danabot | 393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2022 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe
Size

305KB
MD5

6bfc17a28aa01afc3c7cb24f0154220a
SHA1

c69bafa22ca6ec3b8f68bc30fa41e9c07e0b7ed4
SHA256

393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962
SHA512

000dad200e390812e7ed44811701ad31bd4ef831278807f8576e9f5a136d0eeacd591889204158f8502d4faccf96ffa5eff3c511358cfc625f34a93fe21c7cbf
SSDEEP

6144:ILefDAuyxoFK7wFCiEAJdNBOyBU63QZImQKG0:IqDAJx2GXAhMsQZW

Score

10^/10

danabot smokeloader backdoor banker discovery trojan

Malware Config

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2500-133-0x0000000000510000-0x0000000000519000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

44 3924 rundll32.exe
53 3924 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

F429.exe

pid process

4996 F429.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3924 rundll32.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3924 set thread context of 5040 3924 rundll32.exe rundll32.exe

flow	pid	process
44	3924	rundll32.exe
53	3924	rundll32.exe

pid	process
4996	F429.exe

pid	process
3924	rundll32.exe

description	pid	process	target process
PID 3924 set thread context of 5040	3924	rundll32.exe	rundll32.exe

Drops file in Program Files directory 32 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\nppdf32.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\fillandsign.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\AiodLite.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-hover.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\core_icons.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\AdobeLinguistic.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\back-arrow-down.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\editpdf.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\LightTheme.acrotheme	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\aic_file_icons_retina_thumb_highContrast_wob.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\LightTheme.acrotheme	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\trash.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\back-arrow-hover.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\server_issue.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\A12_Spinner_int.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeLinguistic.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Comments.aapp	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\fillandsign.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\dd_arrow_small.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Comments.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\dd_arrow_small.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-down.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\nppdf32.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\logsession.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\logsession.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3460 4996 WerFault.exe F429.exe

pid	pid_target	process	target process
3460	4996	WerFault.exe	F429.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Toolbar

Modifies registry class 30 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e00310000000000935540aa100054656d7000003a0009000400efbe6b558a6c935545aa2e0000000000000000000000000000000000000000000000000062de5100540065006d007000000014000000
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

2480

pid	process
2480

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe

pid	process
2500	393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe
2500	393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480
2480

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2480
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe

pid process

2500 393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe

pid	process
2480

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	2480
Token: SeCreatePagefilePrivilege	2480
Token: SeShutdownPrivilege	2480
Token: SeCreatePagefilePrivilege	2480
Token: SeShutdownPrivilege	2480
Token: SeCreatePagefilePrivilege	2480
Token: SeShutdownPrivilege	2480
Token: SeCreatePagefilePrivilege	2480
Token: SeShutdownPrivilege	2480
Token: SeCreatePagefilePrivilege	2480
Token: SeShutdownPrivilege	2480
Token: SeCreatePagefilePrivilege	2480
Token: SeShutdownPrivilege	2480
Token: SeCreatePagefilePrivilege	2480
Token: SeShutdownPrivilege	2480
Token: SeCreatePagefilePrivilege	2480
Token: SeShutdownPrivilege	2480
Token: SeCreatePagefilePrivilege	2480

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

5040 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

2480
2480

pid	process
5040	rundll32.exe

pid	process
2480
2480

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

F429.exerundll32.exe

description	pid	process	target process
PID 2480 wrote to memory of 4996	2480		F429.exe
PID 2480 wrote to memory of 4996	2480		F429.exe
PID 2480 wrote to memory of 4996	2480		F429.exe
PID 4996 wrote to memory of 3924	4996	F429.exe	rundll32.exe
PID 4996 wrote to memory of 3924	4996	F429.exe	rundll32.exe
PID 4996 wrote to memory of 3924	4996	F429.exe	rundll32.exe
PID 3924 wrote to memory of 5040	3924	rundll32.exe	rundll32.exe
PID 3924 wrote to memory of 5040	3924	rundll32.exe	rundll32.exe
PID 3924 wrote to memory of 5040	3924	rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe
"C:\Users\Admin\AppData\Local\Temp\393b1c22fbd0d7b17d059365da39cc641f33bc0fb23c2ae1b296938945ed9962.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2500

