latentbot | 88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe
Size 2.3MB
Sample240410-pla4aafe35
SHA256 88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7
MD5 93f53bf0f3db53aebcad54a4aa8cc833
SHA1 1dfeb7e7f97c6ea5176eb6b761b46f98af52cacd
SHA512 a4e58ef1072a72158af4f25fc28074b2f66106144e1b098f04996b6720e4a439acec9943373356cfa157781b2044313ba79b2d9ed6d925af9304440629ee9949
SSDEEP 49152:CCjCsNiNMeQ1BK1u4v6ZPUHBPYJSQzt/BDtVK1h0KLF3ITc9qW:xYMx9OYJSQRRtw0KVd9F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot trojan upx

Malware Config

Extracted

Family

latentbot

researchplanet.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002324a-37.dat	Nirsoft

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	55_Maoists_Killed_by_C60_Commandos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	MikaelAbelsen.exe

Executes dropped EXE 5 IoCs

pid	Process
448	55_Maoists_Killed_by_C60_Commandos.exe
4076	valentinamarinovic.exe
560	MikaelAbelsen.exe
3712	nadicamarusic.exe
1320	EdacV.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4816-246-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4816-247-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4816-250-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2368	schtasks.exe
2960	schtasks.exe
2348	schtasks.exe
3816	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	valentinamarinovic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3188	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
560	MikaelAbelsen.exe
560	MikaelAbelsen.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe
3188	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2864	2676	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe	87
PID 2676 wrote to memory of 2864	2676	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe	87
PID 2676 wrote to memory of 2864	2676	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe	87
PID 2676 wrote to memory of 448	2676	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe	88
PID 2676 wrote to memory of 448	2676	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe	88
PID 2676 wrote to memory of 448	2676	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe	88
PID 448 wrote to memory of 4076	448	55_Maoists_Killed_by_C60_Commandos.exe	91
PID 448 wrote to memory of 4076	448	55_Maoists_Killed_by_C60_Commandos.exe	91
PID 448 wrote to memory of 4076	448	55_Maoists_Killed_by_C60_Commandos.exe	91
PID 4076 wrote to memory of 4912	4076	valentinamarinovic.exe	92
PID 4076 wrote to memory of 4912	4076	valentinamarinovic.exe	92
PID 4076 wrote to memory of 4912	4076	valentinamarinovic.exe	92
PID 2676 wrote to memory of 560	2676	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe	90
PID 2676 wrote to memory of 560	2676	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe	90
PID 2676 wrote to memory of 560	2676	88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe	90
PID 4912 wrote to memory of 2948	4912	cscript.exe	94
PID 4912 wrote to memory of 2948	4912	cscript.exe	94
PID 4912 wrote to memory of 2948	4912	cscript.exe	94
PID 4912 wrote to memory of 3928	4912	cscript.exe	96
PID 4912 wrote to memory of 3928	4912	cscript.exe	96
PID 4912 wrote to memory of 3928	4912	cscript.exe	96
PID 4912 wrote to memory of 1328	4912	cscript.exe	98
PID 4912 wrote to memory of 1328	4912	cscript.exe	98
PID 4912 wrote to memory of 1328	4912	cscript.exe	98
PID 4912 wrote to memory of 4184	4912	cscript.exe	100
PID 4912 wrote to memory of 4184	4912	cscript.exe	100
PID 4912 wrote to memory of 4184	4912	cscript.exe	100
PID 4912 wrote to memory of 2092	4912	cscript.exe	101
PID 4912 wrote to memory of 2092	4912	cscript.exe	101
PID 4912 wrote to memory of 2092	4912	cscript.exe	101
PID 4912 wrote to memory of 2288	4912	cscript.exe	104
PID 4912 wrote to memory of 2288	4912	cscript.exe	104
PID 4912 wrote to memory of 2288	4912	cscript.exe	104
PID 3928 wrote to memory of 3712	3928	cmd.exe	106
PID 3928 wrote to memory of 3712	3928	cmd.exe	106
PID 3928 wrote to memory of 3712	3928	cmd.exe	106
PID 1328 wrote to memory of 2368	1328	cmd.exe	107
PID 1328 wrote to memory of 2368	1328	cmd.exe	107
PID 1328 wrote to memory of 2368	1328	cmd.exe	107
PID 2948 wrote to memory of 3188	2948	cmd.exe	108
PID 2948 wrote to memory of 3188	2948	cmd.exe	108
PID 2948 wrote to memory of 3188	2948	cmd.exe	108
PID 4184 wrote to memory of 2960	4184	cmd.exe	109
PID 4184 wrote to memory of 2960	4184	cmd.exe	109
PID 4184 wrote to memory of 2960	4184	cmd.exe	109
PID 2092 wrote to memory of 2348	2092	cmd.exe	110
PID 2092 wrote to memory of 2348	2092	cmd.exe	110
PID 2092 wrote to memory of 2348	2092	cmd.exe	110
PID 2288 wrote to memory of 3816	2288	cmd.exe	123
PID 2288 wrote to memory of 3816	2288	cmd.exe	123
PID 2288 wrote to memory of 3816	2288	cmd.exe	123
PID 3188 wrote to memory of 2336	3188	AcroRd32.exe	112
PID 3188 wrote to memory of 2336	3188	AcroRd32.exe	112
PID 3188 wrote to memory of 2336	3188	AcroRd32.exe	112
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114
PID 2336 wrote to memory of 836	2336	RdrCEF.exe	114

