Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
15-12-2022 09:55
Static task
static1
General
-
Target
2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exe
-
Size
327KB
-
MD5
8d73778b1e919c68f023e8995a8aaee0
-
SHA1
b6ba513b4bf1830451aed41121ddf8b5e32ee01f
-
SHA256
2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e
-
SHA512
55d1de360d01ed559e44542254bc454d8d22e7b63f167265fb40d68c82c11c37f43e43d221ae76c841eaf736432ac87b63066056db91871289afb49b2598d999
-
SSDEEP
6144:0YEcLdiKSYgGFVQ2S9d4eWtGncS3Sbjfxur/tb:BhiKA2S9d3WtGnZSbjJurR
Malware Config
Extracted
danabot
49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535
-
type
loader
Extracted
systembc
109.205.214.18:443
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
2460.exeTyiotphai.exe6CA5.exeucvtq.exepid process 1212 2460.exe 4364 Tyiotphai.exe 1152 6CA5.exe 2764 ucvtq.exe -
Deletes itself 1 IoCs
Processes:
pid process 2952 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2460.exerundll32.exedescription pid process target process PID 1212 set thread context of 4232 1212 2460.exe rundll32.exe PID 4232 set thread context of 4660 4232 rundll32.exe rundll32.exe -
Drops file in Windows directory 3 IoCs
Processes:
6CA5.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri File created C:\Windows\Tasks\ucvtq.job 6CA5.exe File opened for modification C:\Windows\Tasks\ucvtq.job 6CA5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exe -
Checks processor information in registry 2 TTPs 49 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2460.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet 2460.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status 2460.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 2460.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 2460.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2460.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2460.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2460.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 2460.exe -
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Toolbar Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 -
Modifies registry class 53 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e003100000000008f55104f100054656d7000003a0009000400efbe2155a8848f55104f2e00000000000000000000000000000000000000000000000000112a8f00540065006d007000000014000000 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
pid process 2952 2952 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exepid process 328 2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exe 328 2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exe 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 2952 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2952 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exepid process 328 2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Tyiotphai.exedescription pid process Token: SeDebugPrivilege 4364 Tyiotphai.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Tyiotphai.exerundll32.exerundll32.exepid process 4364 Tyiotphai.exe 4232 rundll32.exe 4660 rundll32.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Tyiotphai.exepid process 4364 Tyiotphai.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
pid process 2952 2952 2952 2952 -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
2460.exerundll32.exedescription pid process target process PID 2952 wrote to memory of 1212 2952 2460.exe PID 2952 wrote to memory of 1212 2952 2460.exe PID 2952 wrote to memory of 1212 2952 2460.exe PID 1212 wrote to memory of 4364 1212 2460.exe Tyiotphai.exe PID 1212 wrote to memory of 4364 1212 2460.exe Tyiotphai.exe PID 1212 wrote to memory of 4364 1212 2460.exe Tyiotphai.exe PID 1212 wrote to memory of 4232 1212 2460.exe rundll32.exe PID 1212 wrote to memory of 4232 1212 2460.exe rundll32.exe PID 1212 wrote to memory of 4232 1212 2460.exe rundll32.exe PID 1212 wrote to memory of 4232 1212 2460.exe rundll32.exe PID 4232 wrote to memory of 4660 4232 rundll32.exe rundll32.exe PID 4232 wrote to memory of 4660 4232 rundll32.exe rundll32.exe PID 4232 wrote to memory of 4660 4232 rundll32.exe rundll32.exe PID 2952 wrote to memory of 1152 2952 6CA5.exe PID 2952 wrote to memory of 1152 2952 6CA5.exe PID 2952 wrote to memory of 1152 2952 6CA5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exe"C:\Users\Admin\AppData\Local\Temp\2636d2eaa0e284a5e079b558af958ff94b5375893aa39ef55f4f55f7221e6d6e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2460.exeC:\Users\Admin\AppData\Local\Temp\2460.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Tyiotphai.exe"C:\Users\Admin\AppData\Local\Temp\Tyiotphai.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 307653⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\6CA5.exeC:\Users\Admin\AppData\Local\Temp\6CA5.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\ProgramData\recol\ucvtq.exeC:\ProgramData\recol\ucvtq.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\recol\ucvtq.exeFilesize
