djvu | bdbd0ee82dc7acfb5fafe10561dddd6b6b11c1d55f2f96bc6a1c8eb5dce167e1

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2024, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88d758be6f5d43337e22f026abf3170f.exe
Size 244KB
Sample240208-wpqfpsgh6y
SHA256 bdbd0ee82dc7acfb5fafe10561dddd6b6b11c1d55f2f96bc6a1c8eb5dce167e1
MD5 88d758be6f5d43337e22f026abf3170f
SHA1 35437a2ad650484dde7a6ccf67fd76428ff4ada3
SHA512 1bce2be76d97c9fa6d9af0d4b937a302ab61f45dd72d30c64cb6af1d551095ae225133de517fc642864aeaf88d56429ab5242be598c35b3ac63756f9b23aa3ad
SSDEEP 3072:MwZm1wLxrRmuh2/xEQFz0i1g/ZNF/5kwfM3c16kbPsTdNRunrcSO4Dtl16/AaqP:Fm1w4ZEsg3FhZfMk3rNh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu smokeloader zgrat pub1 backdoor discovery persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.ldhy
offline_id
pIGzEr0bxHiTz7xnvNidWeqzKkxMfVdHTyCkzwt1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-hPAqznkJKD Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0849ASdw

rsa_pubkey.plain

Signatures

Detect ZGRat V1 20 IoCs

resource	yara_rule
behavioral2/memory/1776-86-0x0000000002810000-0x00000000028C0000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-91-0x0000000004E90000-0x0000000004F3E000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-92-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-93-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-95-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-103-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-101-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-99-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-97-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-105-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-107-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-111-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-109-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-113-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-115-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-119-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-117-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-121-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/1776-123-0x0000000004E90000-0x0000000004F39000-memory.dmp	family_zgrat_v1
behavioral2/memory/2860-1953-0x00000000056A0000-0x0000000005790000-memory.dmp	family_zgrat_v1

Detected Djvu ransomware 9 IoCs

resource	yara_rule
behavioral2/memory/4424-28-0x0000000004920000-0x0000000004A3B000-memory.dmp	family_djvu
behavioral2/memory/4512-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4512-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4512-32-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4512-33-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4512-44-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5060-50-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5060-51-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5060-53-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

.NET Reactor proctector 19 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/1776-86-0x0000000002810000-0x00000000028C0000-memory.dmp	net_reactor
behavioral2/memory/1776-91-0x0000000004E90000-0x0000000004F3E000-memory.dmp	net_reactor
behavioral2/memory/1776-92-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-93-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-95-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-103-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-101-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-99-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-97-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-105-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-107-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-111-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-109-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-113-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-115-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-119-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-117-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-121-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor
behavioral2/memory/1776-123-0x0000000004E90000-0x0000000004F39000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	E986.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	A854.exe

Deletes itself 1 IoCs

pid	Process
3412	Process not Found

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe	A854.exe

Executes dropped EXE 10 IoCs

pid	Process
1880	9A4C.exe
4424	E986.exe
4512	E986.exe
3480	E986.exe
5060	E986.exe
4656	9836.exe
1776	A854.exe
2860	C468.exe
812	qemu-ga.exe
4536	C468.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4396	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f36ca09a-13c9-464f-931c-297404b40730\\E986.exe\" --AutoStart"	E986.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
56	api.2ip.ua
57	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4424 set thread context of 4512	4424	E986.exe	94
PID 3480 set thread context of 5060	3480	E986.exe	98
PID 2860 set thread context of 4536	2860	C468.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4248	5060	WerFault.exe	98
3620	4656	WerFault.exe	102
4228	1776	WerFault.exe	103
3936	4536	WerFault.exe	111
1208	4536	WerFault.exe	111

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9A4C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	88d758be6f5d43337e22f026abf3170f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	88d758be6f5d43337e22f026abf3170f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	88d758be6f5d43337e22f026abf3170f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9A4C.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9A4C.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1780	88d758be6f5d43337e22f026abf3170f.exe
1780	88d758be6f5d43337e22f026abf3170f.exe
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found
3412	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1780	88d758be6f5d43337e22f026abf3170f.exe
1880	9A4C.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeDebugPrivilege	1776	A854.exe
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeDebugPrivilege	2860	C468.exe
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found
Token: SeShutdownPrivilege	3412	Process not Found
Token: SeCreatePagefilePrivilege	3412	Process not Found