C:\Users\Admin\AppData\Local\Temp\F429.exe
C:\Users\Admin\AppData\Local\Temp\F429.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3924

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14124
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 528
2⤵
- Program crash
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4996 -ip 4996
1⤵
PID:3936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1008

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
PID:2816

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\aiodlite.dll",XUoTa2Rwdg==
2⤵
PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsPowerShell\Modules\AiodLite.dll

Filesize
797KB

MD5
714d90e07f65afebfe29f88489e5f920

SHA1
4e10c4540095ddb44fa2d82854593888a397fe28

SHA256
215d4f2c7b7b2d1c3c67379a1a8366a0e00bdef7a69fd65716ac322f100b7edd

SHA512
5646058f8ef57e988ccaedf1210e7068b7d0743a07f7f76ba0adf2eb62e32cff2fe4a7a0d0ac94cd5b9653f6c29d2a6435278c4d2b9a4d70025877b6fd64f902

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\AiodLite.dll

Filesize
797KB

MD5
714d90e07f65afebfe29f88489e5f920

SHA1
4e10c4540095ddb44fa2d82854593888a397fe28

SHA256
215d4f2c7b7b2d1c3c67379a1a8366a0e00bdef7a69fd65716ac322f100b7edd

SHA512
5646058f8ef57e988ccaedf1210e7068b7d0743a07f7f76ba0adf2eb62e32cff2fe4a7a0d0ac94cd5b9653f6c29d2a6435278c4d2b9a4d70025877b6fd64f902

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\EaseOfAccessSettings2013.xml

Filesize
5KB

MD5
7ac38dcc72989ac01bd1a67d484af471

SHA1
458224b5c1c1696d8255a355a6100a4652fd7bd7

SHA256
923335d4d6399bd1bc2d44d264183cba0e2a2c3ecb1d18472003e787275d7e46

SHA512
ae5f247648411df8657a2806e5a9ff8e48bf79cf19d2b4101ef67fa78d7b55e37248190ed1d60f58255fe5ceff38017764b0a0d73108150dd4666dde75c0ce14

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

Filesize
2.3MB

MD5
e2fdd10c74b6614fe78b9ab1bd256caa

SHA1
9360e2f008a77061b15d7da723f7c05b1e1ad7b9

SHA256
63bcccf9cd648888dbb448595b821ad4bac6f889291dc3817561913c4d271e09

SHA512
60d9ba77aa34613281674a592a201d5d08134b2d6d4d1bea1d020f3c08eddff66250a63512a09459fe32df23a7b6332cfad9a42c99fe5f2f717db704c817b143

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

Filesize
2.3MB

MD5
e2fdd10c74b6614fe78b9ab1bd256caa

SHA1
9360e2f008a77061b15d7da723f7c05b1e1ad7b9

SHA256
63bcccf9cd648888dbb448595b821ad4bac6f889291dc3817561913c4d271e09

SHA512
60d9ba77aa34613281674a592a201d5d08134b2d6d4d1bea1d020f3c08eddff66250a63512a09459fe32df23a7b6332cfad9a42c99fe5f2f717db704c817b143

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.AsyncTextService_10.0.19041.1023_neutral__8wekyb3d8bbwe.xml

Filesize
2KB

MD5
2240070d6603ab019cd125005cf38b7b

SHA1
ca96d028f51a7d5ec16630b48935f26c72794b0a

SHA256
7b3b1b641ebbda5397a11af86cb347b0f644ab439341c62b1c81d6990e6f75bc

SHA512
95c6f48f717d9103d30c31e00b7ff3a0d235693a8fffed772c0a0c39107bf3003ac84d6c78e2af566d91a88fa523dcc2c523dcc707d19fc77799832d548f330c

