nullmixer | e270a47e3c09fe00dd072297302d96b830682e18214cb7410be4d56f6feb0dd0

Analysis

max time kernel
149s
max time network
164s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9705afcbe13766eedfe83cd901a1cd2.exe
Size

1.5MB
MD5

c9705afcbe13766eedfe83cd901a1cd2
SHA1

5f0a179c3a72744d8e7d16aedebaf5c000b2c019
SHA256

e270a47e3c09fe00dd072297302d96b830682e18214cb7410be4d56f6feb0dd0
SHA512

d34efb1d0f2ef24e277914e292cc09e753f4ca0e9e6189d7163e9932062f4fe2259b180a29ed9d2d5fa3486b3f4e1f2c7e40cf11b7a385562f72534b35f3a53e
SSDEEP

24576:Eg5Qr587v2TIC7sQpnVBf9QQMfcflspnr1+dReMQfOtzan2WnbSXqmndlLMV44gT:EgirovmIm/VhMfcfepnPfgJWn2fPLI6T

Score

10^/10

nullmixer smokeloader pub6 backdoor dropper evasion trojan

Malware Config

Extracted

Family

nullmixer

http://wxkeww.xyz/

Extracted

Family

smokeloader

Botnet

pub6

Extracted

Family

smokeloader

Version

2020

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	karotima_1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	karotima_1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	karotima_1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	karotima_1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	karotima_1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	karotima_1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	karotima_1.exe

NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 5 IoCs

pid	Process
1936	setup_installer.exe
2960	setup_install.exe
2800	karotima_2.exe
2860	karotima_1.exe
1704	drhwadf

Loads dropped DLL 32 IoCs

pid	Process
2176	c9705afcbe13766eedfe83cd901a1cd2.exe
1936	setup_installer.exe
1936	setup_installer.exe
1936	setup_installer.exe
1936	setup_installer.exe
1936	setup_installer.exe
1936	setup_installer.exe
2960	setup_install.exe
2960	setup_install.exe
2960	setup_install.exe
2960	setup_install.exe
2960	setup_install.exe
2960	setup_install.exe
2960	setup_install.exe
2960	setup_install.exe
2780	cmd.exe
2780	cmd.exe
1988	cmd.exe
2800	karotima_2.exe
2860	karotima_1.exe
2800	karotima_2.exe
2860	karotima_1.exe
2800	karotima_2.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io
5	ipinfo.io
11	api.db-ip.com
12	api.db-ip.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1292	2960	WerFault.exe	34
2648	1704	WerFault.exe	39

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	karotima_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	karotima_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	karotima_2.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	karotima_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	karotima_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	karotima_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	karotima_1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	karotima_2.exe
2800	karotima_2.exe
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2800	karotima_2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1192	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1192	Process not Found
1192	Process not Found

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1192	Process not Found
1192	Process not Found

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1936	2176	c9705afcbe13766eedfe83cd901a1cd2.exe	28
PID 2176 wrote to memory of 1936	2176	c9705afcbe13766eedfe83cd901a1cd2.exe	28
PID 2176 wrote to memory of 1936	2176	c9705afcbe13766eedfe83cd901a1cd2.exe	28
PID 2176 wrote to memory of 1936	2176	c9705afcbe13766eedfe83cd901a1cd2.exe	28
PID 2176 wrote to memory of 1936	2176	c9705afcbe13766eedfe83cd901a1cd2.exe	28
PID 2176 wrote to memory of 1936	2176	c9705afcbe13766eedfe83cd901a1cd2.exe	28
PID 2176 wrote to memory of 1936	2176	c9705afcbe13766eedfe83cd901a1cd2.exe	28
PID 1936 wrote to memory of 2960	1936	setup_installer.exe	34
PID 1936 wrote to memory of 2960	1936	setup_installer.exe	34
PID 1936 wrote to memory of 2960	1936	setup_installer.exe	34
PID 1936 wrote to memory of 2960	1936	setup_installer.exe	34
PID 1936 wrote to memory of 2960	1936	setup_installer.exe	34
PID 1936 wrote to memory of 2960	1936	setup_installer.exe	34
PID 1936 wrote to memory of 2960	1936	setup_installer.exe	34
PID 2960 wrote to memory of 1988	2960	setup_install.exe	32
PID 2960 wrote to memory of 1988	2960	setup_install.exe	32
PID 2960 wrote to memory of 1988	2960	setup_install.exe	32
PID 2960 wrote to memory of 1988	2960	setup_install.exe	32
PID 2960 wrote to memory of 1988	2960	setup_install.exe	32
PID 2960 wrote to memory of 1988	2960	setup_install.exe	32
PID 2960 wrote to memory of 1988	2960	setup_install.exe	32
PID 2960 wrote to memory of 2780	2960	setup_install.exe	29
PID 2960 wrote to memory of 2780	2960	setup_install.exe	29
PID 2960 wrote to memory of 2780	2960	setup_install.exe	29
PID 2960 wrote to memory of 2780	2960	setup_install.exe	29
PID 2960 wrote to memory of 2780	2960	setup_install.exe	29
PID 2960 wrote to memory of 2780	2960	setup_install.exe	29
PID 2960 wrote to memory of 2780	2960	setup_install.exe	29
PID 2780 wrote to memory of 2800	2780	cmd.exe	31
PID 2780 wrote to memory of 2800	2780	cmd.exe	31
PID 2780 wrote to memory of 2800	2780	cmd.exe	31
PID 2780 wrote to memory of 2800	2780	cmd.exe	31
PID 2780 wrote to memory of 2800	2780	cmd.exe	31
PID 2780 wrote to memory of 2800	2780	cmd.exe	31
PID 2780 wrote to memory of 2800	2780	cmd.exe	31
PID 1988 wrote to memory of 2860	1988	cmd.exe	30
PID 1988 wrote to memory of 2860	1988	cmd.exe	30
PID 1988 wrote to memory of 2860	1988	cmd.exe	30
PID 1988 wrote to memory of 2860	1988	cmd.exe	30
PID 1988 wrote to memory of 2860	1988	cmd.exe	30
PID 1988 wrote to memory of 2860	1988	cmd.exe	30
PID 1988 wrote to memory of 2860	1988	cmd.exe	30
PID 2960 wrote to memory of 1292	2960	setup_install.exe	35
PID 2960 wrote to memory of 1292	2960	setup_install.exe	35
PID 2960 wrote to memory of 1292	2960	setup_install.exe	35
PID 2960 wrote to memory of 1292	2960	setup_install.exe	35
PID 2960 wrote to memory of 1292	2960	setup_install.exe	35
PID 2960 wrote to memory of 1292	2960	setup_install.exe	35
PID 2960 wrote to memory of 1292	2960	setup_install.exe	35
PID 1308 wrote to memory of 1704	1308	taskeng.exe	39
PID 1308 wrote to memory of 1704	1308	taskeng.exe	39
PID 1308 wrote to memory of 1704	1308	taskeng.exe	39
PID 1308 wrote to memory of 1704	1308	taskeng.exe	39
PID 1704 wrote to memory of 2648	1704	drhwadf	40
PID 1704 wrote to memory of 2648	1704	drhwadf	40
PID 1704 wrote to memory of 2648	1704	drhwadf	40
PID 1704 wrote to memory of 2648	1704	drhwadf	40

