smokeloader | 234311a98ef272ea9a66272eaadaeb49f118eee9b7ebc518aa481bb079032531

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2023, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 366KB
Sample230104-r9ahrsbh21
SHA256 234311a98ef272ea9a66272eaadaeb49f118eee9b7ebc518aa481bb079032531
MD5 5db190f86f98212779499f6fb6a14324
SHA1 d0d556ec67dd76e2723ed7c9db8230eb9041d150
SHA512 9f1b256846cff38186f868bf2cc7ad1ce388229e5ff06c6b42f48d4df84864654ddede27bb2bd4c2ea49bcb841231e461c8c5c62f5f184b6b8d998185513320a
SSDEEP 6144:7pLM8AABaKGj1pGPwMDVfT9oxupmLUjlogf3xjT:7pBAsYbGPn9oxupmLUZn3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor collection discovery spyware stealer trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/4848-133-0x0000000002DE0000-0x0000000002DE9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 3 IoCs

flow	pid	Process
45	4944	rundll32.exe
48	4944	rundll32.exe
71	4944	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1664	1993.exe
1012	56BC.exe

Loads dropped DLL 1 IoCs

pid	Process
4944	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 4828	4944	rundll32.exe	95

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\selection-actions2x.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_base_non_fips.dll	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\server_issue.gif	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\ccme_base_non_fips.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-focus.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\DarkTheme.acrotheme	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\ADelRCP.exe	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\export.svg	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\turnOnNotificationInAcrobat.gif	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\ExtendScript.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions2x.png	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\DarkTheme.acrotheme	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\delete.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\export.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\email_all.gif	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\close_x.png	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\aic_file_icons_retina_thumb_new.png	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\StandardBusiness.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInAcrobat.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\chrome_elf.dll	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\delete.svg	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\CollectSignatures.aapp	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\duplicate.svg	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\tesselate.x3d	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\cryptocme.sig	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.sig	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\back-arrow-focus.svg	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\chrome_elf.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb_new.png	rundll32.exe
File created	C:\Program Files (x86)\Windows Mail\pmd.cer	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1256	1664	WerFault.exe	90

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 30 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000002456bb76100054656d7000003a0009000400efbe21550a582456bd762e000000000000000000000000000000000000000000000000003f1d9500540065006d007000000014000000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3004	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4848	file.exe
4848	file.exe
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4848	file.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeDebugPrivilege	4944	rundll32.exe
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4828	rundll32.exe
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
4944	rundll32.exe
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3004	Process not Found
3004	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1664	3004	Process not Found	90
PID 3004 wrote to memory of 1664	3004	Process not Found	90
PID 3004 wrote to memory of 1664	3004	Process not Found	90
PID 1664 wrote to memory of 4944	1664	1993.exe	91
PID 1664 wrote to memory of 4944	1664	1993.exe	91
PID 1664 wrote to memory of 4944	1664	1993.exe	91
PID 3004 wrote to memory of 1012	3004	Process not Found	94
PID 3004 wrote to memory of 1012	3004	Process not Found	94
PID 3004 wrote to memory of 1012	3004	Process not Found	94
PID 4944 wrote to memory of 4828	4944	rundll32.exe	95
PID 4944 wrote to memory of 4828	4944	rundll32.exe	95
PID 4944 wrote to memory of 4828	4944	rundll32.exe	95
PID 4944 wrote to memory of 4328	4944	rundll32.exe	97
PID 4944 wrote to memory of 4328	4944	rundll32.exe	97
PID 4944 wrote to memory of 4328	4944	rundll32.exe	97
PID 4944 wrote to memory of 2796	4944	rundll32.exe	99
PID 4944 wrote to memory of 2796	4944	rundll32.exe	99
PID 4944 wrote to memory of 2796	4944	rundll32.exe	99

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4848

C:\Users\Admin\AppData\Local\Temp\1993.exe
C:\Users\Admin\AppData\Local\Temp\1993.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Oatedoqeryee.tmp",Yqiowyrat
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4944
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 30943
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:2796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 532
  2⤵
  - Program crash
  PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1664 -ip 1664
1⤵
PID:3680

