danabot | fdaa4f46ebd14a3ed7656f8b22ff2cd2bdfe32f26c35c9ae5d78f5275f06bc6d

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17/12/2022, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

214KB
MD5

3d4cd52e8e5441316bfc75506538db5f
SHA1

71621526e085564e39870ff859bf36cca966d6bc
SHA256

fdaa4f46ebd14a3ed7656f8b22ff2cd2bdfe32f26c35c9ae5d78f5275f06bc6d
SHA512

22baff1e9893b6260238e4e0599ab62e8874e1dd0a6af5b23375955f2558759bece435424c9edeae84f7b9373a167aa9916f8cda481ca9e855d26a8a98957f25
SSDEEP

3072:ALMBjmLc5PqBaTRDrZ+ZFh3u0xOEVV0eggLszei+Ya40zwUzQRKF+:cMoLc5PdMZFXEEQegggzxW40M2b

Score

10^/10

danabot smokeloader backdoor banker trojan

Malware Config

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/1568-133-0x00000000001F0000-0x00000000001F9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3948	CE32.exe
1860	Eewfhetyyyrtfpd.exe
3756	EBAE.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	CE32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1044	Process not Found
884	chrome.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 3736	3948	CE32.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3880	3736	WerFault.exe	89
2880	3756	WerFault.exe	92
1348	884	WerFault.exe	90
2248	3948	WerFault.exe	86

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	CE32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	CE32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	CE32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CE32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CE32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	CE32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	CE32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	CE32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1568	file.exe
1568	file.exe
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found
1044	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1044	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1568	file.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	Eewfhetyyyrtfpd.exe
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeDebugPrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found
Token: SeShutdownPrivilege	1044	Process not Found
Token: SeCreatePagefilePrivilege	1044	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1860	Eewfhetyyyrtfpd.exe
884	chrome.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1860	Eewfhetyyyrtfpd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
884	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3948	1044	Process not Found	86
PID 1044 wrote to memory of 3948	1044	Process not Found	86
PID 1044 wrote to memory of 3948	1044	Process not Found	86
PID 3948 wrote to memory of 1860	3948	CE32.exe	88
PID 3948 wrote to memory of 1860	3948	CE32.exe	88
PID 3948 wrote to memory of 1860	3948	CE32.exe	88
PID 3948 wrote to memory of 3736	3948	CE32.exe	89
PID 3948 wrote to memory of 3736	3948	CE32.exe	89
PID 3948 wrote to memory of 3736	3948	CE32.exe	89
PID 3948 wrote to memory of 3736	3948	CE32.exe	89
PID 1044 wrote to memory of 884	1044	Process not Found	90
PID 1044 wrote to memory of 884	1044	Process not Found	90
PID 884 wrote to memory of 1156	884	chrome.exe	91
PID 884 wrote to memory of 1156	884	chrome.exe	91
PID 1044 wrote to memory of 3756	1044	Process not Found	92
PID 1044 wrote to memory of 3756	1044	Process not Found	92
PID 1044 wrote to memory of 3756	1044	Process not Found	92
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 4528	884	chrome.exe	99
PID 884 wrote to memory of 3504	884	chrome.exe	100
PID 884 wrote to memory of 3504	884	chrome.exe	100
PID 884 wrote to memory of 688	884	chrome.exe	101
PID 884 wrote to memory of 688	884	chrome.exe	101
PID 884 wrote to memory of 688	884	chrome.exe	101
PID 884 wrote to memory of 688	884	chrome.exe	101
PID 884 wrote to memory of 688	884	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1568

C:\Users\Admin\AppData\Local\Temp\CE32.exe
C:\Users\Admin\AppData\Local\Temp\CE32.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\Eewfhetyyyrtfpd.exe
  "C:\Users\Admin\AppData\Local\Temp\Eewfhetyyyrtfpd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1860
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Checks processor information in registry
  PID:3736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 1296
    3⤵
    - Program crash
    PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 1164
  2⤵
  - Program crash
  PID:2248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0f364f50,0x7ffd0f364f60,0x7ffd0f364f70
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,5758957730612275364,12528078793716422612,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1608 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,5758957730612275364,12528078793716422612,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,5758957730612275364,12528078793716422612,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,5758957730612275364,12528078793716422612,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:1868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 884 -s 3608
  2⤵
  - Program crash
  PID:1348

