Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/03/2024, 15:21
General
- Target SecuriteInfo.com.Win64.PWSX-gen.3038.29891.exe
- Size 390KB
- Sample240329-sra71sbc9v
- SHA256 56768dc2486a0eadfb82e3df6436434d1b6502d542fe6c41e2b52aae948b140f
Malware Config
Extracted
-
stealc
-
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Extracted
-
vidar
-
8.6
-
22d12fb91f01647fe2107fec81f0cc22
-
https://steamcommunity.com/profiles/76561199658817715
-
https://t.me/sa9ok
-
profile_id_v2
22d12fb91f01647fe2107fec81f0cc22
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Signatures
- Detect Vidar Stealer 2 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 25 IoCs
- Modifies firewall policy service 2 TTPs 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 11 IoCs
- Executes dropped EXE 26 IoCs
- Loads dropped DLL 12 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Drops file in System32 directory 20 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 10 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.3038.29891.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.3038.29891.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\kfUgSxcWOxk4KSCTSzsML2eG.exe"C:\Users\Admin\Pictures\kfUgSxcWOxk4KSCTSzsML2eG.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u2to.0.exe"C:\Users\Admin\AppData\Local\Temp\u2to.0.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GIEGHJEGHJ.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\GIEGHJEGHJ.exe"C:\Users\Admin\AppData\Local\Temp\GIEGHJEGHJ.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\GIEGHJEGHJ.exe7⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30008⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 26925⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2to.1.exe"C:\Users\Admin\AppData\Local\Temp\u2to.1.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 16164⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\cVsd8XPs5pfawwDmpZlfbyAJ.exe"C:\Users\Admin\Pictures\cVsd8XPs5pfawwDmpZlfbyAJ.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\cVsd8XPs5pfawwDmpZlfbyAJ.exe"C:\Users\Admin\Pictures\cVsd8XPs5pfawwDmpZlfbyAJ.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\o8gEKTTmxC7af0XCYeWDet7H.exe"C:\Users\Admin\Pictures\o8gEKTTmxC7af0XCYeWDet7H.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\o8gEKTTmxC7af0XCYeWDet7H.exe"C:\Users\Admin\Pictures\o8gEKTTmxC7af0XCYeWDet7H.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\CVyFgTO25alNb0EZALzIkTVd.exe"C:\Users\Admin\Pictures\CVyFgTO25alNb0EZALzIkTVd.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\CVyFgTO25alNb0EZALzIkTVd.exe"C:\Users\Admin\Pictures\CVyFgTO25alNb0EZALzIkTVd.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\xI6wGFRXRZLva7ra8YmwuY87.exe"C:\Users\Admin\Pictures\xI6wGFRXRZLva7ra8YmwuY87.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\xI6wGFRXRZLva7ra8YmwuY87.exe"C:\Users\Admin\Pictures\xI6wGFRXRZLva7ra8YmwuY87.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\vrtToq5rSUdgXGh4pUYaWDIu.exe"C:\Users\Admin\Pictures\vrtToq5rSUdgXGh4pUYaWDIu.exe"3⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Pictures\k4Wowr4MNd51y2lX20jwm1IW.exe"C:\Users\Admin\Pictures\k4Wowr4MNd51y2lX20jwm1IW.exe" --silent --allusers=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\k4Wowr4MNd51y2lX20jwm1IW.exeC:\Users\Admin\Pictures\k4Wowr4MNd51y2lX20jwm1IW.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x298,0x29c,0x2a0,0x278,0x2a4,0x6e11e1d0,0x6e11e1dc,0x6e11e1e84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\k4Wowr4MNd51y2lX20jwm1IW.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\k4Wowr4MNd51y2lX20jwm1IW.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Pictures\k4Wowr4MNd51y2lX20jwm1IW.exe"C:\Users\Admin\Pictures\k4Wowr4MNd51y2lX20jwm1IW.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4180 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240329152118" --session-guid=7d309787-c4ab-4f07-b0bb-8c8c081b8bb3 --server-tracking-blob=OWI3YjcyNmI4ZWIxZTJiN2FiYzA5NzY1ZjIzYjdmNWNhNjQ4ODAyYzJkMjQyODc1ZmM3MzE0Nzc5ZjZjMjk3Nzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N183ODkiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE3MjU2NjkuNTQxOSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N183ODkiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjhmOGJiY2MyLWNmZjktNDQwYy05YjgxLWUxOTYwYzAxZjljNiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=68050000000000004⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\k4Wowr4MNd51y2lX20jwm1IW.exeC:\Users\Admin\Pictures\k4Wowr4MNd51y2lX20jwm1IW.