5699db53cf050f538364b5b28bc23a18a9666295706685b3ac9608ac1731c662

Analysis

max time kernel
143s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe
Size

22.2MB
MD5

5df851563272f6928d8ec89699001376
SHA1

b748033191cef57bdb3ba8f0f16c59defc0f7a88
SHA256

5699db53cf050f538364b5b28bc23a18a9666295706685b3ac9608ac1731c662
SHA512

c69a0b942d55ebf654e59114159e7802329a80ff133edd1b18f3b263a32f501e5342ff112b731f6fcc2ec16da1648d67176a23b5052f9acbae1df16986841eb5
SSDEEP

393216:XqeHsQXKIQ2A6p/jJicojuCXiv3vMBnz4CFxDqg9u4PS6n4CEJXE0wEKD3/L4:XqeHsQXKx6liUCXk3EmCFpq4PznwXDwI

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 8 IoCs

resource	yara_rule
behavioral1/memory/2836-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/files/0x000c000000012253-1.dat	UPX
behavioral1/memory/2836-62-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2836-68-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2836-77-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2836-82-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2836-89-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2836-98-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c000000012253-1.dat	acprotect

Executes dropped EXE 11 IoCs

pid	Process
2024	ISBEW64.exe
1916	ISBEW64.exe
1564	ISBEW64.exe
320	ISBEW64.exe
1432	ISBEW64.exe
1604	ISBEW64.exe
308	ISBEW64.exe
1748	ISBEW64.exe
268	ISBEW64.exe
580	ISBEW64.exe
1276	ISBEW64.exe