C:\Users\Admin\AppData\Local\Temp\c9705afcbe13766eedfe83cd901a1cd2.exe
"C:\Users\Admin\AppData\Local\Temp\c9705afcbe13766eedfe83cd901a1cd2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\7zS0971DBA6\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0971DBA6\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 372
      4⤵
      Loads dropped DLL
      Program crash
      PID:1292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c karotima_2.exe
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\7zS0971DBA6\karotima_2.exe
  karotima_2.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2800

C:\Users\Admin\AppData\Local\Temp\7zS0971DBA6\karotima_1.exe
karotima_1.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c karotima_1.exe
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\system32\taskeng.exe
taskeng.exe {E7ACB9F6-CC09-4FF5-BF01-7ECF31101041} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Roaming\drhwadf
  C:\Users\Admin\AppData\Roaming\drhwadf
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 124
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CC4F.tmp

Filesize
382KB

MD5
7110c62cfeae8451d0a91eed0266edde

SHA1
93cbbd558cf954afac40f49e12805ba344413b9d

SHA256
4ec22ac35fdc138395f500f6fd0355a0026aa156497f0556e5f5ccca6eaf4312

SHA512
24729e031ac35bf15d792b3d3510b89c86cb338201e46b5a16f20006a8f645dffa9add158c55caf595a2fa7877ec95a07da3f1bf60c81add1204771c137c419f

Download Submit
C:\Users\Admin\AppData\Roaming\drhwadf

Filesize
201KB

MD5
7e3cb6bf4000e17ada2121b84b63ddc1

SHA1
3d9d09e4603b89913b0eca604021df3c49b4aa31

SHA256
439c74d75423ffb0071e342f248c48567f50f50e1f836ae119f5db1387147188

SHA512
0989ca525843ca03ebfb32b1f000307e7be9674b7453c7a8724f2206028e9ecc04b9f2ef130639858041d37a2b7a11d7e9b1e23197f22bb0e95f9d6f75291ebf

Download Submit
\Users\Admin\AppData\Local\Temp\setup_installer.exe

Filesize
92KB

MD5
d772d6902200f5d4599a9b27d0d8f9e6

SHA1
564eefb3fabe655b2fb51f492959b158cb20e12d

SHA256
7bf11639663306b53a7fe0e3826d12f03e1dda7b1fb3abaa758e3281d35f8e17

SHA512
6682d79a013129aceba9cde75a82f0444a28d30bfbd1c4656d7e3774b469283027a780362657c908c991f9b5939db32792e6713a323667ab763a95b3f3e23d36

Download Submit
memory/1192-100-0x0000000002A20000-0x0000000002A35000-memory.dmp

Filesize
84KB

Download
memory/1704-218-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/1704-212-0x0000000000A10000-0x0000000000B10000-memory.dmp

Filesize
1024KB

Download
memory/1704-233-0x0000000000A10000-0x0000000000B10000-memory.dmp

Filesize
1024KB

Download
memory/1936-38-0x00000000028E0000-0x00000000029FE000-memory.dmp

Filesize
1.1MB

Download
memory/1936-31-0x00000000028E0000-0x00000000029FE000-memory.dmp

Filesize
1.1MB

Download
memory/2800-91-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/2800-101-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/2800-104-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/2800-93-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/2800-90-0x00000000009C0000-0x0000000000AC0000-memory.dmp

Filesize
1024KB

Download
memory/2960-77-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2960-76-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2960-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2960-66-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2960-62-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2960-61-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2960-58-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2960-56-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2960-49-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2960-69-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2960-71-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2960-74-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2960-75-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2960-68-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2960-73-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2960-70-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2960-142-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2960-144-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2960-143-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/2960-141-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2960-140-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2960-139-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2960-65-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2960-63-0x0000000000C50000-0x0000000000D6E000-memory.dmp

Filesize
1.1MB

Download
memory/2960-59-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2960-57-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2960-50-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download