327KB
MD5a533eeaaec1a873d84936633e153dd0a
SHA1a16f84c4039ddccf9960cee21cb8860f2f1cf34c
SHA2563f6c84150d51188f54330ce514518c879705052abad3f89325e9c279f1d9403e
SHA512c599ec24478794dbe3fd1f3124bb93423b610a5d36eb76d625a2401fcc5f368ee40bca9585ba156a06747c593bc415369ae2106ee48b94044a72a59bd1949b79
-
C:\ProgramData\recol\ucvtq.exeFilesize
327KB
MD5a533eeaaec1a873d84936633e153dd0a
SHA1a16f84c4039ddccf9960cee21cb8860f2f1cf34c
SHA2563f6c84150d51188f54330ce514518c879705052abad3f89325e9c279f1d9403e
SHA512c599ec24478794dbe3fd1f3124bb93423b610a5d36eb76d625a2401fcc5f368ee40bca9585ba156a06747c593bc415369ae2106ee48b94044a72a59bd1949b79
-
C:\Users\Admin\AppData\Local\Temp\2460.exeFilesize
4.5MB
MD515d382b3dc8b132f1f9fc920365e6c1f
SHA117f181aeb9e31768d0bb26c7aa69b7f21fce40f9
SHA2561a092bc94e2aaabc71590a8d4a29e391f7baf57583973f059383254f978a461e
SHA51227d76857400f76a0cf75790e46bc2a8c8a333543d8b707591bad214cb2bdc6a5aafb65b11da0f9880275031d8c58154a05c5477c425096ff31b52aaccf6c598b
-
C:\Users\Admin\AppData\Local\Temp\2460.exeFilesize
4.5MB
MD515d382b3dc8b132f1f9fc920365e6c1f
SHA117f181aeb9e31768d0bb26c7aa69b7f21fce40f9
SHA2561a092bc94e2aaabc71590a8d4a29e391f7baf57583973f059383254f978a461e
SHA51227d76857400f76a0cf75790e46bc2a8c8a333543d8b707591bad214cb2bdc6a5aafb65b11da0f9880275031d8c58154a05c5477c425096ff31b52aaccf6c598b
-
C:\Users\Admin\AppData\Local\Temp\6CA5.exeFilesize
327KB
MD5a533eeaaec1a873d84936633e153dd0a
SHA1a16f84c4039ddccf9960cee21cb8860f2f1cf34c
SHA2563f6c84150d51188f54330ce514518c879705052abad3f89325e9c279f1d9403e
SHA512c599ec24478794dbe3fd1f3124bb93423b610a5d36eb76d625a2401fcc5f368ee40bca9585ba156a06747c593bc415369ae2106ee48b94044a72a59bd1949b79
-
C:\Users\Admin\AppData\Local\Temp\6CA5.exeFilesize
327KB
MD5a533eeaaec1a873d84936633e153dd0a
SHA1a16f84c4039ddccf9960cee21cb8860f2f1cf34c
SHA2563f6c84150d51188f54330ce514518c879705052abad3f89325e9c279f1d9403e
SHA512c599ec24478794dbe3fd1f3124bb93423b610a5d36eb76d625a2401fcc5f368ee40bca9585ba156a06747c593bc415369ae2106ee48b94044a72a59bd1949b79
-
C:\Users\Admin\AppData\Local\Temp\Tyiotphai.exeFilesize
1.4MB
MD5dfa7517406bc186cbc7e7e72491f34e2
SHA1e98c6f327a66a9ecd4c0746e8ef19ae53b2bb8b7
SHA2565b6ea9afdebfce6aafda78bbc6f9a9d81494436e4b159122bbc3122355d7a44b
SHA5122644fb9a879e65aaf99fadb3664772b072cd3ced1f4b8a6b89e149b28588bc0e0a6b5d5d72f0decf31b83875ae87a009c298b3cc036a442c725142297dc8ecda
-
C:\Users\Admin\AppData\Local\Temp\Tyiotphai.exeFilesize
1.4MB
MD5dfa7517406bc186cbc7e7e72491f34e2
SHA1e98c6f327a66a9ecd4c0746e8ef19ae53b2bb8b7
SHA2565b6ea9afdebfce6aafda78bbc6f9a9d81494436e4b159122bbc3122355d7a44b
SHA5122644fb9a879e65aaf99fadb3664772b072cd3ced1f4b8a6b89e149b28588bc0e0a6b5d5d72f0decf31b83875ae87a009c298b3cc036a442c725142297dc8ecda
-
memory/328-120-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-121-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-122-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-123-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-124-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-125-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-126-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-127-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-128-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-129-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-130-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-131-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-132-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-133-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-134-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-136-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-137-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-138-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-139-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-140-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-141-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-143-0x0000000000460000-0x000000000050E000-memory.dmpFilesize
696KB
-
