smokeloader | aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220.exe
Size

735KB
MD5

fb9c4b9a277d1bec79c5d72eb92048ae
SHA1

cef6d340e836b1deb4be733e67273d1a9a328a35
SHA256

aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220
SHA512

f5b1dd2da2d2417c7f54f339cb4a8ad8ffb099e758ec4521a1781507e9d71a166ea967ca425e1cf735c5b8aee7a207a98265a67e4067ab8a3bccc232f3d365d8
SSDEEP

12288:ZFs228hxeGgy74QrVA2s/gUZj9yypbStAbQwxTnrmyP6iWOFhLKXMht7numB6804:s2/TD4QrsgYRyyItAHrmyfT3mCnT6804

Score

10^/10

smokeloader pub2 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 42 IoCs

Processes:

Whale.pif

description	pid	process	target process
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE
PID 1816 created 3424	1816	Whale.pif	Explorer.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220.exe

Executes dropped EXE 42 IoCs

Processes:

Whale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pifWhale.pif

pid	process
1816	Whale.pif
2432	Whale.pif
2500	Whale.pif
620	Whale.pif
1420	Whale.pif
4348	Whale.pif
4520	Whale.pif
2960	Whale.pif
908	Whale.pif
1480	Whale.pif
3948	Whale.pif
1632	Whale.pif
2688	Whale.pif
1164	Whale.pif
1284	Whale.pif
4540	Whale.pif
4168	Whale.pif
836	Whale.pif
880	Whale.pif
8	Whale.pif
4672	Whale.pif
3784	Whale.pif
4156	Whale.pif
1344	Whale.pif
2776	Whale.pif
4408	Whale.pif
2924	Whale.pif
3772	Whale.pif
1404	Whale.pif
1356	Whale.pif
2512	Whale.pif
2884	Whale.pif
4328	Whale.pif
4924	Whale.pif
2116	Whale.pif
3464	Whale.pif
4548	Whale.pif
4032	Whale.pif
4052	Whale.pif
2760	Whale.pif
1068	Whale.pif
4584	Whale.pif

Suspicious use of SetThreadContext 1 IoCs

Processes:

Whale.pif

description pid process target process

PID 1816 set thread context of 220 1816 Whale.pif TapiUnattend.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 1816 set thread context of 220	1816	Whale.pif	TapiUnattend.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

TapiUnattend.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TapiUnattend.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TapiUnattend.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TapiUnattend.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

3084 tasklist.exe
4472 tasklist.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

316 PING.EXE

pid	process
3084	tasklist.exe
4472	tasklist.exe

pid	process
316	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Whale.pif

pid	process
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif
1816	Whale.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tasklist.exetasklist.exe

description pid process

Token: SeDebugPrivilege 3084 tasklist.exe
Token: SeDebugPrivilege 4472 tasklist.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Whale.pif

pid process

1816 Whale.pif
1816 Whale.pif
1816 Whale.pif
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Whale.pif

pid process

1816 Whale.pif
1816 Whale.pif
1816 Whale.pif

description	pid	process
Token: SeDebugPrivilege	3084	tasklist.exe
Token: SeDebugPrivilege	4472	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220.execmd.exeWhale.pif

