stealc | 04e78ecfe607fbbea63c548deac4a45403a4ce44ffa35a6e858bcbf4b09e7bdf

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
#!~#0Pen_4422_P@$SW0rd~!!$/Setup.exe
Size 94KB
Sample240615-bfeydstcqe
SHA256 040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92
MD5 9a4cc0d8e7007f7ef20ca585324e0739
SHA1 f3e5a2e477cac4bab85940a2158eed78f2d74441
SHA512 54636a48141804112f5b4f2fc70cb7c959a041e5743aeedb5184091b51daa1d1a03f0016e8299c0d56d924c6c8ae585e4fc864021081ffdf1e6f3eab11dd43b3
SSDEEP 1536:9M/AhIxHHWMpdPa5wiE21M8kJIGFvb1Cwn/ZDs5yf:9M4SwMpdCq/IM8uIGfV/ZDso
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar xmrig discovery miner spyware stealer upx

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral2/memory/1680-19-0x0000000000FC0000-0x000000000170C000-memory.dmp	family_vidar_v7
behavioral2/memory/1680-28-0x0000000000FC0000-0x000000000170C000-memory.dmp	family_vidar_v7
behavioral2/memory/1680-126-0x0000000000FC0000-0x000000000170C000-memory.dmp	family_vidar_v7
behavioral2/memory/1680-155-0x0000000000FC0000-0x000000000170C000-memory.dmp	family_vidar_v7
behavioral2/memory/1680-156-0x0000000000FC0000-0x000000000170C000-memory.dmp	family_vidar_v7
behavioral2/memory/1680-174-0x0000000000FC0000-0x000000000170C000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect binaries embedding considerable number of MFA browser extension IDs. 4 IoCs

resource	yara_rule
behavioral2/memory/1680-126-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/1680-155-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/1680-156-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/1680-174-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs

resource	yara_rule
behavioral2/memory/1680-126-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1680-155-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1680-156-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1680-174-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Windows executables referencing non-Windows User-Agents 6 IoCs

resource	yara_rule
behavioral2/memory/1680-19-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1680-28-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1680-126-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1680-155-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1680-156-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1680-174-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 4 IoCs

resource	yara_rule
behavioral2/memory/1680-126-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1680-155-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1680-156-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1680-174-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 6 IoCs

resource	yara_rule
behavioral2/memory/1680-19-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1680-28-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1680-126-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1680-155-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1680-156-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1680-174-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing potential Windows Defender anti-emulation checks 6 IoCs

resource	yara_rule
behavioral2/memory/1680-19-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/1680-28-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/1680-126-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/1680-155-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/1680-156-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/1680-174-0x0000000000FC0000-0x000000000170C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023531-117.dat	INDICATOR_EXE_Packed_Fody

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral2/memory/3984-204-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX
behavioral2/memory/3984-206-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX
behavioral2/memory/3984-207-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX
behavioral2/memory/3984-210-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX
behavioral2/memory/3984-212-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX
behavioral2/memory/3984-211-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX
behavioral2/memory/3984-209-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral2/memory/3984-207-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/3984-210-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/3984-212-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/3984-211-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/3984-209-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3984-204-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/3984-206-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/3984-207-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/3984-210-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/3984-212-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/3984-211-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/3984-209-0x0000000140000000-0x00000001407DC000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	coml.au3

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3608 set thread context of 3380	3608	Setup.exe	84
PID 2460 set thread context of 4476	2460	KKJKEBKFCA.exe	94
PID 2000 set thread context of 4280	2000	GIEHIDHJDB.exe	96
PID 4476 set thread context of 4460	4476	ftp.exe	105
PID 4460 set thread context of 3984	4460	MSBuild.exe	107

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Watcher Com SH.job	ftp.exe
File created	C:\Windows\Tasks\TWI Cloud Host.job	ftp.exe

Executes dropped EXE 2 IoCs

pid	Process
2000	GIEHIDHJDB.exe
2460	KKJKEBKFCA.exe

Loads dropped DLL 3 IoCs

pid	Process
1680	coml.au3
1680	coml.au3
1680	coml.au3

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	coml.au3

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
716	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	coml.au3
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	coml.au3