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2a4,0x2a8,0x2ac,0x274,0x2b0,0x6d79e1d0,0x6d79e1dc,0x6d79e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291521181\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291521181\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291521181\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291521181\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291521181\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291521181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0xac0040,0xac004c,0xac00585⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\Pictures\4srEMRkx0KMlHpC6ZkEO2SC2.exe"C:\Users\Admin\Pictures\4srEMRkx0KMlHpC6ZkEO2SC2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 21525⤵
- Program crash
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3660 -ip 36601⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5604 -ip 56041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3396 -ip 33961⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
nss3.dll
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
additional_file0.tmp
assistant_installer.exe
dbgcore.dll
dbghelp.dll
opera_package
Opera_installer_2403291521180114180.dll
Protect544cd51a.dll
__PSScriptPolicyTest_121m4njv.sp2.ps1
ioloDMLog.txt
u2to.0.exe
u2to.1.exe
settings.dat
2kbohsh15lDBHf79sFqUhzeM.exe
4srEMRkx0KMlHpC6ZkEO2SC2.exe
cVsd8XPs5pfawwDmpZlfbyAJ.exe
jsVzJ9rJayhTkY1VVWbHaFx1.exe
k4Wowr4MNd51y2lX20jwm1IW.exe
kfUgSxcWOxk4KSCTSzsML2eG.exe
o8gEKTTmxC7af0XCYeWDet7H.exe
ofNgdf4DBE0WK5oscl43k9UQ.exe
vrtToq5rSUdgXGh4pUYaWDIu.exe
xI6wGFRXRZLva7ra8YmwuY87.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
gpt.ini
memory/668-124-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/668-6-0x0000000000400000-0x0000000000408000-memory.dmp
memory/668-7-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/668-190-0x0000000002C60000-0x0000000002C70000-memory.dmp
memory/668-8-0x0000000002C60000-0x0000000002C70000-memory.dmp
memory/1588-206-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/1588-162-0x00007FF7D4E40000-0x00007FF7D5857000-memory.dmp
memory/1588-142-0x00007FF7D4E40000-0x00007FF7D5857000-memory.dmp
memory/1588-184-0x00007FFF71020000-0x00007FFF710DE000-memory.dmp
memory/1588-144-0x00007FF7D4E40000-0x00007FF7D5857000-memory.dmp
memory/1588-189-0x00007FF7D4E40000-0x00007FF7D5857000-memory.dmp
memory/1588-146-0x00007FF7D4E40000-0x00007FF7D5857000-memory.dmp
memory/1588-187-0x00007FFF00000000-0x00007FFF00002000-memory.dmp
memory/1588-433-0x00007FF7D4E40000-0x00007FF7D5857000-memory.dmp
memory/1588-149-0x00007FFF00030000-0x00007FFF00031000-memory.dmp
memory/1588-163-0x00007FF7D4E40000-0x00007FF7D5857000-memory.dmp
memory/1588-147-0x00007FFF6F0B0000-0x00007FFF6F379000-memory.dmp
memory/1588-154-0x00007FF7D4E40000-0x00007FF7D5857000-memory.dmp
memory/1752-706-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1752-197-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/1752-567-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1752-441-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2364-0-0x000001925BF00000-0x000001925BF0C000-memory.dmp
memory/2364-2-0x00000192763D0000-0x00000192763E0000-memory.dmp
memory/2364-5-0x0000019277250000-0x00000192772AE000-memory.dmp
memory/2364-9-0x00007FFF539D0000-0x00007FFF54491000-memory.dmp
memory/2364-4-0x0000019276380000-0x000001927639E000-memory.dmp
memory/2364-1-0x00007FFF539D0000-0x00007FFF54491000-memory.dmp
memory/2364-3-0x00000192772D0000-0x0000019277346000-memory.dmp
memory/2884-484-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2884-338-0x00000000029F0000-0x0000000002DF5000-memory.dmp
memory/2884-330-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2884-86-0x00000000029F0000-0x0000000002DF5000-memory.dmp
memory/2884-98-0x0000000002E00000-0x00000000036EB000-memory.dmp