description	pid	process	target process
PID 4612 wrote to memory of 3652	4612	aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220.exe	cmd.exe
PID 4612 wrote to memory of 3652	4612	aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220.exe	cmd.exe
PID 4612 wrote to memory of 3652	4612	aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220.exe	cmd.exe
PID 3652 wrote to memory of 3084	3652	cmd.exe	tasklist.exe
PID 3652 wrote to memory of 3084	3652	cmd.exe	tasklist.exe
PID 3652 wrote to memory of 3084	3652	cmd.exe	tasklist.exe
PID 3652 wrote to memory of 876	3652	cmd.exe	findstr.exe
PID 3652 wrote to memory of 876	3652	cmd.exe	findstr.exe
PID 3652 wrote to memory of 876	3652	cmd.exe	findstr.exe
PID 3652 wrote to memory of 4472	3652	cmd.exe	tasklist.exe
PID 3652 wrote to memory of 4472	3652	cmd.exe	tasklist.exe
PID 3652 wrote to memory of 4472	3652	cmd.exe	tasklist.exe
PID 3652 wrote to memory of 2380	3652	cmd.exe	findstr.exe
PID 3652 wrote to memory of 2380	3652	cmd.exe	findstr.exe
PID 3652 wrote to memory of 2380	3652	cmd.exe	findstr.exe
PID 3652 wrote to memory of 4396	3652	cmd.exe	cmd.exe
PID 3652 wrote to memory of 4396	3652	cmd.exe	cmd.exe
PID 3652 wrote to memory of 4396	3652	cmd.exe	cmd.exe
PID 3652 wrote to memory of 1240	3652	cmd.exe	findstr.exe
PID 3652 wrote to memory of 1240	3652	cmd.exe	findstr.exe
PID 3652 wrote to memory of 1240	3652	cmd.exe	findstr.exe
PID 3652 wrote to memory of 4120	3652	cmd.exe	cmd.exe
PID 3652 wrote to memory of 4120	3652	cmd.exe	cmd.exe
PID 3652 wrote to memory of 4120	3652	cmd.exe	cmd.exe
PID 3652 wrote to memory of 1816	3652	cmd.exe	Whale.pif
PID 3652 wrote to memory of 1816	3652	cmd.exe	Whale.pif
PID 3652 wrote to memory of 1816	3652	cmd.exe	Whale.pif
PID 3652 wrote to memory of 316	3652	cmd.exe	PING.EXE
PID 3652 wrote to memory of 316	3652	cmd.exe	PING.EXE
PID 3652 wrote to memory of 316	3652	cmd.exe	PING.EXE
PID 1816 wrote to memory of 2432	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 2432	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 2432	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 2500	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 2500	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 2500	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 620	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 620	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 620	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 1420	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 1420	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 1420	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 4348	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 4348	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 4348	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 4520	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 4520	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 4520	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 2960	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 2960	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 2960	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 908	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 908	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 908	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 1480	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 1480	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 1480	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 3948	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 3948	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 3948	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 1632	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 1632	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 1632	1816	Whale.pif	Whale.pif
PID 1816 wrote to memory of 2688	1816	Whale.pif	Whale.pif

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220.exe
  "C:\Users\Admin\AppData\Local\Temp\aba228d167cbabe85ed94101c53d367bdd423d3fa84b977f4629c528912b0220.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Control Control.cmd & Control.cmd & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3084
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:876
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4472
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2380
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 22212
      4⤵
      PID:4396
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "StickStatManufactureFourth" Italia
      4⤵
      PID:1240
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Mean 22212\C
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
      22212\Whale.pif 22212\C
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1816
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      Runs ping.exe
      PID:316
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\SysWOW64\TapiUnattend.exe
  C:\Windows\SysWOW64\TapiUnattend.exe
  2⤵
  - Checks SCSI registry key(s)
  PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22212\Whale.pif

Filesize
915KB

MD5
b06e67f9767e5023892d9698703ad098

SHA1
acc07666f4c1d4461d3e1c263cf6a194a8dd1544

SHA256
8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

SHA512
7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Buy

Filesize
35KB

MD5
4b69ab9d4c24d5a84dda16f2c5866d7e

SHA1
3b2ad2618be8c6cc948d5c905b49ab6aa792d79f

SHA256
196533143118e26014b159c0b9c1c151547fbe48b939211c1e695e999dbecc48

SHA512
df49dc395ce83dd7aa7ab19751b00235aed9210e035dfc2a84164bcbe74404e79ca427f34a09a86a8b35fac382d41b0819569f883591a5f5afbabe9ed4a2eac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Calculate