C:\Users\Admin\AppData\Local\Temp\EBAE.exe
C:\Users\Admin\AppData\Local\Temp\EBAE.exe
1⤵
- Executes dropped EXE
PID:3756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 272
  2⤵
  - Program crash
  PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3756 -ip 3756
1⤵
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3736 -ip 3736
1⤵
PID:4004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 884 -ip 884
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3948 -ip 3948
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CE32.exe

Filesize
5.6MB

MD5
7bca245090dace95e87bb3d9b230c4d7

SHA1
83e13902c00fd1a621dcd96a36c8862ff0b61606

SHA256
ba21117d135d43225c06751e0b8ac91522b765442984d097cedcd7386ab81dac

SHA512
f306d838e4380c516aed968aaea87524d4ccf6bad9a17d85a3f8f8fa6d90042b8b2d8e67d3aff4bda63ee5759a6369a7d5aca3aaa97e0d5c5f8149c79ecb2abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CE32.exe

Filesize
5.6MB

MD5
7bca245090dace95e87bb3d9b230c4d7

SHA1
83e13902c00fd1a621dcd96a36c8862ff0b61606

SHA256
ba21117d135d43225c06751e0b8ac91522b765442984d097cedcd7386ab81dac

SHA512
f306d838e4380c516aed968aaea87524d4ccf6bad9a17d85a3f8f8fa6d90042b8b2d8e67d3aff4bda63ee5759a6369a7d5aca3aaa97e0d5c5f8149c79ecb2abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBAE.exe

Filesize
1.4MB

MD5
1ea8aaf997bbebac62ec8031d9304100

SHA1
e8b7a1aeae449fc28310c8244bc6940d94adabb6

SHA256
bf52f8def7e804055268e9f17bd8fc91edea479e7d719f9335035bfc71ef21bd

SHA512
04217d1f733e56ce32aa96758941ebd6171242f7ff3f7ed8694247aae61a9b6d1b2fa1d0477612acda5a60a32f47af690dce7fdc4c388d337ddf5fce12335b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBAE.exe

Filesize
1.4MB

MD5
1ea8aaf997bbebac62ec8031d9304100

SHA1
e8b7a1aeae449fc28310c8244bc6940d94adabb6

SHA256
bf52f8def7e804055268e9f17bd8fc91edea479e7d719f9335035bfc71ef21bd

SHA512
04217d1f733e56ce32aa96758941ebd6171242f7ff3f7ed8694247aae61a9b6d1b2fa1d0477612acda5a60a32f47af690dce7fdc4c388d337ddf5fce12335b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Eewfhetyyyrtfpd.exe

Filesize
2.4MB

MD5
e7053575255acd45d4213d866123dbaf

SHA1
95fa5a2178eb1dd6a445685b3ab2905c11045d0c

SHA256
794be0b98421623959185a060092be697fa695a73268ab8a46c7ab12655df62b

SHA512
e934ae1bb4cef1e71cf1905655bcb5979f8f70944817de88204d8bebf3a36300b7b282d0bd711cc41ae5e69f91b6e14576b7a8098ee283d29bdb451d98238401

Download Submit
C:\Users\Admin\AppData\Local\Temp\Eewfhetyyyrtfpd.exe

Filesize
2.4MB

MD5
e7053575255acd45d4213d866123dbaf

SHA1
95fa5a2178eb1dd6a445685b3ab2905c11045d0c

SHA256
794be0b98421623959185a060092be697fa695a73268ab8a46c7ab12655df62b

SHA512
e934ae1bb4cef1e71cf1905655bcb5979f8f70944817de88204d8bebf3a36300b7b282d0bd711cc41ae5e69f91b6e14576b7a8098ee283d29bdb451d98238401

Download Submit
memory/1044-202-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-204-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-226-0x0000000000730000-0x0000000000740000-memory.dmp

Filesize
64KB

Download
memory/1044-225-0x00000000006E0000-0x00000000006F0000-memory.dmp

Filesize
64KB

Download
memory/1044-224-0x0000000000730000-0x0000000000740000-memory.dmp

Filesize
64KB

Download
memory/1044-223-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-145-0x0000000007F90000-0x00000000081F9000-memory.dmp