memory/2884-106-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/3032-133-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/3032-329-0x00000000078B0000-0x00000000078F4000-memory.dmp
memory/3032-137-0x00000000033B0000-0x00000000033C0000-memory.dmp
memory/3032-123-0x0000000003360000-0x0000000003396000-memory.dmp
memory/3032-128-0x0000000005C10000-0x0000000006238000-memory.dmp
memory/3032-186-0x0000000006540000-0x0000000006894000-memory.dmp
memory/3032-148-0x0000000005B80000-0x0000000005BA2000-memory.dmp
memory/3032-151-0x00000000033B0000-0x00000000033C0000-memory.dmp
memory/3064-103-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/3064-88-0x0000000002A00000-0x0000000002E06000-memory.dmp
memory/3064-102-0x0000000002E10000-0x00000000036FB000-memory.dmp
memory/3064-360-0x0000000002A00000-0x0000000002E06000-memory.dmp
memory/3064-331-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/3064-479-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/3396-119-0x0000000002160000-0x0000000002187000-memory.dmp
memory/3396-183-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/3396-355-0x0000000000400000-0x000000000063B000-memory.dmp
memory/3396-120-0x0000000000400000-0x000000000063B000-memory.dmp
memory/3396-491-0x0000000000400000-0x000000000063B000-memory.dmp
memory/3396-122-0x0000000000780000-0x0000000000880000-memory.dmp
memory/3532-117-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/3532-486-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/3532-332-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/3532-121-0x00000000029A0000-0x0000000002DA1000-memory.dmp
memory/3660-194-0x0000000000690000-0x0000000000790000-memory.dmp
memory/3660-56-0x0000000000400000-0x0000000000563000-memory.dmp
memory/3660-55-0x0000000002240000-0x00000000022AE000-memory.dmp
memory/3660-54-0x0000000000690000-0x0000000000790000-memory.dmp
memory/3660-262-0x0000000000400000-0x0000000000563000-memory.dmp
memory/4188-181-0x0000000005BA0000-0x0000000005C06000-memory.dmp
memory/4188-143-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/4188-248-0x00000000063E0000-0x000000000642C000-memory.dmp
memory/4188-145-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/4196-340-0x00000000082D0000-0x000000000894A000-memory.dmp
memory/4196-139-0x0000000005500000-0x0000000005510000-memory.dmp
memory/4196-351-0x0000000007E30000-0x0000000007E62000-memory.dmp
memory/4196-339-0x0000000007BD0000-0x0000000007C46000-memory.dmp
memory/4196-344-0x0000000007C70000-0x0000000007C8A000-memory.dmp
memory/4196-359-0x000000006E210000-0x000000006E25C000-memory.dmp
memory/4196-361-0x000000006E790000-0x000000006EAE4000-memory.dmp
memory/4196-138-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/4196-239-0x00000000068C0000-0x00000000068DE000-memory.dmp
memory/4444-182-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/4444-141-0x0000000002ED0000-0x0000000002EE0000-memory.dmp
memory/4444-136-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/4444-140-0x0000000002ED0000-0x0000000002EE0000-memory.dmp
memory/5032-115-0x0000000002990000-0x0000000002D8B000-memory.dmp
memory/5032-337-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5032-118-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5032-478-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5428-324-0x0000000000140000-0x00000000005DC000-memory.dmp
memory/5428-325-0x0000000004E70000-0x0000000004F0C000-memory.dmp
memory/5428-336-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/5604-943-0x0000000000400000-0x0000000000644000-memory.dmp
memory/5604-947-0x0000000000400000-0x0000000000644000-memory.dmp
memory/5720-639-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5720-900-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5720-984-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5740-916-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5740-1039-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5740-641-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5752-905-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5752-640-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5752-1006-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5788-919-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5788-642-0x0000000000400000-0x0000000000D1C000-memory.dmp