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1880	3412	Process not Found	91
PID 3412 wrote to memory of 1880	3412	Process not Found	91
PID 3412 wrote to memory of 1880	3412	Process not Found	91
PID 3412 wrote to memory of 4424	3412	Process not Found	93
PID 3412 wrote to memory of 4424	3412	Process not Found	93
PID 3412 wrote to memory of 4424	3412	Process not Found	93
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4424 wrote to memory of 4512	4424	E986.exe	94
PID 4512 wrote to memory of 4396	4512	E986.exe	95
PID 4512 wrote to memory of 4396	4512	E986.exe	95
PID 4512 wrote to memory of 4396	4512	E986.exe	95
PID 4512 wrote to memory of 3480	4512	E986.exe	96
PID 4512 wrote to memory of 3480	4512	E986.exe	96
PID 4512 wrote to memory of 3480	4512	E986.exe	96
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3480 wrote to memory of 5060	3480	E986.exe	98
PID 3412 wrote to memory of 4656	3412	Process not Found	102
PID 3412 wrote to memory of 4656	3412	Process not Found	102
PID 3412 wrote to memory of 4656	3412	Process not Found	102
PID 3412 wrote to memory of 1776	3412	Process not Found	103
PID 3412 wrote to memory of 1776	3412	Process not Found	103
PID 3412 wrote to memory of 1776	3412	Process not Found	103
PID 3412 wrote to memory of 2860	3412	Process not Found	106
PID 3412 wrote to memory of 2860	3412	Process not Found	106
PID 3412 wrote to memory of 2860	3412	Process not Found	106
PID 1776 wrote to memory of 812	1776	A854.exe	108
PID 1776 wrote to memory of 812	1776	A854.exe	108
PID 2860 wrote to memory of 4536	2860	C468.exe	111
PID 2860 wrote to memory of 4536	2860	C468.exe	111
PID 2860 wrote to memory of 4536	2860	C468.exe	111
PID 2860 wrote to memory of 4536	2860	C468.exe	111
PID 2860 wrote to memory of 4536	2860	C468.exe	111
PID 2860 wrote to memory of 4536	2860	C468.exe	111
PID 2860 wrote to memory of 4536	2860	C468.exe	111
PID 2860 wrote to memory of 4536	2860	C468.exe	111
PID 2860 wrote to memory of 4536	2860	C468.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\88d758be6f5d43337e22f026abf3170f.exe
"C:\Users\Admin\AppData\Local\Temp\88d758be6f5d43337e22f026abf3170f.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1780

C:\Users\Admin\AppData\Local\Temp\9A4C.exe
C:\Users\Admin\AppData\Local\Temp\9A4C.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1880

C:\Users\Admin\AppData\Local\Temp\E986.exe
C:\Users\Admin\AppData\Local\Temp\E986.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\E986.exe
  C:\Users\Admin\AppData\Local\Temp\E986.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\f36ca09a-13c9-464f-931c-297404b40730" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\E986.exe
    "C:\Users\Admin\AppData\Local\Temp\E986.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\E986.exe
      "C:\Users\Admin\AppData\Local\Temp\E986.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:5060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 568
        5⤵
        Program crash
        
        PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5060 -ip 5060
1⤵
PID:2416

C:\Users\Admin\AppData\Local\Temp\9836.exe
C:\Users\Admin\AppData\Local\Temp\9836.exe
1⤵
- Executes dropped EXE
PID:4656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1152
  2⤵
  - Program crash
  PID:3620

C:\Users\Admin\AppData\Local\Temp\A854.exe
C:\Users\Admin\AppData\Local\Temp\A854.exe
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 1184
  2⤵
  - Program crash
  PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4656 -ip 4656
1⤵
PID:896