Filesize
2.4MB

Download
memory/1044-222-0x0000000000730000-0x0000000000740000-memory.dmp

Filesize
64KB

Download
memory/1044-221-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-215-0x0000000000730000-0x0000000000740000-memory.dmp

Filesize
64KB

Download
memory/1044-220-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-219-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-218-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-217-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-216-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-214-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-213-0x0000000000730000-0x0000000000740000-memory.dmp

Filesize
64KB

Download
memory/1044-212-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-157-0x0000000007F90000-0x00000000081F9000-memory.dmp

Filesize
2.4MB

Download
memory/1044-211-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-182-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-210-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-163-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-209-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-208-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-174-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-167-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-168-0x0000000000720000-0x0000000000730000-memory.dmp

Filesize
64KB

Download
memory/1044-169-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-207-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-173-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-172-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-206-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-205-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-177-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-178-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-180-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-183-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-185-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-184-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-159-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-203-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-201-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-186-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-187-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/1044-188-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-189-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-190-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-200-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-198-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/1044-193-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1044-197-0x0000000000750000-0x0000000000760000-memory.dmp

Filesize
64KB

Download
memory/1044-196-0x0000000007F90000-0x00000000081F9000-memory.dmp

Filesize
2.4MB

Download
memory/1568-135-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1568-132-0x00000000004F3000-0x0000000000504000-memory.dmp

Filesize
68KB

Download
memory/1568-134-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1568-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

Filesize
36KB

Download
memory/3736-176-0x0000000002DC0000-0x0000000002F00000-memory.dmp

Filesize
1.2MB

Download
memory/3736-164-0x0000000000440000-0x0000000000A45000-memory.dmp

Filesize
6.0MB

Download
memory/3736-158-0x00000000025C0000-0x0000000002CE5000-memory.dmp

Filesize
7.1MB

Download
memory/3736-166-0x00000000025C0000-0x0000000002CE5000-memory.dmp

Filesize
7.1MB

Download
memory/3736-170-0x0000000002DC0000-0x0000000002F00000-memory.dmp

Filesize
1.2MB

Download
memory/3736-171-0x0000000002DC0000-0x0000000002F00000-memory.dmp

Filesize
1.2MB

Download
memory/3736-192-0x00000000025C0000-0x0000000002CE5000-memory.dmp

Filesize
7.1MB

Download
memory/3948-156-0x0000000006C70000-0x0000000007395000-memory.dmp

Filesize
7.1MB

Download
memory/3948-150-0x00000000075F0000-0x0000000007730000-memory.dmp

Filesize
1.2MB

Download
memory/3948-140-0x0000000002D30000-0x00000000032ED000-memory.dmp

Filesize
5.7MB

Download
memory/3948-199-0x0000000000400000-0x00000000009BE000-memory.dmp

Filesize
5.7MB

Download
memory/3948-154-0x00000000075F0000-0x0000000007730000-memory.dmp

Filesize
1.2MB

Download
memory/3948-153-0x00000000075F0000-0x0000000007730000-memory.dmp

Filesize
1.2MB

Download
memory/3948-149-0x00000000075F0000-0x0000000007730000-memory.dmp

Filesize
1.2MB

Download
memory/3948-152-0x00000000075F0000-0x0000000007730000-memory.dmp

Filesize
1.2MB

Download
memory/3948-151-0x00000000075F0000-0x0000000007730000-memory.dmp

Filesize
1.2MB

Download
memory/3948-195-0x0000000006C70000-0x0000000007395000-memory.dmp

Filesize
7.1MB

Download
memory/3948-148-0x00000000075F0000-0x0000000007730000-memory.dmp

Filesize
1.2MB

Download
memory/3948-147-0x00000000075F0000-0x0000000007730000-memory.dmp

Filesize
1.2MB

Download
memory/3948-146-0x0000000006C70000-0x0000000007395000-memory.dmp

Filesize
7.1MB

Download
memory/3948-139-0x0000000000F1F000-0x000000000148D000-memory.dmp

Filesize
5.4MB

Download
memory/3948-194-0x0000000000400000-0x00000000009BE000-memory.dmp

Filesize
5.7MB

Download
memory/3948-141-0x0000000000400000-0x00000000009BE000-memory.dmp

Filesize
5.7MB

Download