Loads dropped DLL 16 IoCs

pid	Process
2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2548	MsiExec.exe
2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2836-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x000c000000012253-1.dat	upx
behavioral1/memory/2836-62-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2836-68-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2836-77-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2836-82-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2836-89-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2836-98-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\e:	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\program files\common files\system\symsrv.dll.000	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe
2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe
2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2120	msiexec.exe
2548	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe
Token: SeShutdownPrivilege	2520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2648	msiexec.exe
Token: SeTakeOwnershipPrivilege	2648	msiexec.exe
Token: SeSecurityPrivilege	2648	msiexec.exe
Token: SeCreateTokenPrivilege	2520	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2520	msiexec.exe
Token: SeLockMemoryPrivilege	2520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2520	msiexec.exe
Token: SeMachineAccountPrivilege	2520	msiexec.exe
Token: SeTcbPrivilege	2520	msiexec.exe
Token: SeSecurityPrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeLoadDriverPrivilege	2520	msiexec.exe
Token: SeSystemProfilePrivilege	2520	msiexec.exe
Token: SeSystemtimePrivilege	2520	msiexec.exe
Token: SeProfSingleProcessPrivilege	2520	msiexec.exe
Token: SeIncBasePriorityPrivilege	2520	msiexec.exe
Token: SeCreatePagefilePrivilege	2520	msiexec.exe
Token: SeCreatePermanentPrivilege	2520	msiexec.exe
Token: SeBackupPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeShutdownPrivilege	2520	msiexec.exe
Token: SeDebugPrivilege	2520	msiexec.exe
Token: SeAuditPrivilege	2520	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2520	msiexec.exe
Token: SeChangeNotifyPrivilege	2520	msiexec.exe
Token: SeRemoteShutdownPrivilege	2520	msiexec.exe
Token: SeUndockPrivilege	2520	msiexec.exe
Token: SeSyncAgentPrivilege	2520	msiexec.exe
Token: SeEnableDelegationPrivilege	2520	msiexec.exe
Token: SeManageVolumePrivilege	2520	msiexec.exe
Token: SeImpersonatePrivilege	2520	msiexec.exe
Token: SeCreateGlobalPrivilege	2520	msiexec.exe
Token: SeShutdownPrivilege	2120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2120	msiexec.exe
Token: SeCreateTokenPrivilege	2120	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2120	msiexec.exe
Token: SeLockMemoryPrivilege	2120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2120	msiexec.exe
Token: SeMachineAccountPrivilege	2120	msiexec.exe
Token: SeTcbPrivilege	2120	msiexec.exe
Token: SeSecurityPrivilege	2120	msiexec.exe
Token: SeTakeOwnershipPrivilege	2120	msiexec.exe
Token: SeLoadDriverPrivilege	2120	msiexec.exe
Token: SeSystemProfilePrivilege	2120	msiexec.exe
Token: SeSystemtimePrivilege	2120	msiexec.exe
Token: SeProfSingleProcessPrivilege	2120	msiexec.exe
Token: SeIncBasePriorityPrivilege	2120	msiexec.exe
Token: SeCreatePagefilePrivilege	2120	msiexec.exe
Token: SeCreatePermanentPrivilege	2120	msiexec.exe
Token: SeBackupPrivilege	2120	msiexec.exe
Token: SeRestorePrivilege	2120	msiexec.exe
Token: SeShutdownPrivilege	2120	msiexec.exe
Token: SeDebugPrivilege	2120	msiexec.exe
Token: SeAuditPrivilege	2120	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2120	msiexec.exe
Token: SeChangeNotifyPrivilege	2120	msiexec.exe
Token: SeRemoteShutdownPrivilege	2120	msiexec.exe
Token: SeUndockPrivilege	2120	msiexec.exe
Token: SeSyncAgentPrivilege	2120	msiexec.exe
Token: SeEnableDelegationPrivilege	2120	msiexec.exe
Token: SeManageVolumePrivilege	2120	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2520	msiexec.exe
2520	msiexec.exe
2120	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2520	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	28
PID 2836 wrote to memory of 2520	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	28
PID 2836 wrote to memory of 2520	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	28
PID 2836 wrote to memory of 2520	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	28
PID 2836 wrote to memory of 2520	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	28
PID 2836 wrote to memory of 2520	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	28
PID 2836 wrote to memory of 2520	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	28
PID 2836 wrote to memory of 2120	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	30
PID 2836 wrote to memory of 2120	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	30
PID 2836 wrote to memory of 2120	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	30
PID 2836 wrote to memory of 2120	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	30
PID 2836 wrote to memory of 2120	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	30
PID 2836 wrote to memory of 2120	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	30
PID 2836 wrote to memory of 2120	2836	2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe	30
PID 2648 wrote to memory of 2548	2648	msiexec.exe	31
PID 2648 wrote to memory of 2548	2648	msiexec.exe	31
PID 2648 wrote to memory of 2548	2648	msiexec.exe	31
PID 2648 wrote to memory of 2548	2648	msiexec.exe	31
PID 2648 wrote to memory of 2548	2648	msiexec.exe	31
PID 2648 wrote to memory of 2548	2648	msiexec.exe	31
PID 2648 wrote to memory of 2548	2648	msiexec.exe	31
PID 2548 wrote to memory of 2024	2548	MsiExec.exe	32
PID 2548 wrote to memory of 2024	2548	MsiExec.exe	32
PID 2548 wrote to memory of 2024	2548	MsiExec.exe	32
PID 2548 wrote to memory of 2024	2548	MsiExec.exe	32
PID 2548 wrote to memory of 1916	2548	MsiExec.exe	33
PID 2548 wrote to memory of 1916	2548	MsiExec.exe	33
PID 2548 wrote to memory of 1916	2548	MsiExec.exe	33
PID 2548 wrote to memory of 1916	2548	MsiExec.exe	33
PID 2548 wrote to memory of 1564	2548	MsiExec.exe	34
PID 2548 wrote to memory of 1564	2548	MsiExec.exe	34
PID 2548 wrote to memory of 1564	2548	MsiExec.exe	34
PID 2548 wrote to memory of 1564	2548	MsiExec.exe	34
PID 2548 wrote to memory of 320	2548	MsiExec.exe	35
PID 2548 wrote to memory of 320	2548	MsiExec.exe	35
PID 2548 wrote to memory of 320	2548	MsiExec.exe	35
PID 2548 wrote to memory of 320	2548	MsiExec.exe	35
PID 2548 wrote to memory of 1432	2548	MsiExec.exe	36
PID 2548 wrote to memory of 1432	2548	MsiExec.exe	36
PID 2548 wrote to memory of 1432	2548	MsiExec.exe	36
PID 2548 wrote to memory of 1432	2548	MsiExec.exe	36
PID 2548 wrote to memory of 1604	2548	MsiExec.exe	37
PID 2548 wrote to memory of 1604	2548	MsiExec.exe	37
PID 2548 wrote to memory of 1604	2548	MsiExec.exe	37
PID 2548 wrote to memory of 1604	2548	MsiExec.exe	37
PID 2548 wrote to memory of 308	2548	MsiExec.exe	38
PID 2548 wrote to memory of 308	2548	MsiExec.exe	38
PID 2548 wrote to memory of 308	2548	MsiExec.exe	38
PID 2548 wrote to memory of 308	2548	MsiExec.exe	38
PID 2548 wrote to memory of 1748	2548	MsiExec.exe	39
PID 2548 wrote to memory of 1748	2548	MsiExec.exe	39
PID 2548 wrote to memory of 1748	2548	MsiExec.exe	39
PID 2548 wrote to memory of 1748	2548	MsiExec.exe	39
PID 2548 wrote to memory of 268	2548	MsiExec.exe	40
PID 2548 wrote to memory of 268	2548	MsiExec.exe	40
PID 2548 wrote to memory of 268	2548	MsiExec.exe	40
PID 2548 wrote to memory of 268	2548	MsiExec.exe	40
PID 2548 wrote to memory of 580	2548	MsiExec.exe	41
PID 2548 wrote to memory of 580	2548	MsiExec.exe	41
PID 2548 wrote to memory of 580	2548	MsiExec.exe	41
PID 2548 wrote to memory of 580	2548	MsiExec.exe	41
PID 2548 wrote to memory of 1276	2548	MsiExec.exe	42
PID 2548 wrote to memory of 1276	2548	MsiExec.exe	42
PID 2548 wrote to memory of 1276	2548	MsiExec.exe	42