memory/328-144-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-146-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-147-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-148-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-149-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-150-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-151-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-145-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/328-153-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-154-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-155-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-156-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-152-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-142-0x0000000000460000-0x000000000050E000-memory.dmpFilesize
696KB
-
memory/328-157-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1152-483-0x0000000000460000-0x00000000005AA000-memory.dmpFilesize
1.3MB
-
memory/1152-469-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1152-468-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/1152-467-0x0000000000460000-0x00000000005AA000-memory.dmpFilesize
1.3MB
-
memory/1152-408-0x0000000000000000-mapping.dmp
-
memory/1212-173-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-165-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-171-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-172-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-169-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-174-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-175-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-177-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-178-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-179-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-180-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-181-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-182-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-183-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-184-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-185-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-186-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-188-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-187-0x0000000002620000-0x0000000002A6B000-memory.dmpFilesize
4.3MB
-
memory/1212-189-0x0000000002A70000-0x0000000002F09000-memory.dmpFilesize
4.6MB
-
memory/1212-193-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-192-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-194-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-195-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-191-0x0000000000400000-0x000000000089B000-memory.dmpFilesize
4.6MB
-
memory/1212-190-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-263-0x0000000006370000-0x0000000006A95000-memory.dmpFilesize
7.1MB
-
memory/1212-158-0x0000000000000000-mapping.dmp
-
memory/1212-160-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-161-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-470-0x0000000000400000-0x000000000089B000-memory.dmpFilesize
4.6MB
-
memory/1212-162-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-163-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-164-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-427-0x0000000006370000-0x0000000006A95000-memory.dmpFilesize
7.1MB
-
memory/1212-392-0x0000000002620000-0x0000000002A6B000-memory.dmpFilesize
4.3MB
-
memory/1212-394-0x0000000000400000-0x000000000089B000-memory.dmpFilesize
4.6MB
-
memory/1212-170-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-166-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1212-168-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/2764-526-0x00000000004F0000-0x000000000059E000-memory.dmpFilesize
696KB
-
memory/2764-525-0x00000000004F0000-0x000000000059E000-memory.dmpFilesize
696KB
-
memory/2764-523-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2764-522-0x00000000004F0000-0x000000000059E000-memory.dmpFilesize
696KB
-
memory/2764-521-0x00000000004F0000-0x000000000059E000-memory.dmpFilesize
696KB
-
memory/4232-365-0x00000000053E0000-0x0000000005B05000-memory.dmpFilesize
7.1MB
-
memory/4232-406-0x0000000003290000-0x0000000003895000-memory.dmpFilesize
6.0MB
-
memory/4232-274-0x0000000001275FB0-mapping.dmp
-
memory/4232-407-0x00000000053E0000-0x0000000005B05000-memory.dmpFilesize
7.1MB
-
memory/4232-337-0x0000000003290000-0x0000000003895000-memory.dmpFilesize
6.0MB
-
memory/4364-340-0x0000000002260000-0x00000000023A0000-memory.dmpFilesize
1.2MB
-
memory/4364-216-0x0000000000000000-mapping.dmp
-
memory/4364-343-0x00000000023A0000-0x00000000024D2000-memory.dmpFilesize
1.2MB
-
memory/4364-344-0x0000000000400000-0x0000000000571000-memory.dmpFilesize
1.4MB
-
memory/4364-428-0x0000000002260000-0x00000000023A0000-memory.dmpFilesize
1.2MB
-
memory/4660-386-0x00007FF690DE5FD0-mapping.dmp
-
memory/4660-396-0x00000000000F0000-0x0000000000309000-memory.dmpFilesize
2.1MB
-
memory/4660-397-0x0000014C64380000-0x0000014C645AB000-memory.dmpFilesize
2.2MB