Filesize
16KB

MD5
b5223d8e4abe72bfdf3dda20e2d174e4

SHA1
da10ed6b21c2cd7c81950de85558fc2cc9dc7a1d

SHA256
888dc090ce9c9e461c291f7d84347f073ec482ce554a04979e8510af5d97c5a6

SHA512
b0769ed9ea8cc0bbb4583a8aae0f9323b66a9ae31680b75ac7d0ed32f093c3e784ef3120e2740c7a9c23bd8d4b8c7e812b13d8fc8838082d2fefcd2ef7bc86dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Control

Filesize
6KB

MD5
c5e251955e48a4de99c33b7df29f7c5b

SHA1
12ed707a52851d9e497dc8166063b4a391a4513b

SHA256
bc5084331dd598958f99d1f0b258a15baef1ec95c9f79f6fa55ef76bb0b5fd33

SHA512
40b25127c611c0f90339888f5d676cc09596c4d6ab8a4382a3f4b7aa495cbdf56e02f7a3e6408f4d6ca7b2a5fe6c3948de6ef928c95086e1e2117ee8335d660e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Coordinates

Filesize
51KB

MD5
e109b9321ca1d766d1360f8175ba8e06

SHA1
b7931a244fca053f6cc1f5d4e33a2f09aae9ab51

SHA256
da0009ca1182c059c453c561ac41c5188aeb522a8f672f0bcf7fcc914e4d45d3

SHA512
f3290525e970ab8350c56dfaeca2f329d2c43368ef86a63dd38499fe429c291f8b9adc47a2f566ef94a956fab1f758caee12aa29127639e71b7f8a47ca169f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cork

Filesize
41KB

MD5
c94e352c69366260945b9cc5cf5aa85a

SHA1
d7d13a251e898006ad75a893d1180674a99d1129

SHA256
b30f02c65e617a442f9da17e4676f2d02a98e62bd6258f15fb20f8f214c82054

SHA512
57a23f86a8fd9659e4f94717ee34adc83823164429aa0566472114ab7dae8901b52d6d5e064e75f5932a3ff62479b9fa7747853f1dcc2bf74112c7e051326636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Doll

Filesize
69KB

MD5
74d854b8939df4f2d9136ceb3e061ee9

SHA1
fc0e544c9e277a8a4491af4edbf8bf7b74547ecb

SHA256
a375899ed3295ea3986a4bbd92e3da2015f7645d5614cd1f0e46bf91605b0732

SHA512
a764615e4c063d7d7d3466bb940e02ca8dc0dc580efc1a08d685e220f26b5a8e95a5bfd81c6c5bed4e87ad7e2899c85c93b5713eaaf61ff5095dfb1395931836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Excerpt

Filesize
51KB

MD5
b8ed31070285d82fe0eae8272f0f9840

SHA1
6d3b6de4ed28c0c28fc6631841380957a0f4a1df

SHA256
79e85196a6ac26576ef41f8aaf95c2059fbfc27a12a4a6e30a19b1870756813c

SHA512
377e036ce7307ed6863df953cb8b02abd348ac253ac27febe909a2333b9a0167b91dc36d606b01afaa6170fc3e439fc575c8ba49080f1a13573beb0742c40b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Infrastructure

Filesize
44KB

MD5
552da5204c479e97527bfe084802548c

SHA1
66f4c6291b15ba21aa122d56b51cd1d2eda458cd

SHA256
30517cd6f4339dc906dbf953e0c9d071a6293b10953bf71bef277eec365c1fd7

SHA512
3b36ea8b2651308585355b687a19564d32e63ec1b7c4ec71b9d7734f7da024d9087ccd132c64a2fcc816eb38ba8ba10c91646c3b86c6f3fa2cc24eefbac135d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Introductory

Filesize
38KB

MD5
f96e5f0509dd4c426f1d1fd7f4802a97

SHA1
a1189757a01529453f095ee1ec6ad9ae83289007

SHA256
7a08ae7d78d7c3e9b82f8a10c0df8f812ec1985273823f672582840f2aae2a34

SHA512
040a1e0476bf1910f05092c1bec0236e05c38257ead451cc9f4b06eb8c15b0bb195ee32a6cbd909eff106879e6d11d8a109d5e4fdabef7911f7f5bfde5f4025f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Italia