C:\Users\Admin\AppData\Local\Temp\C468.exe
C:\Users\Admin\AppData\Local\Temp\C468.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\C468.exe
  C:\Users\Admin\AppData\Local\Temp\C468.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1136
    3⤵
    - Program crash
    PID:3936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1068
    3⤵
    - Program crash
    PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1776 -ip 1776
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4536 -ip 4536
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4536 -ip 4536
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9836.exe

Path C:\Users\Admin\AppData\Local\Temp\9836.exe
Size 1.7MB
SHA256 35df8690ceda348b00f543f94ef75d3cc53c147dba9369cf885b2ea8b47770fa
MD5 54a6e3f899b01a296c1d494e4ffa44a7
SHA1 519efb67333e3c602b197ac4af9a5a7c0a2365bd
SHA512 1f36b26237fff97141e150f52ed186cff7d9f091e3873ac6b112f27db7f65640eabd6617a3d3b92769d9c2a8dc5db4714d82d10bc367126f5b2f0eb9613a985a
SSDEEP 49152:l7iXNl1MVDRspFhCTSsHtZBMoOiMEQj02LQnwR8J:luEqDCBNZBMoC5QnwO
MD5 SHA1 SHA512 SSDEEP

Submit Download

9836.exe

Path C:\Users\Admin\AppData\Local\Temp\9836.exe
Size 1.6MB
SHA256 5019d7404128b45cc2f92fc847a5dd592b8368445469794511569836c80a7458
MD5 63e01863874f11f86518924b79cc24da
SHA1 a8029228dc0ff362188868b564f748a2fa1088c3
SHA512 45a5240a559645fe2558f63237ff31a6d6c76b5b39d803c6190bf6bccad99d66a52778bf486a3239a059f960ae8c451be6b63b1e8bdd0415bacdbf5e5d270893
SSDEEP 49152:l7iXNl1MVDRspFhCTSsHtZBMoOiMEQj02LQnm:luEqDCBNZBMoC5Qnm
MD5 SHA1 SHA512 SSDEEP

Submit Download

9A4C.exe

Path C:\Users\Admin\AppData\Local\Temp\9A4C.exe
Size 170KB
SHA256 a69d7517d4446398a134a31d5ef4cd09ca9b4d51c26d8195a803e6f45493c6fb
MD5 3951adeb102b9d9f38ad610c8b784090
SHA1 8728e88c32f2f233501cf849b6c6a945f9b0ad91
SHA512 76afc1ec4758031860f4379854a3572869b3fbcb36d4ef5afca4e262eaa70781f9912f70a7c56ba3a519f3b6981e2e362c4cc03a8b364bd2cb2e024a199be6a8
SSDEEP 3072:4LWzwQb2BRThhLXoVU9esHFBvbA6aqTeG:4LWsfthN+8esH8
MD5 SHA1 SHA512 SSDEEP

Submit Download

A854.exe

Path C:\Users\Admin\AppData\Local\Temp\A854.exe
Size 649KB
SHA256 9217999518147c602f16ed7d80c9b95dec621f442192ce49192736a27e73847f
MD5 35ffefa212414c2538df410e5ad3afa7
SHA1 e7721fbb85e400c74c7f4de95f1c27b6318caabd
SHA512 7bf9ffe99588a1e6e01a6c84fee7bd998b337653c908e33d3c10f1aa9abc7af925ca9d86a884099824133947614aa070181c973b220163dd99dde87765152a25
SSDEEP 12288:8iKjrHyexBctDvHT5JKxdhlJdMF0GXMHnWI0XSIHEPRMzoAgxAWaxL6:a0tTHTKb3+XuWIaSIHqRpxi6
MD5 SHA1 SHA512 SSDEEP

Submit Download

C468.exe

Path C:\Users\Admin\AppData\Local\Temp\C468.exe
Size 952KB
SHA256 82311d6280999d5c9d368377e30b8f55abe2a3d7d98f8c074f6e40c5be7cd965
MD5 422a9c5cfa6370c93a4bd5db29c3d196
SHA1 caaf89e601fde4bc9dbe3c0edda8e7efa5062e17
SHA512 2caf014595f65caa26bd7c8396f981ee452ef01fdf35dde3e9e2e950855f564e97026f71c52b9a49526f9bca68d4f5c6d4bc9ba51d4b8330e38e4b4b84214e96
SSDEEP 12288:DdbkfRTBFnDOyMEktt7LuR6CsjKHL8sQ4OaiQJW+nDSHZx1ZK97wJDgwkxTUkMvW:52ZDnyyMtLUhwKrkgo+nD8Z/3DCTUpoB
MD5 SHA1 SHA512 SSDEEP