C:\Users\Admin\AppData\Local\Temp\56BC.exe
C:\Users\Admin\AppData\Local\Temp\56BC.exe
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1993.exe

Path C:\Users\Admin\AppData\Local\Temp\1993.exe
Size 1.1MB
SHA256 1adaaaa48de14166c7ddee1d6d793d6b86f26c2215b77d0cc5e5711129913d4f
MD5 451528a809d7ea66b3a5d0d6cd0643ce
SHA1 d3adc9d29bcf3c7c8e3f7abb582172c6805b4d22
SHA512 acee0e984ff1ca7b76abeda8e756603e2543d7eedebdf212233a7bc8eddfed4b53f9b1d6466b579081d9285daeaf8ab6b54a016fdd14f91d5df00da697593e5a
SSDEEP 24576:ps3yrZKEfqSDp2UQj9YWGJOA0B8qXJBTFxKhJoUYL:plKEdQEX075B6Jop
MD5 SHA1 SHA512 SSDEEP

Submit Download

1993.exe

Path C:\Users\Admin\AppData\Local\Temp\1993.exe
Size 1.1MB
SHA256 1adaaaa48de14166c7ddee1d6d793d6b86f26c2215b77d0cc5e5711129913d4f
MD5 451528a809d7ea66b3a5d0d6cd0643ce
SHA1 d3adc9d29bcf3c7c8e3f7abb582172c6805b4d22
SHA512 acee0e984ff1ca7b76abeda8e756603e2543d7eedebdf212233a7bc8eddfed4b53f9b1d6466b579081d9285daeaf8ab6b54a016fdd14f91d5df00da697593e5a
SSDEEP 24576:ps3yrZKEfqSDp2UQj9YWGJOA0B8qXJBTFxKhJoUYL:plKEdQEX075B6Jop
MD5 SHA1 SHA512 SSDEEP

Submit Download

56BC.exe

Path C:\Users\Admin\AppData\Local\Temp\56BC.exe
Size 382KB
SHA256 982c702ecac5a029dedfe7d564913db598caf3e090d492b71478f48299088980
MD5 399a2bfd384720ec3723d54a18df023c
SHA1 d6b377174e3de30bfeb31a0722889fd57479232a
SHA512 fde1d36e410bb18f7e9af9a6850c8f33b8995203e623d486d003b86e38c0c4ca6b87736d507ed0d13a9331e12164a11987ade3a380722a1c984a99720c885eb2
SSDEEP 6144:blLgtUo/6BFCEX4joTN3jqoxupmL1iXWwejT:blMU3FCz+NGoxupmLRw
MD5 SHA1 SHA512 SSDEEP

Submit Download

56BC.exe

Path C:\Users\Admin\AppData\Local\Temp\56BC.exe
Size 382KB
SHA256 982c702ecac5a029dedfe7d564913db598caf3e090d492b71478f48299088980
MD5 399a2bfd384720ec3723d54a18df023c
SHA1 d6b377174e3de30bfeb31a0722889fd57479232a
SHA512 fde1d36e410bb18f7e9af9a6850c8f33b8995203e623d486d003b86e38c0c4ca6b87736d507ed0d13a9331e12164a11987ade3a380722a1c984a99720c885eb2
SSDEEP 6144:blLgtUo/6BFCEX4joTN3jqoxupmL1iXWwejT:blMU3FCz+NGoxupmLRw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oatedoqeryee.tmp

Path C:\Users\Admin\AppData\Local\Temp\Oatedoqeryee.tmp
Size 718KB
SHA256 200911b8faaea3104d1b51231d534e615fe755dc84024c1029aeafe1f842206b
MD5 86df455f98f9b6b06535d64a9cfd7006
SHA1 6d79d6464ce3eeb70de564652f9b99b09c5d3a22
SHA512 249dac192d6c8023d4673a52d36cc4beecb899ab394f26e6812b3304075f427baba8b4b6a0cf4f6d4f50710eea8a0338d268b82a97a32632e18597c8eae1c426
SSDEEP 12288:ARjS5HTPT0AZdFhKsOYq729ykv8n4hgu9+0s9K1rn+lrtQx1H:ARjS5zlFhP5Mkv8n4a9mL+Bq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oatedoqeryee.tmp

