Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c061f6c696cde2214e0425839ae84f84.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
General
-
Target
c061f6c696cde2214e0425839ae84f84.exe
-
Size
2.6MB
-
MD5
c061f6c696cde2214e0425839ae84f84
-
SHA1
907c23a4e0aed6b887e0f7c8b16e1b4f82d1f340
-
SHA256
d520edc59c5aee94806782d012efa7e0f905e90ce4e177f14cd612e7b8bb17ba
-
SHA512
c0dc8dc9e5569d0db1ac6c9ac084599111f16b60cf39c230c791327304c5452df6036dbc9f0564c05a283ba369cefb87daad3714029caa4a021b94e6d88eabd6
-
SSDEEP
49152:xcBxPkZVi7iKiF8cUvFyP2jckAjxt3htaPkvAesMMOZEwJ84vLRaBtIl9mT+Pep:xRri7ixZUvFyPScjVt4j/hCvLUBsKv
Malware Config
Extracted
Family
nullmixer
C2
http://razino.xyz/
Extracted
Family
smokeloader
Botnet
pub5
Extracted
Family
vidar
Version
39.7
Botnet
933
C2
https://shpak125.tumblr.com/
Attributes
-
profile_id
933
Extracted
Family
smokeloader
Version
2020
C2
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
rc4.i32
rc4.i32
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5012 1604 rUNdlL32.eXe 114 -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 3 IoCs
resource yara_rule behavioral2/memory/4144-93-0x0000000000DB0000-0x0000000000E4D000-memory.dmp family_vidar behavioral2/memory/4144-98-0x0000000000400000-0x00000000008F8000-memory.dmp family_vidar behavioral2/memory/4144-139-0x0000000000400000-0x00000000008F8000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x0006000000023254-28.dat aspack_v212_v242 behavioral2/files/0x0006000000023250-35.dat aspack_v212_v242 behavioral2/files/0x000600000002324f-36.dat aspack_v212_v242 behavioral2/files/0x0006000000023252-43.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation c061f6c696cde2214e0425839ae84f84.exe Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation sahiba_1.exe -
Executes dropped EXE 9 IoCs
pid Process 1720 setup_install.exe 4152 sahiba_2.exe 4760 sahiba_4.exe 3392 sahiba_5.exe 4144 smss.exe 4348 sahiba_1.exe 2320 smss.exe 3196 smss.exe 3584 smss.exe -
Loads dropped DLL 8 IoCs
pid Process 1720 setup_install.exe 1720 setup_install.exe 1720 setup_install.exe 1720 setup_install.exe 1720 setup_install.exe 1720 setup_install.exe 4152 Process not Found 4468 smss.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ipinfo.io 30 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4272 1720 WerFault.exe 91 4520 4468 WerFault.exe 115 -
Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID Process not Found Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID Process not Found Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Process not Found -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found -
Modifies data under HKEY_USERS 54 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4152 Process not Found 4152 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1416 Process not Found 436 Process not Found 2376 Process not Found 3284 Process not Found 4272 Process not Found 4932 Process not Found 3644 Process not Found 3428 Process not Found 1188 Process not Found 2640 Process not Found 460 Process not Found 5024 Process not Found 4764 Process not Found 2940 Process not Found 4016 Process not Found 396 Process not Found 4660 Process not Found 4980 Process not Found 4772 Process not Found 4116 Process not Found 4752 Process not Found 2492 Process not Found 3760 Process not Found 752 Process not Found 3628 Process not Found 1304 Process not Found 1696 Process not Found 3056 Process not Found 4564 Process not Found 4392 Process not Found 3208 Process not Found 1060 Process not Found 2660 Process not Found 3060 Process not Found 3540 Process not Found 4908 Process not Found 2240 Process not Found 1704 Process not Found 3356 Process not Found 1952 Process not Found 1020 Process not Found 5052 Process not Found 4584 Process not Found 3380 Process not Found 5040 Process not Found 4596 Process not Found 60 Process not Found 5112 Process not Found 5012 Process not Found 2004 Process not Found 4060 Process not Found 800 Process not Found 1412 Process not Found 2116 Process not Found 2988 Process not Found 1292 Process not Found 2236 Process not Found 3312 Process not Found 1656 Process not Found 2228 Process not Found 2124 Process not Found 