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.LockApp_10.0.19041.1023_neutral__cw5n1h2txyewy.xml

Filesize
2KB

MD5
2ff808c347a1bd28f3df3bc8873d73d6

SHA1
afc3b29446a1e5ea641db1c5f1521b2f5c814581

SHA256
6d6bb6749a28b69f42fede441d1c84dbff9c3f69938e637eee4fc260d0c92301

SHA512
33c2861f5b1f0b87be1f7a5d59313d5977d284ba70a126541f2daed6297ac35cf11c4f43107148f05da7e4748f49b3e99335d4c2164ba04e0a4f17830afd1706

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe.xml

Filesize
6KB

MD5
7e913c1a399dd176eea1bb8f2be26268

SHA1
6be9a44820ffbabb10202af890da00c9aa2dfec2

SHA256
5295393602a18f301613c7160e24f88816070a41cf69b32c821b6d3858541b4a

SHA512
dc52de8489f586081c246a297a35987eb7f74e122f475df88cfdc683787fe532e609db3b43915c73f7f172e1a4fc13efacd1b52252d1041e5c8f4dd190009105

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe.xml

Filesize
1KB

MD5
af5e2e83f730f2fd1c0a63c86437d00a

SHA1
0aee18034eae17e51f20858c05a9616b03c9b8c4

SHA256
6a8f415526a62ac93dc93850ce58b533e0ea93acf3e7fa72f917d123d664c210

SHA512
9a59e43913e131c976f772b442c02226abeb137b5a8f8bc3f57673fa6ea15e5bff0a3cc5af747f3730b6d0878f97ef0b18fde4e8afb5fd4674dc618335d17b20

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe.xml

Filesize
1KB

MD5
d8c0aaaa1d4b2386b683f9f0e0150986

SHA1
98aa9efe9aa9e7c9b1c27eb70e1a704a5fc1315d

SHA256
47740c23beeeeccfc9a10b8ffc82c745385403faef48c5f4b9fb7c092f9e6083

SHA512
41c3f40a8ee3f353634fba846938a7aec4bb5b8f6b98f3f108c22c1278b4df4d97b1cf43a096f896b4130249040f5d6931cf1275876ec1ec0fc6a1e1cb99d56c

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe.xml

Filesize
1KB

MD5
4e453fc9a4e419d0eefa057cd136484f

SHA1
dd9eb7313819ab30488efbb4b3c6e34214d37078

SHA256
d97e577008c9cf9baa9939be4babe4690e5f1e6ad1e97234b2f40ee22927d7fe

SHA512
72182582106d4488619ce6531c61003a7dad2eeca1c7b381f90db967d41ba8685d0eb719cae42256c774a20d3db2adca4fdd3b2bd621439feac2ef72554e1ae2

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c.xml

Filesize
35KB

MD5
d838647709cc692e5baa42ed5e612a15

SHA1
28403026cfc539e10cec2de39cc4273dfffa506e

SHA256
54e71797852c8b4dfe12af952c305db2d2416ded7e2cae5c1ea766070be981da

SHA512
1b3eac54dad342ba0bff5fdb66b569ae14cff892bae71dd3f9a5e0e1ff2f8f03656649c68a3f7ba9d106eec57ea56e0cb039747e435339ffe9a46dc96f58575c

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe.xml

Filesize
841B

MD5
2208598032bb288d2418ac683aa1c52e

SHA1
05ee06da9d4966b7b42f4d32acaa6a3c4c716b2b

SHA256
63c1ca505cf74b0f5c0fa35937730ee43a05cd9be03ee2489ab99d513bde741a

SHA512
9081c48088fe654ca64d94040d81473326a327714da7031da73f3bddf1ebfb17c1af1efa0ae3e4aeefe18b2425124bdfd86c5285271281bd10e88109f49edf3c

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\MicrosoftOffice2013Win64.xml