Path C:\Users\Admin\AppData\Local\Temp\Oatedoqeryee.tmp
Size 718KB
SHA256 200911b8faaea3104d1b51231d534e615fe755dc84024c1029aeafe1f842206b
MD5 86df455f98f9b6b06535d64a9cfd7006
SHA1 6d79d6464ce3eeb70de564652f9b99b09c5d3a22
SHA512 249dac192d6c8023d4673a52d36cc4beecb899ab394f26e6812b3304075f427baba8b4b6a0cf4f6d4f50710eea8a0338d268b82a97a32632e18597c8eae1c426
SSDEEP 12288:ARjS5HTPT0AZdFhKsOYq729ykv8n4hgu9+0s9K1rn+lrtQx1H:ARjS5zlFhP5Mkv8n4a9mL+Bq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1012-197-0x0000000000400000-0x0000000002C52000-memory.dmp

Download

memory/1012-195-0x0000000002D2D000-0x0000000002D47000-memory.dmp

Download

memory/1012-196-0x0000000004780000-0x00000000047A9000-memory.dmp

Download

memory/1012-198-0x0000000002D2D000-0x0000000002D47000-memory.dmp

Download

memory/1012-199-0x0000000000400000-0x0000000002C52000-memory.dmp

Download

memory/1664-191-0x0000000000400000-0x0000000002D07000-memory.dmp

Download

memory/1664-185-0x0000000000400000-0x0000000002D07000-memory.dmp

Download

memory/1664-184-0x0000000004B20000-0x0000000004C2C000-memory.dmp

Download

memory/1664-183-0x0000000004A50000-0x0000000004B1E000-memory.dmp

Download

memory/3004-172-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-181-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-155-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-153-0x00000000026F0000-0x0000000002700000-memory.dmp

Download

memory/3004-152-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-156-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-160-0x00000000026F0000-0x0000000002700000-memory.dmp

Download

memory/3004-161-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-162-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-163-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-136-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-137-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-138-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-139-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-140-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-151-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-150-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-167-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-168-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-169-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-170-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-171-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-149-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-173-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-174-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-176-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-175-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-177-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-178-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-179-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-180-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-154-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-182-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-148-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-147-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-146-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-186-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-187-0x0000000002930000-0x0000000002940000-memory.dmp

Download

memory/3004-145-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-144-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-143-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-142-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-141-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/4828-208-0x0000018A2F4D0000-0x0000018A2F77E000-memory.dmp

Download

memory/4828-207-0x00000000001F0000-0x000000000048D000-memory.dmp

Download

memory/4828-206-0x0000018A30F20000-0x0000018A31060000-memory.dmp

Download

memory/4828-205-0x0000018A30F20000-0x0000018A31060000-memory.dmp

Download

memory/4848-135-0x0000000000400000-0x0000000002C4D000-memory.dmp

Download

memory/4848-133-0x0000000002DE0000-0x0000000002DE9000-memory.dmp

Download

memory/4848-134-0x0000000000400000-0x0000000002C4D000-memory.dmp

Download

memory/4848-132-0x0000000002EBD000-0x0000000002ED2000-memory.dmp

Download

memory/4944-200-0x0000000005BB0000-0x0000000005CF0000-memory.dmp

Download

memory/4944-201-0x0000000005BB0000-0x0000000005CF0000-memory.dmp

Download

memory/4944-202-0x0000000005BB0000-0x0000000005CF0000-memory.dmp

Download

memory/4944-203-0x0000000005BB0000-0x0000000005CF0000-memory.dmp

Download

memory/4944-193-0x0000000005BB0000-0x0000000005CF0000-memory.dmp

Download

memory/4944-192-0x0000000004FA0000-0x0000000005AC0000-memory.dmp

Download

memory/4944-194-0x0000000005BB0000-0x0000000005CF0000-memory.dmp

Download

memory/4944-210-0x0000000004FA0000-0x0000000005AC0000-memory.dmp

Download