Submit Download

E986.exe

Path C:\Users\Admin\AppData\Local\Temp\E986.exe
Size 699KB
SHA256 9d2a9b3978790f121c43e7fece8f43704761fc609f0bd026f223bba6539f1622
MD5 bc6e113b7b34968f4219fec2b214def9
SHA1 968a437d3ef93f1660ead5d3b89608296760a3e9
SHA512 f835a9c28eef54a105e3075aa21c0c2e1d5350661fbd61c152e9c83c1968f871586f28d1bc9ed848b3cec1cdddc83c2b8765525f3abf5cfd858c9f833f769972
SSDEEP 12288:x2q9GHy0fs0sz9RomhqPZpUIOa/hZOhKOSuVRjMPXxODpdUh:QS0fsvz9Eovu6K0VRjMPA3Uh
MD5 SHA1 SHA512 SSDEEP

Submit Download

qemu-ga.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
Size 4KB
SHA256 9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a
MD5 a5ce3aba68bdb438e98b1d0c70a3d95c
SHA1 013f5aa9057bf0b3c0c24824de9d075434501354
SHA512 7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79
SSDEEP 48:68kM4rRDxNMk+wwnikZsFtRvlm4MI9BFipfbNtm:8vVDB+wwn0/MvzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/812-3101-0x00007FF9403F0000-0x00007FF940EB1000-memory.dmp

Download

memory/812-3098-0x0000000000790000-0x0000000000798000-memory.dmp

Download

memory/1776-2452-0x0000000006810000-0x00000000068A2000-memory.dmp

Download

memory/1776-2480-0x00000000084B0000-0x00000000089DC000-memory.dmp

Download

memory/1776-3104-0x00000000742C0000-0x0000000074A70000-memory.dmp

Download

memory/1776-3103-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/1776-3085-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/1776-109-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-3082-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/1776-3077-0x00000000742C0000-0x0000000074A70000-memory.dmp

Download

memory/1776-2483-0x0000000000610000-0x0000000000710000-memory.dmp

Download

memory/1776-113-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-2475-0x0000000006B00000-0x0000000006CC2000-memory.dmp

Download

memory/1776-2470-0x0000000006EB0000-0x0000000006F00000-memory.dmp

Download

memory/1776-2455-0x0000000006910000-0x000000000692E000-memory.dmp

Download

memory/1776-2447-0x0000000006720000-0x0000000006796000-memory.dmp

Download

memory/1776-2372-0x0000000005F20000-0x0000000005F86000-memory.dmp

Download

memory/1776-1946-0x0000000005DC0000-0x0000000005E0C000-memory.dmp

Download

memory/1776-1945-0x0000000004F60000-0x0000000004F9C000-memory.dmp

Download

memory/1776-1944-0x0000000005CB0000-0x0000000005DBA000-memory.dmp

Download

memory/1776-1943-0x0000000004F40000-0x0000000004F52000-memory.dmp

Download

memory/1776-1942-0x0000000005690000-0x0000000005CA8000-memory.dmp

Download

memory/1776-1941-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/1776-123-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-121-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-117-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-119-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-115-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-111-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-3084-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/1776-107-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-105-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-83-0x0000000000610000-0x0000000000710000-memory.dmp

Download

memory/1776-84-0x0000000002180000-0x0000000002245000-memory.dmp

Download

memory/1776-85-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/1776-86-0x0000000002810000-0x00000000028C0000-memory.dmp

Download

memory/1776-87-0x00000000742C0000-0x0000000074A70000-memory.dmp

Download

memory/1776-88-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/1776-89-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/1776-90-0x0000000004FE0000-0x0000000005584000-memory.dmp