Filesize
66KB

MD5
c08e2d9084398ad29bb453183bb2155d

SHA1
285b0d897ff73444a74bf9e253d30f7cb1f4f2be

SHA256
9ddc306cee7a71d98fe59c39ce5fb74cc7e36c54a55cc46f2e8136c12e890418

SHA512
d032acce3071bb26d688aa4a816d09b6852c3ccb179f66a0001038b94f556a4b04401e02a4dc3b8eb7f4c4aa0fb74aa009a5db786972c56cb08d5dbeeaefad83

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft_Office_Office Feature Updates.xml

Filesize
6KB

MD5
b293170595e747ad85d1fb7f2ee06eea

SHA1
0d09a9c16ba3a694aab8fe232a35b719201c0955

SHA256
57dede2ef5f1d9538d211229bd5551c88c3c2df627782a7eb6ae98f8051f2535

SHA512
0fd0a57941c8e394598e88183c258ee70f54e3c80b32610cf626df18f55d95fd9149ea6e1d055c317236e8b3f0980cf70314392f94e77144ad3fd9519142f12b

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\edb.log

Filesize
64KB

MD5
950a765b75342020ecbff26deb862205

SHA1
33ac73e52fc7cc4f2f9b4606682371e23605c4a2

SHA256
d1b17e354889dc00d1ac3eb275b27d1fc8cadec10e5a2bc231cf01f07d703b6f

SHA512
369d758a487fb682563beda27e7ec964c8cda924a2f32dbec0c591dc7f637b19c7141d0f7579dc585db0fcc7fe80b601b64dc66d7c39e764f966dbde051c0765

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\user-40.png

Filesize
525B

MD5
3bde564b05fe619b8082900b5c83b536

SHA1
656b402ff5e478471b1053e50ed8e5bfcc011a11

SHA256
1fa751b71307c22ceb94e3af09688c0e123b26ae8c16e1c521510f309bca4308

SHA512
00303409ca69ee71e6e2702d8f06a8ee5418d01e2e0f726394042b0af4b6a5b35f66d5a70664f031feb7e28d13c124b5d08e4b3998b443a2cba3574c4996ca0b

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\user.bmp

Filesize
588KB

MD5
908fa2dfb385771ecf5f8b2b3e7bff16

SHA1
1255fa1edbd2dbbcab6d9eb9f74b7d6783697a58

SHA256
60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d

SHA512
573c9fde441fb8debaa44b6fa2d3763c3dc4714497089b82bedc8ef0720eea4a907f75cffb1c0ec4a77ac89cfecbef8e6182a2a8fea5b51a2e91920ceaad5f69

Download Submit
C:\Users\Admin\AppData\Local\Temp\F429.exe

Filesize
1.1MB

MD5
0632c99ab43231f1f8b7c7f6bc8e30d8

SHA1
ea284fc244536dd7f1ef4990879a554cd1375671

SHA256
b3a1633cf2b87e4084d7c61a92a36c8c5fca4c926a7eed0916653712618033b1

SHA512
56dc4e12f80d175901acf8be0d3fa9512ce581774caaa6593a49b1369219022ebfa098e1ba47930f7619174f7afa4b0155bcac4d83162841b40899458cd1c643

Download Submit
C:\Users\Admin\AppData\Local\Temp\F429.exe

Filesize
1.1MB

MD5
0632c99ab43231f1f8b7c7f6bc8e30d8

SHA1
ea284fc244536dd7f1ef4990879a554cd1375671

SHA256
b3a1633cf2b87e4084d7c61a92a36c8c5fca4c926a7eed0916653712618033b1

SHA512
56dc4e12f80d175901acf8be0d3fa9512ce581774caaa6593a49b1369219022ebfa098e1ba47930f7619174f7afa4b0155bcac4d83162841b40899458cd1c643