C:\Users\Admin\AppData\Local\Temp\88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe
"C:\Users\Admin\AppData\Local\Temp\88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FrederikkeKreutzmann.vbs"
  2⤵
  PID:2864
- C:\Users\Admin\Desktop\55_Maoists_Killed_by_C60_Commandos.exe
  "C:\Users\Admin\Desktop\55_Maoists_Killed_by_C60_Commandos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Shunnothe\valentinamarinovic.exe
    "C:\Shunnothe\valentinamarinovic.exe" /run
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\system32\cscript.exe" //B VinkaNikolic.vbs
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Shunnothe\Summary.pdf
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Shunnothe\Summary.pdf"
        6⤵
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=09050FF1F7B52C1CCBEA9E1A2DA600A4 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        8⤵
        
        PID:836
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C67EDFB2491AA5049ABA7EDE7CC00C6F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C67EDFB2491AA5049ABA7EDE7CC00C6F --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
        8⤵
        
        PID:3156
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CF0BB67AF71BBA8C33AE080127943465 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CF0BB67AF71BBA8C33AE080127943465 --renderer-client-id=4 --mojo-platform-channel-handle=2188 --allow-no-sandbox-job /prefetch:1
        8⤵
        
        PID:3120
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=58179373EE20B44C20DE6D44803DD480 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        8⤵
        
        PID:4408
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=386748C3F46F1BA89227B29E86411460 --mojo-platform-channel-handle=2712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        8⤵
        
        PID:3656
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4BC3838F37244B4184611A85626DC41 --mojo-platform-channel-handle=2792 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        8⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Shunnothe\nadicamarusic x 1605.rar -pNikaMatijevic
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3928
      - C:\Shunnothe\nadicamarusic.exe
        
        C:\Shunnothe\nadicamarusic x 1605.rar -pNikaMatijevic
        6⤵
        Executes dropped EXE
        
        PID:3712
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC MINUTE /MO 16 /TN Naturawroveh /TR C:\Shunnothe\DoraIvanec.exe /F
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1328
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /SC MINUTE /MO 16 /TN Naturawroveh /TR C:\Shunnothe\DoraIvanec.exe /F
        6⤵
        Creates scheduled task(s)
        
        PID:2368
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 1 /TN Naturawrovei /TR C:\Shunnothe\FranoNovak.exe /F
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4184
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /SC HOURLY /MO 1 /TN Naturawrovei /TR C:\Shunnothe\FranoNovak.exe /F
        6⤵
        Creates scheduled task(s)
        
        PID:2960
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 2 /TN Naturawrovej /TR C:\Shunnothe\MilenaZagorec.exe /F
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2092
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /SC HOURLY /MO 2 /TN Naturawrovej /TR C:\Shunnothe\MilenaZagorec.exe /F
        6⤵
        Creates scheduled task(s)
        
        PID:2348
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 4 /TN Naturawrovek /TR C:\Shunnothe\MilenkoVukelic.exe /F
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2288
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /SC HOURLY /MO 4 /TN Naturawrovek /TR C:\Shunnothe\MilenkoVukelic.exe /F
        6⤵
        Creates scheduled task(s)
        
        PID:3816
- C:\Users\Admin\Desktop\MikaelAbelsen.exe
  "C:\Users\Admin\Desktop\MikaelAbelsen.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:560
- - C:\Users\Admin\AppData\Local\Temp\EdacV.exe
    "C:\Users\Admin\AppData\Local\Temp\EdacV.exe"
    3⤵
    - Executes dropped EXE
    PID:1320
- - C:\Windows\SysWOW64\dllhost.exe
    dllhost.exe
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\dllhost.exe
    dllhost.exe
    3⤵
    PID:4816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1605.rar

