smokeloader | a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6

General

Target

a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
Size

284KB
MD5

d21e88369dc69042d256dc59263d5b61
SHA1

575e789b0b3bc16a4f44fe6151af4d41cfd630b5
SHA256

a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6
SHA512

ea5d31d708a0aa4b700788767819a1f5be02b4c61119725f6dd7ecda72f19809b360ae39692f6933e5d3404180bee94bd1337d8894baf7654ece89c199db5a8b
SSDEEP

3072:Ui/i1bLhJ1h8iimVIPI2CbC0k6PJRwlNBsTUqVnPEx/eDU6gNZCIpITIQWyQCk16:9sLwqtTbE6BRwlN6UMPG2Y60nDjCcQT

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exea6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exea6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe

Modifies registry class 60 IoCs

Processes:

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000005456d096122041707044617461003c0008000400efbe5456d0965456d0962a000000e90100000000020000000000000000000000000000004100700070004400610074006100000016000000
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Mode = "6"
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1092616209"
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:PID = "0"
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupView = "0"
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a003100000000006d56e45e102054656d700000360008000400efbe5456d0966d56e45e2a000000fd010000000002000000000000000000000000000000540065006d007000000014000000
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Rev = "0"
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000005456d0961100557365727300600008000400efbeee3a851a5456d0962a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\LogicalViewMode = "2"
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f4225481e03947bc34db131e946b44c8dd50000
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByDirection = "1"
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000f00000000000000000000000
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1092616193"
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\IconSize = "48"
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c0031000000000054562b9910204c6f63616c00380008000400efbe5456d09654562b992a000000fc0100000000020000000000000000000000000000004c006f00630061006c00000014000000
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c0031000000000054563c9c100041646d696e00380008000400efbe5456d09654563c9c2a0000002e000000000004000000000000000000000000000000410064006d0069006e00000014000000
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exea6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe

pid	process
2012	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
2012	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
604	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
604	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1244

pid	process
1244

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exea6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exea6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe

pid	process
2012	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
604	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
1988	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	632	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	632	AUDIODG.EXE
Token: 33	632	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	632	AUDIODG.EXE
Token: SeShutdownPrivilege	1244
Token: SeShutdownPrivilege	1244
Token: SeShutdownPrivilege	1244
Token: SeShutdownPrivilege	1244
Token: SeShutdownPrivilege	1244
Token: SeSecurityPrivilege	1244
Token: SeTakeOwnershipPrivilege	1244
Token: SeShutdownPrivilege	1244
Token: SeShutdownPrivilege	1244
Token: SeShutdownPrivilege	1244

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

pid process

1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244

pid	process
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244
1244

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

description	pid	target process
PID 1244 wrote to memory of 604	1244	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
PID 1244 wrote to memory of 604	1244	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
PID 1244 wrote to memory of 604	1244	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
PID 1244 wrote to memory of 604	1244	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
PID 1244 wrote to memory of 1988	1244	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
PID 1244 wrote to memory of 1988	1244	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
PID 1244 wrote to memory of 1988	1244	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
PID 1244 wrote to memory of 1988	1244	a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe

C:\Users\Admin\AppData\Local\Temp\a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
"C:\Users\Admin\AppData\Local\Temp\a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2012

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1980

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x568
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Users\Admin\AppData\Local\Temp\a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
"C:\Users\Admin\AppData\Local\Temp\a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:604

C:\Users\Admin\AppData\Local\Temp\a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe
"C:\Users\Admin\AppData\Local\Temp\a6b58dd392fd903d5e247fa25c752b40cbb648db89186a14db2f074c132854a6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-62-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/1244-56-0x0000000004840000-0x0000000004856000-memory.dmp

Filesize
88KB

Download
memory/1244-61-0x0000000004930000-0x0000000004946000-memory.dmp

Filesize
88KB

Download
memory/1244-68-0x0000000003C70000-0x0000000003C86000-memory.dmp

Filesize
88KB

Download
memory/1988-69-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2012-55-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2012-57-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads