f3a667d53097ecd945043e61c90000000273825a9411d53da8460a173a76e8b6567d1cace0e7e01f8d45f31614f18486887792998857b341cecf43a2bef524900e7349a63a794a9fd86c019ee8f6b4ea35e5ed6d132de24066a61f90dfe1eb881ca1ed4c1e41f8af04cec671d30de140a710011f0e647658256dfa4a467c93fc89c0c9bef9c4482f4b5d06b58d083874e9a498af8d84e44267f08bb32d6226a0640000000bd7fb65869733ff355dae04c878a051db31e46f45df19dbb19bb1758be1a5a71d2967dfcecf50097f409d609458477a23e5276fd6f55aa61aee4b4d2101f1c3f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\6896600.com\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377347272"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92718490-77AD-11ED-B1EF-6A950B37D0A0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\superveryvipa.6896600.com\ = "63"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d55f7fba0bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\superveryvipa.6896600.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000027a0aa38247fe42f33c6e3f92a8721c2207c598036bfd561731be9533266a695000000000e8000000002000020000000acf579621e3624e8ce8df438ea8fe85abfcb4f3efbd1d6ec609cb4369312ad9120000000936516d818d193725236bccb818f35fbd046155045f67b103ff60c73324423fb40000000879235e4df6cf03713cb849bf17356376197b67156149cf843d69db1e52de8000ad00bc1e1e6af6c24a44e9c9c157d981afe4801eba02dab34826f2b05f7db5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\6896600.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\6896600.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
904	data.dll
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	cmd.exe
Token: 33	1828	cmd.exe
Token: SeIncBasePriorityPrivilege	1828	cmd.exe
Token: 33	1828	cmd.exe
Token: SeIncBasePriorityPrivilege	1828	cmd.exe
Token: 33	1828	cmd.exe
Token: SeIncBasePriorityPrivilege	1828	cmd.exe
Token: 33	1828	cmd.exe
Token: SeIncBasePriorityPrivilege	1828	cmd.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1340	iexplore.exe
1828	cmd.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1828	cmd.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
904	data.dll
904	data.dll
1340	iexplore.exe
1340	iexplore.exe
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1828	cmd.exe
1828	cmd.exe
1828	cmd.exe
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1964	2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	27
PID 2008 wrote to memory of 1964	2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	27
PID 2008 wrote to memory of 1964	2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	27
PID 2008 wrote to memory of 1964	2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	27
PID 2008 wrote to memory of 1000	2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	28
PID 2008 wrote to memory of 1000	2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	28
PID 2008 wrote to memory of 1000	2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	28
PID 2008 wrote to memory of 1000	2008	a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	28
PID 1964 wrote to memory of 904	1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	29
PID 1964 wrote to memory of 904	1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	29
PID 1964 wrote to memory of 904	1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	29
PID 1964 wrote to memory of 904	1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	29
PID 328 wrote to memory of 1340	328	explorer.exe	31
PID 328 wrote to memory of 1340	328	explorer.exe	31
PID 328 wrote to memory of 1340	328	explorer.exe	31
PID 1340 wrote to memory of 1204	1340	iexplore.exe	33
PID 1340 wrote to memory of 1204	1340	iexplore.exe	33
PID 1340 wrote to memory of 1204	1340	iexplore.exe	33
PID 1340 wrote to memory of 1204	1340	iexplore.exe	33
PID 904 wrote to memory of 1828	904	data.dll	35
PID 904 wrote to memory of 1828	904	data.dll	35
PID 904 wrote to memory of 1828	904	data.dll	35
PID 904 wrote to memory of 1828	904	data.dll	35
PID 904 wrote to memory of 1828	904	data.dll	35
PID 904 wrote to memory of 1828	904	data.dll	35
PID 904 wrote to memory of 1828	904	data.dll	35
PID 904 wrote to memory of 1828	904	data.dll	35
PID 1964 wrote to memory of 2040	1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	36
PID 1964 wrote to memory of 2040	1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	36
PID 1964 wrote to memory of 2040	1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	36
PID 1964 wrote to memory of 2040	1964	.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe	36
PID 1340 wrote to memory of 1928	1340	iexplore.exe	38
PID 1340 wrote to memory of 1928	1340	iexplore.exe	38
PID 1340 wrote to memory of 1928	1340	iexplore.exe	38
PID 1340 wrote to memory of 1928	1340	iexplore.exe	38
PID 1828 wrote to memory of 1296	1828	cmd.exe	39
PID 1828 wrote to memory of 1296	1828	cmd.exe	39
PID 1828 wrote to memory of 1296	1828	cmd.exe	39
PID 1828 wrote to memory of 1296	1828	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
"C:\Users\Admin\AppData\Local\Temp\a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
  C:\Users\Admin\AppData\Local\Temp\.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\data.dll
    data.dll
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Windows\SysWOW64\NOTEPAD.exe
        