1948 Process not Found 4676 Process not Found 4112 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4152 Process not Found -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 4760 Process not Found Token: SeDebugPrivilege 3392 Process not Found Token: SeCreateGlobalPrivilege 5048 Process not Found Token: SeChangeNotifyPrivilege 5048 Process not Found Token: 33 5048 Process not Found Token: SeIncBasePriorityPrivilege 5048 Process not Found Token: SeCreateGlobalPrivilege 4564 Process not Found Token: SeChangeNotifyPrivilege 4564 Process not Found Token: 33 4564 Process not Found Token: SeIncBasePriorityPrivilege 4564 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeCreateGlobalPrivilege 3312 Process not Found Token: SeChangeNotifyPrivilege 3312 Process not Found Token: 33 3312 Process not Found Token: SeIncBasePriorityPrivilege 3312 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeCreateGlobalPrivilege 3336 Process not Found Token: SeChangeNotifyPrivilege 3336 Process not Found Token: 33 3336 Process not Found Token: SeIncBasePriorityPrivilege 3336 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found 3444 Process not Found -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4016 wrote to memory of 1720 4016 c061f6c696cde2214e0425839ae84f84.exe 91 PID 4016 wrote to memory of 1720 4016 c061f6c696cde2214e0425839ae84f84.exe 91 PID 4016 wrote to memory of 1720 4016 c061f6c696cde2214e0425839ae84f84.exe 91 PID 1720 wrote to memory of 4528 1720 setup_install.exe 111 PID 1720 wrote to memory of 4528 1720 setup_install.exe 111 PID 1720 wrote to memory of 4528 1720 setup_install.exe 111 PID 1720 wrote to memory of 5096 1720 setup_install.exe 110 PID 1720 wrote to memory of 5096 1720 setup_install.exe 110 PID 1720 wrote to memory of 5096 1720 setup_install.exe 110 PID 1720 wrote to memory of 2384 1720 setup_install.exe 109 PID 1720 wrote to memory of 2384 1720 setup_install.exe 109 PID 1720 wrote to memory of 2384 1720 setup_install.exe 109 PID 1720 wrote to memory of 5076 1720 setup_install.exe 108 PID 1720 wrote to memory of 5076 1720 setup_install.exe 108 PID 1720 wrote to memory of 5076 1720 setup_install.exe 108 PID 1720 wrote to memory of 3208 1720 setup_install.exe 107 PID 1720 wrote to memory of 3208 1720 setup_install.exe 107 PID 1720 wrote to memory of 3208 1720 setup_install.exe 107 PID 1720 wrote to memory of 1876 1720 setup_install.exe 106 PID 1720 wrote to memory of 1876 1720 setup_install.exe 106 PID 1720 wrote to memory of 1876 1720 setup_install.exe 106 PID 1720 wrote to memory of 376 1720 setup_install.exe 95 PID 1720 wrote to memory of 376 1720 setup_install.exe 95 PID 1720 wrote to memory of 376 1720 setup_install.exe 95 PID 5096 wrote to memory of 4152 5096 cmd.exe 105 PID 5096 wrote to memory of 4152 5096 cmd.exe 105 PID 5096 wrote to memory of 4152 5096 cmd.exe 105 PID 5076 wrote to memory of 4760 5076 cmd.exe 104 PID 5076 wrote to memory of 4760 5076 cmd.exe 104 PID 3208 wrote to memory of 3392 3208 cmd.exe 103 PID 3208 wrote to memory of 3392 3208 cmd.exe 103 PID 2384 wrote to memory of 4144 2384 Process not Found 706 PID 2384 wrote to memory of 4144 2384 Process not Found 706 PID 2384 wrote to memory of 4144 2384 Process not Found 706 PID 4528 wrote to memory of 4348 4528 Process not Found 97 PID 4528 wrote to memory of 4348 4528 Process not Found 97 PID 4528 wrote to memory of 4348 4528 Process not Found 97 PID 1876 wrote to memory of 2320 1876 Process not Found 998 PID 1876 wrote to memory of 2320 1876 Process not Found 998 PID 1876 wrote to memory of 2320 1876 Process not Found 998 PID 376 wrote to memory of 3196 376 Process not Found 992 PID 376 wrote to memory of 3196 376 Process not Found 992 PID 4348 wrote to memory of 3584 4348 sahiba_1.exe 432 PID 4348 wrote to memory of 3584 4348 sahiba_1.exe 432 PID 4348 wrote to memory of 3584 4348 sahiba_1.exe 432 PID 5012 wrote to memory of 4468 5012 Process not Found 664 PID 5012 wrote to memory of 4468 5012 Process not Found 664 PID 5012 wrote to memory of 4468 5012 Process not Found 664 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c061f6c696cde2214e0425839ae84f84.exe"C:\Users\Admin\AppData\Local\Temp\c061f6c696cde2214e0425839ae84f84.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe3⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\sahiba_7.exesahiba_7.exe4⤵PID:3196