Filesize
82B

MD5
bba9daa662151aa5548513e8c4f415f4

SHA1
5579c1a4db21193526e3cffe9f9740135bc12a62

SHA256
b0d1b77b03f17cc8bf0b51904f2533423890d049d43ea9f9069ccfe41fe29c66

SHA512
a278bda01e2da0d3ed3f967756ee66c4c77748d44d4c7ccb4398de999565f483999f17ca13f8c6e5550496a7182b640927da4e6fef24ccb3850f2007f745591d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Lap

Filesize
46KB

MD5
7f2b1cfb8db769ae4d3d2181069a2c79

SHA1
d380f54ed033b9e61a6771acd8893d50d39cadfc

SHA256
50cd8ea334dad5e6a8b6e371cc34432102c9f563a737ad79bbb2b4ef2496f9df

SHA512
607df2847c7482c1eeaf56aa494a3329db4c8ac90cf6b47ecff71f5f1390e90dfb8409bf803b66c4510f53b5c8a053fbce877d27c571fc2d87c7e0f5fba091fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Mean

Filesize
193KB

MD5
c45c6d0eb10d7e7a62a7f68661bba82b

SHA1
bc86f8360cf3834d0cabfc6a35227d2b13232521

SHA256
edfbf623565f7396074df45a87a71278d425640a181af4f3e399553d0a57f9e5

SHA512
6a24f3647af676814d17bec32a40c5d71c979811a16f223d5ee81c2aa1b14270dca65d0e97306620b0cf5c30ba23f79f413976d955d377890f40e1603bdb3020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Nfl

Filesize
58KB

MD5
aa81705defb492e5c4e9db2069fad5ae

SHA1
995006e9b36b13c628061779706dbfccab5fd82f

SHA256
359b1bbe67343880df0a5c88cf7e6954b03dc83192b1e362fbd7646a8935e2fd

SHA512
4233f6af1b92e9498b97380e59a0e71286987d131a3e080433b5f043b55d61e6307c1b623e40d1da7ec9f47cdd23e512bae9d5c79d426a11ca25903cf8869e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Nine

Filesize
40KB

MD5
5d0db47fc7f4de1f045779b36ee856e5

SHA1
f1e188360a395bb3954c73ee0f0f9bc4756267ad

SHA256
6a9c8c62c7125649af510c9394e828c5cfc214e79adfa818891cbd302a9c9f56

SHA512
4873db7199f60109c529ed106e4b2914381bdab74f743ec6e3932ebee93963199be3265987be01944c5803440cfcd0b08535420c082c2506a917e3601e8cf986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Opera

Filesize
68KB

MD5
3b7c9491c0a99ed8d3765c8cffb8c6a4

SHA1
4d3ca05521c55e92a7bebdbbfccc030c8b8ffebb

SHA256
0fbef6bfbfe6ab2d96c59e0ff125b7c12d97d3a29f9bd3162ed86aa06fb6a10d

SHA512
b1c444f9b58eece6d913ed435e7a412f1057c45b23b59f3470999d2b009d4741af389d9643bcf2724435505416b2cc80916347ae2926e8c953684fd286cd832a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Panel

Filesize
29KB

MD5
829a7f8e584da8dabe594cf52cfbe61e

SHA1
18130e6c32685819eda65b079086caec6aac0155

SHA256
89570434130fc9a5c2760f48a274c7396a1fd17218524f3b0243fce97d6e56c8

SHA512
5b751b38078142b574983a744b13a494daaae097a31687595a509d57268c8f786d327b3807ce92748d6d68c4530669dae5f009ae6da27aeae001e403c18eb2c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Rb