Download

memory/1776-91-0x0000000004E90000-0x0000000004F3E000-memory.dmp

Download

memory/1776-92-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-93-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-95-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-103-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-101-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-99-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1776-97-0x0000000004E90000-0x0000000004F39000-memory.dmp

Download

memory/1780-3-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/1780-5-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/1780-2-0x0000000002190000-0x000000000219B000-memory.dmp

Download

memory/1780-1-0x0000000000490000-0x0000000000590000-memory.dmp

Download

memory/1880-17-0x0000000000400000-0x0000000002BD7000-memory.dmp

Download

memory/1880-19-0x0000000000400000-0x0000000002BD7000-memory.dmp

Download

memory/1880-16-0x0000000002BE0000-0x0000000002CE0000-memory.dmp

Download

memory/2860-3081-0x0000000005840000-0x000000000588C000-memory.dmp

Download

memory/2860-3105-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/2860-3100-0x00000000742C0000-0x0000000074A70000-memory.dmp

Download

memory/2860-3111-0x00000000742C0000-0x0000000074A70000-memory.dmp

Download

memory/2860-3080-0x0000000005AF0000-0x0000000005B6A000-memory.dmp

Download

memory/2860-3079-0x00000000057F0000-0x00000000057F1000-memory.dmp

Download

memory/2860-3078-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/2860-1953-0x00000000056A0000-0x0000000005790000-memory.dmp

Download

memory/2860-1952-0x00000000742C0000-0x0000000074A70000-memory.dmp

Download

memory/2860-1951-0x0000000000D20000-0x0000000000E12000-memory.dmp

Download

memory/3412-4-0x00000000024B0000-0x00000000024C6000-memory.dmp

Download

memory/3412-18-0x0000000006B20000-0x0000000006B36000-memory.dmp

Download

memory/3480-47-0x00000000048D0000-0x0000000004963000-memory.dmp

Download

memory/4424-28-0x0000000004920000-0x0000000004A3B000-memory.dmp

Download

memory/4424-27-0x0000000004880000-0x000000000491A000-memory.dmp

Download

memory/4512-31-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4512-32-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4512-44-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4512-33-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4512-29-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4536-3116-0x0000000002620000-0x0000000002720000-memory.dmp

Download

memory/4536-3117-0x00000000025A0000-0x00000000025D2000-memory.dmp

Download

memory/4536-3113-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4536-3114-0x00000000025A0000-0x00000000025D2000-memory.dmp

Download

memory/4536-3115-0x00000000025A0000-0x00000000025D2000-memory.dmp

Download

memory/4536-3112-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4656-71-0x0000000000EE0000-0x0000000001A3B000-memory.dmp

Download

memory/4656-62-0x0000000000EE0000-0x0000000001A3B000-memory.dmp

Download

memory/4656-64-0x0000000001BA0000-0x0000000001BA1000-memory.dmp

Download

memory/4656-61-0x0000000001B60000-0x0000000001B61000-memory.dmp

Download

memory/4656-60-0x0000000001B50000-0x0000000001B51000-memory.dmp

Download

memory/4656-72-0x0000000000EE0000-0x0000000001A3B000-memory.dmp

Download

memory/4656-73-0x0000000003690000-0x00000000036C2000-memory.dmp

Download

memory/4656-74-0x0000000003690000-0x00000000036C2000-memory.dmp

Download

memory/4656-75-0x0000000003690000-0x00000000036C2000-memory.dmp

Download

memory/4656-65-0x0000000001BB0000-0x0000000001BB1000-memory.dmp

Download

memory/4656-77-0x0000000003690000-0x00000000036C2000-memory.dmp

Download

memory/4656-76-0x0000000003690000-0x00000000036C2000-memory.dmp

Download

memory/4656-66-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Download

memory/4656-1464-0x0000000000EE0000-0x0000000001A3B000-memory.dmp

Download

memory/4656-63-0x0000000001B90000-0x0000000001B91000-memory.dmp

Download

memory/5060-50-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5060-53-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5060-51-0x0000000000400000-0x0000000000537000-memory.dmp

Download