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

Filesize
797KB

MD5
24925b25552a7d8f1d3292071e545920

SHA1
f786e1d40df30f6fed0301d60c823b655f2d6eac

SHA256
9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

SHA512
242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

Filesize
797KB

MD5
24925b25552a7d8f1d3292071e545920

SHA1
f786e1d40df30f6fed0301d60c823b655f2d6eac

SHA256
9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

SHA512
242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

Download Submit
\??\c:\program files (x86)\windowspowershell\modules\aiodlite.dll

Filesize
797KB

MD5
714d90e07f65afebfe29f88489e5f920

SHA1
4e10c4540095ddb44fa2d82854593888a397fe28

SHA256
215d4f2c7b7b2d1c3c67379a1a8366a0e00bdef7a69fd65716ac322f100b7edd

SHA512
5646058f8ef57e988ccaedf1210e7068b7d0743a07f7f76ba0adf2eb62e32cff2fe4a7a0d0ac94cd5b9653f6c29d2a6435278c4d2b9a4d70025877b6fd64f902

Download Submit
memory/1908-182-0x00000000041B0000-0x00000000048D5000-memory.dmp

Filesize
7.1MB

Download
memory/1908-179-0x0000000000000000-mapping.dmp

Download
memory/1908-183-0x00000000041B0000-0x00000000048D5000-memory.dmp

Filesize
7.1MB

Download
memory/2500-135-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2500-132-0x0000000000538000-0x000000000054E000-memory.dmp

Filesize
88KB

Download
memory/2500-134-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2500-133-0x0000000000510000-0x0000000000519000-memory.dmp

Filesize
36KB

Download
memory/2816-181-0x00000000035B0000-0x0000000003CD5000-memory.dmp

Filesize
7.1MB

Download
memory/2816-163-0x00000000035B0000-0x0000000003CD5000-memory.dmp

Filesize
7.1MB

Download
memory/3924-146-0x0000000005B10000-0x0000000006235000-memory.dmp

Filesize
7.1MB

Download
memory/3924-147-0x0000000004860000-0x00000000049A0000-memory.dmp

Filesize
1.2MB

Download
memory/3924-139-0x0000000000000000-mapping.dmp

Download
memory/3924-145-0x0000000005B10000-0x0000000006235000-memory.dmp

Filesize
7.1MB

Download
memory/3924-159-0x0000000005B10000-0x0000000006235000-memory.dmp

Filesize
7.1MB

Download
memory/3924-148-0x0000000004860000-0x00000000049A0000-memory.dmp

Filesize
1.2MB

Download
memory/3924-154-0x00000000048D9000-0x00000000048DB000-memory.dmp

Filesize
8KB

Download
memory/3924-151-0x0000000004860000-0x00000000049A0000-memory.dmp

Filesize
1.2MB

Download
memory/3924-149-0x0000000004860000-0x00000000049A0000-memory.dmp

Filesize
1.2MB

Download
memory/3924-152-0x0000000004860000-0x00000000049A0000-memory.dmp

Filesize
1.2MB

Download
memory/3924-150-0x0000000004860000-0x00000000049A0000-memory.dmp

Filesize
1.2MB

Download
memory/4996-144-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/4996-143-0x0000000002380000-0x00000000024B0000-memory.dmp

Filesize
1.2MB

Download
memory/4996-142-0x000000000218A000-0x0000000002278000-memory.dmp

Filesize
952KB

Download
memory/4996-136-0x0000000000000000-mapping.dmp

Download
memory/5040-153-0x00007FF701756890-mapping.dmp

Download
memory/5040-155-0x0000027F344E0000-0x0000027F34620000-memory.dmp

Filesize
1.2MB

Download
memory/5040-156-0x0000027F344E0000-0x0000027F34620000-memory.dmp

Filesize
1.2MB

Download
memory/5040-157-0x0000000000800000-0x0000000000A19000-memory.dmp

Filesize
2.1MB

Download
memory/5040-158-0x0000027F32B10000-0x0000027F32D3A000-memory.dmp

Filesize
2.2MB

Download