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3608	Setup.exe
3608	Setup.exe
3380	netsh.exe
3380	netsh.exe
1680	coml.au3
1680	coml.au3
2000	GIEHIDHJDB.exe
2460	KKJKEBKFCA.exe
2460	KKJKEBKFCA.exe
2000	GIEHIDHJDB.exe
1680	coml.au3
1680	coml.au3
4476	ftp.exe
4476	ftp.exe
4280	ftp.exe
4280	ftp.exe
4460	MSBuild.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3608	Setup.exe
3380	netsh.exe
2460	KKJKEBKFCA.exe
2000	GIEHIDHJDB.exe
4476	ftp.exe
4476	ftp.exe
4280	ftp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	MSBuild.exe
Token: SeLockMemoryPrivilege	3984	ngen.exe
Token: SeLockMemoryPrivilege	3984	ngen.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3984	ngen.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 3380	3608	Setup.exe	84
PID 3608 wrote to memory of 3380	3608	Setup.exe	84
PID 3608 wrote to memory of 3380	3608	Setup.exe	84
PID 3608 wrote to memory of 3380	3608	Setup.exe	84
PID 3380 wrote to memory of 1680	3380	netsh.exe	86
PID 3380 wrote to memory of 1680	3380	netsh.exe	86
PID 3380 wrote to memory of 1680	3380	netsh.exe	86
PID 3380 wrote to memory of 1680	3380	netsh.exe	86
PID 3380 wrote to memory of 1680	3380	netsh.exe	86
PID 1680 wrote to memory of 2000	1680	coml.au3	91
PID 1680 wrote to memory of 2000	1680	coml.au3	91
PID 1680 wrote to memory of 2000	1680	coml.au3	91
PID 1680 wrote to memory of 2460	1680	coml.au3	93
PID 1680 wrote to memory of 2460	1680	coml.au3	93
PID 1680 wrote to memory of 2460	1680	coml.au3	93
PID 2460 wrote to memory of 4476	2460	KKJKEBKFCA.exe	94
PID 2460 wrote to memory of 4476	2460	KKJKEBKFCA.exe	94
PID 2460 wrote to memory of 4476	2460	KKJKEBKFCA.exe	94
PID 2000 wrote to memory of 4280	2000	GIEHIDHJDB.exe	96
PID 2000 wrote to memory of 4280	2000	GIEHIDHJDB.exe	96
PID 2000 wrote to memory of 4280	2000	GIEHIDHJDB.exe	96
PID 2460 wrote to memory of 4476	2460	KKJKEBKFCA.exe	94
PID 2000 wrote to memory of 4280	2000	GIEHIDHJDB.exe	96
PID 1680 wrote to memory of 376	1680	coml.au3	98
PID 1680 wrote to memory of 376	1680	coml.au3	98
PID 1680 wrote to memory of 376	1680	coml.au3	98
PID 376 wrote to memory of 716	376	cmd.exe	100
PID 376 wrote to memory of 716	376	cmd.exe	100
PID 376 wrote to memory of 716	376	cmd.exe	100
PID 4476 wrote to memory of 4460	4476	ftp.exe	105
PID 4476 wrote to memory of 4460	4476	ftp.exe	105
PID 4280 wrote to memory of 4768	4280	ftp.exe	106
PID 4280 wrote to memory of 4768	4280	ftp.exe	106
PID 4280 wrote to memory of 4768	4280	ftp.exe	106
PID 4476 wrote to memory of 4460	4476	ftp.exe	105
PID 4476 wrote to memory of 4460	4476	ftp.exe	105
PID 4280 wrote to memory of 4768	4280	ftp.exe	106
PID 4460 wrote to memory of 3984	4460	MSBuild.exe	107
PID 4460 wrote to memory of 3984	4460	MSBuild.exe	107
PID 4460 wrote to memory of 3984	4460	MSBuild.exe	107
PID 4460 wrote to memory of 3984	4460	MSBuild.exe	107
PID 4460 wrote to memory of 3984	4460	MSBuild.exe	107
PID 4460 wrote to memory of 3984	4460	MSBuild.exe	107
PID 4460 wrote to memory of 3984	4460	MSBuild.exe	107

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Users\Admin\AppData\Local\Temp\coml.au3
    C:\Users\Admin\AppData\Local\Temp\coml.au3
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\ProgramData\GIEHIDHJDB.exe
      "C:\ProgramData\GIEHIDHJDB.exe"
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\Windows\SysWOW64\ftp.exe
        
        C:\Windows\SysWOW64\ftp.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4280
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        
        PID:4768
  - - C:\ProgramData\KKJKEBKFCA.exe
      "C:\ProgramData\KKJKEBKFCA.exe"
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Windows\SysWOW64\ftp.exe
        
        C:\Windows\SysWOW64\ftp.exe
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4476
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3984
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HCAEGCBFHJDG" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:376
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GIEHIDHJDB.exe

Path C:\ProgramData\GIEHIDHJDB.exe
Size 8.6MB
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8
SSDEEP 98304:kHRNlpNpt3gSuDdFeznbkRBLwX1Pgedmv72Im/xAgDXMnw4bmVKAHNAXqcMHKYsN:uRrptYDdF8komd8xAUXMwIwHNvcMmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNT~1.DLL