        NOTEPAD C:\Windows\SysWOW64\Ê¹ÓÃ½Ì³ÌÓë¸üÐÂËµÃ÷.txt
        5⤵
        Drops file in System32 directory
        
        PID:1296
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe "http://www.shuangy.com/waigua.html"
    3⤵
    PID:2040
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe "http://www.shuangy.com"
  2⤵
  PID:1000

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.shuangy.com/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1204
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275461 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1928

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3bf854fd3a094099087be1428c5e8d90

SHA1
2a74df36eef1f4f8da8bdebafaf12f21c5a5d153

SHA256
7f871a80327d16b15a0771a94fc4648e955d83b2c55cfc6acfcccc25b7833a7b

SHA512
91e8c3380b02bc8aa334ee63e50a43e6ab53f4e5a7b4a1ed41a026a028df62ad43b4c61e590a690e7d27981ef4499bda0f06b59e66a29b83170ab24d9f7525b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t9o3c8r\imagestore.dat

Filesize
4KB

MD5
169693188b285a2e4c4d7278e73ea91f

SHA1
e40a67fe786f2e726e0755df03051d019ddfeac1

SHA256
6a498a181af2765be785d484e3299b49a850ae54c0774c9cba2f4754d0c65de6

SHA512
58ee2ea51cae12b5484c575989f2a5decf9a134168e7a5b97083fdf42367313b860f9f1c41e18ebfa1661fc9b5152438af1e6dd657092fc3fc0ba350eb41c3f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LZLYL77D\favicon[2].ico

Filesize
4KB

MD5
2078a69bf68e43b1a9b3ea4caa01cdeb

SHA1
705231be423060e06cf18dc76ea61c629898cbb0

SHA256
e471a9f02d1bb949155890f497d7b6188766b88154bf5aecc713d0ce4513723a

SHA512
4e2032974a289732be0d2d059cde6f60635e06a3748e9f478cc14b88013a7f45d7a764d32ee68f2d237f1300aff24df6167592a818b3273d7339e6f5430736e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe

Filesize
1.7MB

MD5
ad82dba72c0767b7a1dc1cb98d9c586a

SHA1
17cc3bdff44de676549739cce95e790c38a84442

SHA256
0fe58b71d53d0ce64dab2895556e349fe52c6c7da19162b075994ca7c95b82df

SHA512
6e937a8c7a3425d394a15792d9db484e94a6b261b70dafce3063d793f72b6724cd201e03a2122d5966e31325dffa1166ce2a5d31a941c3322e7761ee43909988

Download Submit
C:\Users\Admin\AppData\Local\Temp\data.dll

Filesize
1.6MB

MD5
f9c24a384df9341adcf6f607796af1fa

SHA1
d812521b224c41a5a215969d5ec1e867a9acf243

SHA256
0f90c2e77c506a0e03e4c7b673669eaf78ff3e17d0b60d90611684cc2d5fb0bb

SHA512
c8f9d15a3b5f8690ee5c60e7e63dadf7fc6675e698573c6f2aa37705655b4b7e82fc7007be277ed6eab96d0428c2e11b510dd428e4efbfa2ebe8fc01d4983e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\data.dll

Filesize
1.6MB

MD5
f9c24a384df9341adcf6f607796af1fa

SHA1
d812521b224c41a5a215969d5ec1e867a9acf243

SHA256
0f90c2e77c506a0e03e4c7b673669eaf78ff3e17d0b60d90611684cc2d5fb0bb

SHA512
c8f9d15a3b5f8690ee5c60e7e63dadf7fc6675e698573c6f2aa37705655b4b7e82fc7007be277ed6eab96d0428c2e11b510dd428e4efbfa2ebe8fc01d4983e8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6WH7HYS8.txt

Filesize
130B

MD5
608b353c76a8ab5292b5b9ba0acf1cd6

SHA1
5c88c53275ee9533daeeb388276f02e2ce613671

SHA256
093b4dde07ba3d3cd057d4c5d6b9784be8be2cd69baef1400288cb89eac80d45

SHA512
ab5b99bf76aa2c2c2e309a34b6463c6faa0c60600fe93fd649b3e0c0bee4ae62af67c24b3916d8fea7ada1a854fac63d3d8361c4ab0e1633007774f5272b2308