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 5483⤵
- Program crash
PID:4272
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe3⤵PID:1876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe3⤵
- Suspicious use of WriteProcessMemory
PID:5076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe3⤵PID:2384
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe3⤵
- Suspicious use of WriteProcessMemory
PID:5096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe3⤵PID:4528
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\sahiba_1.exesahiba_1.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\sahiba_1.exe" -a2⤵PID:3584
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\sahiba_6.exesahiba_6.exe1⤵PID:2320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1720 -ip 17201⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\sahiba_3.exesahiba_3.exe1⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\sahiba_5.exesahiba_5.exe1⤵
- Executes dropped EXE
PID:3392
-
C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\sahiba_4.exesahiba_4.exe1⤵
- Executes dropped EXE
PID:4760
-
C:\Users\Admin\AppData\Local\Temp\7zS0BFBC297\sahiba_2.exesahiba_2.exe1⤵
- Executes dropped EXE
PID:4152
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 6002⤵
- Program crash
PID:4520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4468 -ip 44681⤵PID:2208
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5012
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:5048
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4564
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3312
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3504
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2880
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4504
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3108
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4924
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4328
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000033c 000000841⤵
- Executes dropped EXE
PID:3584
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000244 000000841⤵
- Loads dropped DLL
PID:4468
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000250 000000841⤵
- Executes dropped EXE
PID:4144
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000cc 000000841⤵
- Executes dropped EXE
PID:3196
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000f8 000000841⤵
- Executes dropped EXE
PID:2320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
Filesize
202KB
MD54a958b7f15d342fbaaed26da7b9a5628
SHA125e663702193dc851e7fd57005ef45d9e65077f4
SHA2565b397fc6966368fc4b2c3302e0aa529d14de521a1ff2810a8145a7c574fa7709
SHA512dab2955ea896b36f8c8854157dbee975afc13efb53335c940f2efc6d13aae7aafdd515fa156c866d243a93edf16ba20e1884559ed7621b7a1a4d26091980f43e
-
Filesize
365KB
MD5e07c849f0610b6494a316e686abe9208
SHA1b15949d5c196d9e8deb063be771de2a28a625def
SHA256a20e96a2c647b8c89987f6397644ea2f5b56787860d4df5d9893f500e847404d
SHA5129ad48e2fbfb75d86573742f6d5491f6fea8f6adda9e0dce47b1a0d8740bea700e5013203eb956904b3353f709ed901587b6606a6514b417906593e93036f8d58
-
Filesize
8KB
MD53338af5387be57396e2ab03cdd18271f
SHA1e60e505a56fedd2f91e0ac4ec7267c270b86ebc3
SHA256396adb904ebd81c2996a01520af921ef4bffedaf45b65d50d158e95a10c2b943
SHA512f1173732a3a1e20c89f3c354bcaf9d9b737526dce6697044cfa65d130ec120f1b75148d6c7b881af892c507b112c050dc2218b71e9522f88da6aff2015524b33
-
Filesize
92KB
MD5bf5e071e1c72d0cc1779f2974a6dc14a
SHA1dcbbe2db2554b76a01c6d972971cc33eb8f45773
SHA25685951209d1a34f81273c8cf0bf6667b2ff1260b689e4647dc89ae7dc4cee27e0
SHA5123d1ba9929cc2d6cc15dea16a6161a5e7bd19f29c82b86d07d3a3ba102c97caedf0c8edc8ef7bb59a795b3904f0b5f274caf5ba989b246252fd58682c017b99b7
-
Filesize
287KB
MD58e316ec3b4d715862e31529b7c155aee
SHA11e1e1268bb609d92b3e778cecbdae4e97c1b5bb2
SHA256ef5fbfafa5b4b138302c45631c72e699dd8ab43d93a77a19ba5a7b155a55d794
SHA5123e0085b92a3d2105a6f5c5618701daf0341b34f37c9ec37fc13d3093694494536c1af1e7e66e45a6a0edd7fd2d34b720fd16c1cf6a976aa3b6a4939b0f291acc