Filesize
30KB

MD5
d94497a3a1e2197f8abdaaeba0adaa03

SHA1
3fd9c46431b1159194bc802f78edd484bc4a74f8

SHA256
59d4b39d0d3f5595a7e3db7c47e4fd094035e549d91e2ebb4146e41ce85b6977

SHA512
5da29997d3d43b10bd02c8510186e45994b7ec338d02c875caaf1821651d00e368c6fe5a0eae1c6e035064d4623ca1f86b2b1ba2875073e8b052bbe5830eccbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Rd

Filesize
49KB

MD5
d0d68fcc731b33ac46e6cf04607d2d5b

SHA1
cca14a2f17178f6ee46733789295066d0f9e3f1b

SHA256
147a5802fc79b09f8c211dd2eb68013f0995758cd72853d4eb3d77c7978da035

SHA512
5ea80cd6f22743920126c9a11b0e5ba5f6bb1ebda3df6a87d85a9d9fa42e28a9def6d9ebe13660a55f0203c5e8c21ff81ff1622f86ce2ce72ac9a49aaa02a9ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Salad

Filesize
37KB

MD5
27306272752af7cf0be5113a8d430353

SHA1
470125134c8506ba4861c08a618d2810484366a0

SHA256
87e399b1e3d8b780f16fc24099172f2b7ea8ff03114e7c1d53fe877ae1a63ded

SHA512
696735cacf75698ee125e97fa0ea59e8a81245e350949a25bdf3910c73c0d536cdb2f9273e9248e34ff5ef3412c618a8dae8cb72cec21f28cb17b587da9c87f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sleeve

Filesize
51KB

MD5
4173e3b7eee8aba7654fb4e5d124303f

SHA1
45cfe590ee622a706112865e344ddcb0e234719e

SHA256
db32cab0818498f48ceeed682e25f3eba6083494d03b87c5882ed670f454a646

SHA512
a66d214ca2427d10ce57a79c18ddc4bf82a2fe9b6e0526ade7a8bdc692ead3c4115bcad9fb15baac58134af2d473182e80a324623b84d82025b86d41f30b64a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Symbols

Filesize
54KB

MD5
a9bc9bcef3da5b7b069338e02817b91c

SHA1
af119bbcb042ed084fda357d331cfde29163760d

SHA256
fe643c7747275f90caa32db19b8d1671b0b2a9c619344bdd08bf32249e83606a

SHA512
b1318e4ef2a2cc6afe20d86ba678ebe331df4347465a87f9b760fa16d26eefbb74aa99782e671e9f84ba00902abc4e117944c8e650c46da2f88955473b857f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Villas

Filesize
28KB

MD5
cbf7156118d054fd054882a3bde09c90

SHA1
b6e58716139f8fb9837f2adb7a5e50d8db5a59d6

SHA256
19d74560062541f23f84e64eb661f9316014185f5543161ae47f90322d6e090c

SHA512
e69b4042f0b7722a84b7c5d726a69d92047874753d5791b12e0c9142cd2b16740bf85531f7c7507937e6e118c3611e696e812ff7b743fc44caa280542a2a224a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Wilson

Filesize
52KB

MD5
b9de11f4e1d595477eb06b006f21f46f

SHA1
e0efba9acee9202f20e325ce5a90d0c2c14a79d3

SHA256
23d3a762f27136391bd022bcb80d11621bdb1263c1486983478addd737a1515b

SHA512
e38eb36c6e40a97c81df9bd09e12e3f5d052f250d517bf0a2a302d4fa335dbeaa05aa2aca7adb16eaa6d7cf69edd7c2461a05b94fe2df4e7780f9e5d518ff21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Yr

Filesize
28KB

MD5
5ce25e4a4e31b437ab290f3450dcb3e0

SHA1
166aac9a22a954a7236033537cabaf69ef74a5ac

SHA256
8f69b99d2b0c38d6d26b535fc2c2edd85f75d373bb72bc2b2849aa024240af46

SHA512
1b6a1d9ce6060c688669b19f39d1a609163bdf0f91307d52b2ec600c5228eada826cbd2ba755e91f5d7be161b2269526a08de3af110a2300be5b287a7d69e8e9

Download Submit
memory/220-135-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/220-136-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download