Path C:\Shunnothe\1605.rar
Size 1.5MB
SHA256 a749584abe0779415d099f8560c84ec84f70e4952510c196234029ba966696eb
MD5 2e7dfc222c0e46c22abdb92bbedc34d7
SHA1 9a49fc49f8b2aa0ff487b10b57713736f8edc789
SHA512 63708cb4b3b851d7420cad2c4e0cb20c6e87c39f1cb64dfe79541c6c10646ffb40361bfa0b9392c48a915a31ed887014c4fa463469dc9332cf9dec9a5ce1f613
SSDEEP 24576:q5Clapo9sWxJ1l2CZcF+Zk77PogUwDDaZUPxzYdzAyXl9+SLIiQPF2Wjoo/YaC:qGapTWn1l2ClZuboCDaZUPkHHjy2hN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Summary.pdf

Path C:\Shunnothe\Summary.pdf
Size 109KB
SHA256 17d17b728180a204f68fd47e369d64258a78628b8741404450b77838d92fb90d
MD5 47bb8648f9935b8af8c3e8cf90b16da5
SHA1 fe53dbc135e27abf6a5337f89cb1b079625f81a6
SHA512 5b38cc0a7d9ab5fd7f258051df838af3576a71a3841342401ebf3edd1d58faa3dc67b24113e59a763e41fb638341f1958dce1cf4ef5d12971f214d81ae572f24
SSDEEP 3072:t4XKRNF660PjaKyvy0DfFHEFLdDKGw1+J0CfdNK:t4XKRNQJw1DNEpdDKj1+zfdNK
MD5 SHA1 SHA512 SSDEEP

Submit Download

VinkaNikolic.vbs

Path C:\Shunnothe\VinkaNikolic.vbs
Size 62KB
SHA256 3d4db5858e00d10cee7a32e0efbde968b5cee96ea7aaa376980d2331b30b35c3
MD5 2c626cafaf09381689ee8f8187e7a39d
SHA1 bea8838399341403baa31120b57f85fa8c0ab0e4
SHA512 694cc1e4b9589b234ef5636e00433bdaa02ae7b5decd6c72ba8c2e004d0f9282ff06047d28ad742117c7a8552b00241f62c79bcb8662a1287b8124f72058460a
SSDEEP 1536:CVx89FVNt+35vr8ZsVATOf1/fRfNdfdfRqfVfSqjF6hp:+0w6O3ptqjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

nadicamarusic.exe

Path C:\Shunnothe\nadicamarusic.exe
Size 193KB
SHA256 14e2fb9cff35dfa28550ea823b4106c7015ac6888373f0ff740f97e91b72c8b3
MD5 578da05d920d3c450e3f8ba5ecc2afb5
SHA1 5a6c4dd5f7aea02fa33b0af044fb517151c20dfe
SHA512 cc8cf968e9c1ce5f9dec9ddefd3aa2ab6510a76c75f8afc797326aefec5e6a2a44a13278ae4b8566a368e35266d7d06840a6e9decddc9283504dbd7b8af2eba3
SSDEEP 6144:crePjZpzGUikiabl8J0YWbPVC2MevqBThj7k:crePjZpzQn9ibPVCHk
MD5 SHA1 SHA512 SSDEEP

Submit Download

valentinamarinovic.cfg

Path C:\Shunnothe\valentinamarinovic.cfg
Size 801B
SHA256 2439b4c3da1e778e51906a2b3f00389e84d00304f0519049596fda77602858e9
MD5 eba75b9f8369727776ab636681dbcf85
SHA1 31d9f38ea39043d07a0b3120841fb109e5b55539
SHA512 9ae50ba1fc3ffc6f6edb90a3a03e26969cc248bf55f49ad4a81385c0c97a58a13dcc2275833eb7c12945cc55b636e7ac2c4b8e921eaad1e77ce85642cf590ee5
MD5 SHA1 SHA512

Submit Download

valentinamarinovic.exe

Path C:\Shunnothe\valentinamarinovic.exe
Size 88KB
SHA256 f21ec80032f5dabef2d6ad17753b0f2f733fdea7f8af64f82946bdebc68c0d50
MD5 4d9c5b2b2d6237a768fc843d329763f4
SHA1 513b0c4fafc306f65960b559b615d2dfac0e7bd3
SHA512 45cd3af906e39dd668eb630dba76bc31b89372166845092633582f9b3d8b3c6d79f3ea9f433b22cba023983bf09918466cb1b021adfaeec1dac2e9c28619dce2
SSDEEP 1536:RJBZe+tl6Cks5LdCipcC2E2gwTxF2j++YC9sPbiT:hzn6CnldCipcQDwT6j++YCiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 c0884c27da8954f356f2f399af0689990241459c6fc3ec2a655633dfbce0cd91
MD5 09bf2afb3dd799084410bae3ce5d8774
SHA1 69c9d1570ecc5f116971e9907ab111e15d5e1cdc
SHA512 26ad0509d68f430bed58e19470a1cc99b52e38537ee0bf86997b3320bb964d2fbee8468112f562476e8f3d22f8387c7b79ff5184479a92a1ff7c87fbba240f2c
SSDEEP 384:ye+dThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:9+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