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KJ604YLU.txt

Filesize
101B

MD5
c48729f8b2f4ed7bb00123c81a26faba

SHA1
f30772b547cc07e30fd6072edc4b5ace920d9263

SHA256
d048ae4fd37d43c9c627241babd4c8efca779bab2235718bc9d4dda18578a6c4

SHA512
066c5505691f2fd31ff2d0997d99ce884c6fc6307a18c47b28c13058fde3ae4eba1424c6761b27ec58977dc46901077e3b8776e3976db7d0843ac58edc9435b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YA1XLDJF.txt

Filesize
608B

MD5
8b772ffda862f5d7ceee45cb820e560b

SHA1
18b9462e1369a15716c486783bf1ece0cc98290b

SHA256
d8b59451d49d2c945d964583bc80842ee01ce78a987a750fa32ff5bfe0f271ea

SHA512
8fed0d031d2d24a5b4f160e33966a64e61d70145508ab26212cf20ee1de3e86090d4ed5b934528b95f3931c41bebc9a442f16330e6cd78efdfb479cf4de8a48f

Download Submit
\Users\Admin\AppData\Local\Temp\.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe

Filesize
1.7MB

MD5
ad82dba72c0767b7a1dc1cb98d9c586a

SHA1
17cc3bdff44de676549739cce95e790c38a84442

SHA256
0fe58b71d53d0ce64dab2895556e349fe52c6c7da19162b075994ca7c95b82df

SHA512
6e937a8c7a3425d394a15792d9db484e94a6b261b70dafce3063d793f72b6724cd201e03a2122d5966e31325dffa1166ce2a5d31a941c3322e7761ee43909988

Download Submit
\Users\Admin\AppData\Local\Temp\.a7afadcf473eb1ec7dea3dcdb34a0c975ae0f5cf3ce4cd7e252ed7629d721289.exe

Filesize
1.7MB

MD5
ad82dba72c0767b7a1dc1cb98d9c586a

SHA1
17cc3bdff44de676549739cce95e790c38a84442

SHA256
0fe58b71d53d0ce64dab2895556e349fe52c6c7da19162b075994ca7c95b82df

SHA512
6e937a8c7a3425d394a15792d9db484e94a6b261b70dafce3063d793f72b6724cd201e03a2122d5966e31325dffa1166ce2a5d31a941c3322e7761ee43909988

Download Submit
\Users\Admin\AppData\Local\Temp\data.dll

Filesize
1.6MB

MD5
f9c24a384df9341adcf6f607796af1fa

SHA1
d812521b224c41a5a215969d5ec1e867a9acf243

SHA256
0f90c2e77c506a0e03e4c7b673669eaf78ff3e17d0b60d90611684cc2d5fb0bb

SHA512
c8f9d15a3b5f8690ee5c60e7e63dadf7fc6675e698573c6f2aa37705655b4b7e82fc7007be277ed6eab96d0428c2e11b510dd428e4efbfa2ebe8fc01d4983e8a

Download Submit
\Users\Admin\AppData\Local\Temp\data.dll

Filesize
1.6MB

MD5
f9c24a384df9341adcf6f607796af1fa

SHA1
d812521b224c41a5a215969d5ec1e867a9acf243

SHA256
0f90c2e77c506a0e03e4c7b673669eaf78ff3e17d0b60d90611684cc2d5fb0bb

SHA512
c8f9d15a3b5f8690ee5c60e7e63dadf7fc6675e698573c6f2aa37705655b4b7e82fc7007be277ed6eab96d0428c2e11b510dd428e4efbfa2ebe8fc01d4983e8a

Download Submit
memory/328-71-0x000007FEFB5F1000-0x000007FEFB5F3000-memory.dmp

Filesize
8KB

Download
memory/904-72-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/904-70-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/904-84-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1000-68-0x00000000731F1000-0x00000000731F3000-memory.dmp

Filesize
8KB

Download
memory/1828-80-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1828-74-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1828-89-0x00000000005DF000-0x000000000077E000-memory.dmp

Filesize
1.6MB

Download
memory/1828-90-0x0000000000401000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/1828-87-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1828-86-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1828-98-0x00000000005DF000-0x000000000077E000-memory.dmp

Filesize
1.6MB

Download
memory/1828-88-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1828-77-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1964-69-0x0000000002E70000-0x00000000031F5000-memory.dmp

Filesize
3.5MB

Download
memory/2008-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/2040-93-0x0000000071301000-0x0000000071303000-memory.dmp

Filesize
8KB

Download