C:\Users\Admin\AppData\Local\Temp\2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-27_5df851563272f6928d8ec89699001376_floxif_icedid.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe /x {D9FB7F91-9687-4B09-894D-072903CADEA4} /passive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2520
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5C9FC022CFB6D008521CA824DF27FCC3 C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C5A2382C-76BB-47DA-896B-3A743DD5DFB3}
    3⤵
    - Executes dropped EXE
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{89CDB378-8C94-4DAB-9F80-26DCB1BBB218}
    3⤵
    - Executes dropped EXE
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{415C1B08-2672-4196-B2A2-D25F857C51CA}
    3⤵
    - Executes dropped EXE
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5FD096F3-BA3F-4075-BA78-1A8D759DEDB6}
    3⤵
    - Executes dropped EXE
    PID:320
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{17B7F7E7-A60F-46E8-81A1-16D7FF561700}
    3⤵
    - Executes dropped EXE
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7129DE5-4325-4B80-8C85-F39D7E3885D8}
    3⤵
    - Executes dropped EXE
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{05E2A45B-BD15-4657-BF08-8347E2C593C9}
    3⤵
    - Executes dropped EXE
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{65383590-550E-4F32-9321-C53B2D1E6DF9}
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A044219D-246B-41AE-BFE7-DE20688303F1}
    3⤵
    - Executes dropped EXE
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F781B6D4-2CE7-4CCB-90F8-48A74173CC74}
    3⤵
    - Executes dropped EXE
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A091CE1-C14F-431E-AEDF-251E666A5A16}
    3⤵
    - Executes dropped EXE
    PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI35C0.tmp

Filesize
1.3MB

MD5
ca189a2b762e64d61303bfd4d88fd0a6

SHA1
13bf55664fb0345d3931458f75b6039c1213f46a

SHA256
dc5094ceb682772d95b427230bfb1af29df90ef67fe8afb08c43a0f2af3f880a

SHA512
31bb912f5c5f6cd6577f8529fcbbfc0bf4d0bda5e1904772c57cd942520db7dd1c10657e8695d16418a05763202af1034e4e47a7db8a8be618b9e330e8a544bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi

Filesize
8.9MB

MD5
5f831b2f8e81b85816b0aa5c68e7ccd4

SHA1
b61801f297babc069a7f4e2f0b4d75ff5cfb52fb

SHA256
69ca8f3f6deb1bb510d259e99f51dc7f3d96d5273237e6177903dc97eba9a2be

SHA512
94e0b3b1ffbd73869fe394780b55a72a8c9b725ade0f0b995f1d6154e31db3ddf1f895137fa1313133f060dae8ad6f7a7834d8785b004c5a575594c42f286520

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISBEW64.exe

Filesize
146KB

MD5
c3b2acc07bb0610405fc786e3432bef9

SHA1
333d5f2b55bd00ad4311ba104af7db984f953924

SHA256
9acc6cb5d01a4e4dbc92c8774c6999fab5f0e49f097e83098ba740842f5a2894

SHA512
2438e5dd11c8322101d9dc2d0f89ed0b1fc3cb5a65f644a1cf07f4c5a7f353c648e715fb910e09a444b623b3384eecd628e312608bcec63aa3b0107630df32bd

Download Submit
\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\ISRT.dll

Filesize
260KB

MD5
a93f625ef42b54c2b0f4d38201e67606

SHA1
cbfebc1f736ccfc65562ede79a5ae1a8afb116a1

SHA256
e91a865c3d60d9d0bce5d5a0a2f551c5e032d5bc13bc40f85091ce46d38064e0

SHA512
805f0d535022de3d03aa191239fd90c54f2f6745bf02e0ce9cbe59ea34eecac7f9ebb600864c7cbcad5d011fa61bdb5b65889136617edc44178f87bd3970b198

Download Submit
\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\_isres_0x0409.dll

Filesize
540KB

MD5
d6bbf7ff6984213c7f1f0f8f07c51e6a

SHA1
cfe933fc3b634f7333adec7ec124c14e9d19ac21

SHA256
6366e18a8cbf609c9573f341004e5c2725c23a12973affa90ee7bcc7934ae1b2

SHA512
a1364c96848f54b241c8e92ed1887ca599255c8046e31af11cd4b0b23d97c00243808dff9086a536c0084d6815223685283844a9e27f2c20c4d3b85a794a9e9d

Download Submit
\Users\Admin\AppData\Local\Temp\{FA64D265-9607-49BD-BCFF-10F8E2175F92}\_isres_0x0409.dll.tmp

Filesize
616KB

MD5
a4e553e65ccced74ebe9a9e50d8d4552

SHA1
b68a31e1a0c108da797e8a0199fea720a485eaa9

SHA256
0cc4ce57e18cf207abc3e0c33a911af7002925ebbfd935bc44ade9ee32b83418

SHA512
c31ddf72d487789e0d054a930b5c797a51ea6040ac536dce084c26b2206984abadeaa08e9a4dcac6f3dcc2b2b655d6d332d53caa20f48f57ef93c150681a0464

Download Submit
memory/2548-45-0x00000000002E0000-0x00000000002E2000-memory.dmp

Filesize
8KB

Download
memory/2548-44-0x0000000002AE0000-0x0000000002B69000-memory.dmp

Filesize
548KB

Download
memory/2548-17-0x0000000000210000-0x0000000000212000-memory.dmp

Filesize
8KB

Download
memory/2548-41-0x0000000003060000-0x0000000003107000-memory.dmp

Filesize
668KB

Download
memory/2548-16-0x0000000010000000-0x00000000101B5000-memory.dmp

Filesize
1.7MB

Download
memory/2548-71-0x0000000000210000-0x0000000000212000-memory.dmp

Filesize
8KB

Download
memory/2548-63-0x0000000010000000-0x00000000101B5000-memory.dmp

Filesize
1.7MB

Download
memory/2548-64-0x0000000003060000-0x0000000003107000-memory.dmp

Filesize
668KB

Download
memory/2836-68-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2836-65-0x0000000077480000-0x00000000774B5000-memory.dmp

Filesize
212KB

Download
memory/2836-69-0x0000000077480000-0x00000000774B5000-memory.dmp

Filesize
212KB

Download
memory/2836-62-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2836-77-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2836-82-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2836-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2836-89-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2836-6-0x0000000000400000-0x0000000001A2A000-memory.dmp

Filesize
22.2MB

Download
memory/2836-98-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download