EdacV.exe

Path C:\Users\Admin\AppData\Local\Temp\EdacV.exe
Size 28KB
SHA256 de3196627bc810dd22f58dee65747baca25485ccd0cee2701055ece1058f1c6a
MD5 3ca2bb895e204478c7a4c9baf70970ce
SHA1 1b376c177c5629c0e620431af1a9e8c16bf23d53
SHA512 85684d681e740f25ea30b0a50dbc15715a21570b4bbaa6f6b5ec8a1e1291a23b68e856fef652430bf673b1482b64a3fedcdd846d4c270caf4e32004826716276
SSDEEP 384:AXk5OzwZILYdhMBdMtazagzp+gHGC7Kf2GR7gjNetJqfNDu1TuoVqzuNakWm05bW:AYqLBBzZd+QGJfFgjNbfNa1TDwDsO
MD5 SHA1 SHA512 SSDEEP

Submit Download

55_Maoists_Killed_by_C60_Commandos.exe

Path C:\Users\Admin\Desktop\55_Maoists_Killed_by_C60_Commandos.exe
Size 1.8MB
SHA256 a533b3aa47de8fcbad83ab8df4a2d069ad6ef38e69c507ec87a6f5be1c68c5c8
MD5 fc88e8b0ff629d3a0c467b40ed0d97a9
SHA1 40fe9dcbed87fc052a31022e0c395096e164c58b
SHA512 966ed14ea6cf5d06494026ea0183b2e4f3524318f28a2c382677b6e4dc5044c2efccddd65718688d16235898e79b2cd24d4c4663992d393d6bf68f7e1cc230a2
SSDEEP 49152:2gWGapTWn1l2ClZuboCDaZUPkHHjy2hVeUVl0:3WGapC1nlZuboEamQHu4eY0
MD5 SHA1 SHA512 SSDEEP

Submit Download

FrederikkeKreutzmann.vbs

Path C:\Users\Admin\Desktop\FrederikkeKreutzmann.vbs
Size 12KB
SHA256 77aa63f4bcf72167f771e8103df61c82633e8323716a66dfd744f7262914b68f
MD5 271595162d4ee421c4ba346f7deef2f6
SHA1 3ded32c56e78df7862a0ef7ff308904c5d8794a7
SHA512 26da1c37730e668c640a7b9156defbaf02db5951699528e678f3c643257ea9bb6bb6736d436a5670065fc2043e09320250b111b26a25b118d5a9afd12866a324
SSDEEP 384:MP4k6nAj6wLjLRLr4k6nAj6MdxP4k6nAj6xLRLJL7LhLV4k6nAj6MZ:Y4k6nAjd4k6nAjx4k6nAjw4k6nAjX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MikaelAbelsen.exe

Path C:\Users\Admin\Desktop\MikaelAbelsen.exe
Size 65.8MB
SHA256 506c46418f1a14e5254f666d963775618ec19f9a914cd5749033a666d3740746
MD5 f57aa097c73c503b3b707820ee31c558
SHA1 eaed469f127cd81c93762413503a8c5a8deafb41
SHA512 669e3050ceb18f22152f5fe3b0d85a109d212b695506bc3c2a5fd1e0c379044113684e62ed5c6fd929b4e1d84073995072a5e938afbf0a1f45229ff434184f19
SSDEEP 12288:fge0wNtPo3st+TrRxSN9VXBMqj+SrSxuJw3DYOlj+KXwF3:Ie0wNtQ3sYTrRxSTPCS2xeEYOj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/560-101-0x0000000077342000-0x0000000077343000-memory.dmp

Download

memory/560-96-0x00000000064E0000-0x000000000655B000-memory.dmp

Download

memory/560-206-0x00000000064E0000-0x000000000655B000-memory.dmp

Download

memory/560-255-0x00000000064E0000-0x000000000655B000-memory.dmp

Download

memory/3188-203-0x000000000AED0000-0x000000000B17B000-memory.dmp

Download

memory/3712-64-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4816-248-0x0000000077342000-0x0000000077343000-memory.dmp

Download

memory/4816-247-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4816-249-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/4816-250-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4816-253-0x0000000077343000-0x0000000077344000-memory.dmp

Download

memory/4816-246-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4816-254-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/4816-270-0x0000000077342000-0x0000000077343000-memory.dmp

Download