Path C:\ProgramData\HCAEGCBFHJDG\VCRUNT~1.DLL
Size 78KB
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
SSDEEP 1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\HCAEGCBFHJDG\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\ProgramData\HCAEGCBFHJDG\msvcp140.dll
Size 439KB
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
SSDEEP 12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\HCAEGCBFHJDG\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\ProgramData\HCAEGCBFHJDG\softokn3.dll
Size 251KB
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
SSDEEP 6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

KKJKEBKFCA.exe

Path C:\ProgramData\KKJKEBKFCA.exe
Size 2.3MB
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3
SSDEEP 49152:QMVZsEVMBOL5BdKOPp/6VHAZCRiiQSPyAH0ehXC4KblR1pzA:TVZsHBSBdlSHwJiQSPvHjhy4K/A
MD5 SHA1 SHA512 SSDEEP

Submit Download

1122e574

Path C:\Users\Admin\AppData\Local\Temp\1122e574
Size 736KB
SHA256 921120b68c6417b024c8a89962c1480d2e45d452a72e092546aaaa907a42cd81
MD5 3ca89f5c8a5d435eb758701a2c6fe548
SHA1 6d41dd827e5549203d5ea31ac119c112423a4f7c
SHA512 580f9eb4c5af88d3e0ed9448603dbb6b0be92dab587c781a13d473ff730212c67460049453ab2382cc4fc71fc186367a788c218a39c62eaf9bf44a9b3c93f8f4
SSDEEP 12288:i1fSP2o7LKqCO3W8zDdKja5t94STBsMzIrNTvx4cmeh37v1Gknuml9RKg/6vYzt:i1fSP2o3KdP8zDd8a794esSIR2u96mlL
MD5 SHA1 SHA512 SSDEEP

Submit Download

13942430

Path C:\Users\Admin\AppData\Local\Temp\13942430
Size 1.1MB
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5
SSDEEP 24576:3v/gJp5kBRawWokpLs/GFR7v1aV2W5WG9HjLTQ:3AXyRTeI/Gfd8n5WG9DLTQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

158310c3

Path C:\Users\Admin\AppData\Local\Temp\158310c3
Size 1.1MB
SHA256 66423098a26b58619976ff05222628024a03cfb30ef370224966d30b74ef01f9
MD5 12853f1a15c7c5d4cc3971b582d9a1c6
SHA1 89f687e97f1ad7b300279f005dc3a13547aeaa10
SHA512 4a6cdb2c773ed00ff09b82e8d9aca80d0cea2937259b852f6f4ee257b00d38d7ac766d844bc2ce1bad83161b54cf712ecc40a353ec74e7a421a1b428cec12acb
SSDEEP 24576:hnm19T3qZsCUfZn9dewfq7XJlpKvcYADQWZIhg0wdKt1jWm192:hnK9T6sCY13C7tK9ADzZithWm192
MD5 SHA1 SHA512 SSDEEP

Submit Download

76c6e391

Path C:\Users\Admin\AppData\Local\Temp\76c6e391
Size 6.8MB
SHA256 17d3c744a54fd039c9db3d25c20f75854461a9a05835355af5edd3d0838a603a
MD5 ea000b2a5bbbfd4d20821bd85e4cf932
SHA1 dcafe122ab40bfe96757fe7822231c988464a5eb
SHA512 11790680396dbc4d0a535bc860a58be46836aa07b02d9c46bff9c2b84420b9129ca861b02194759033d6e6af8d3d994a5df3317c5b622b98d36dc2b0cbd3ad77
SSDEEP 98304:mLQ13OKzuyS3HHZj0lqIlTJbQNiP6MvEj7zReUS9lcELY9TgrwMGp3WopG7C3Jol:mQ3lzyCplTJaJZLacEsBgG5wCL0YJUeQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

coml.au3

Path C:\Users\Admin\AppData\Local\Temp\coml.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5bb857

Path C:\Users\Admin\AppData\Local\Temp\e5bb857
Size 951KB
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092
SSDEEP 24576:iHXwrLprR8zlPaiQSPOlAqVap0M5PgwXXCDoC+GqVn:iHAZCRiiQSPyAH0ehXC4n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1680-28-0x0000000000FC0000-0x000000000170C000-memory.dmp

Download

memory/1680-174-0x0000000000FC0000-0x000000000170C000-memory.dmp

Download

memory/1680-21-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

Download

memory/1680-126-0x0000000000FC0000-0x000000000170C000-memory.dmp

Download

memory/1680-19-0x0000000000FC0000-0x000000000170C000-memory.dmp

Download

memory/1680-156-0x0000000000FC0000-0x000000000170C000-memory.dmp

Download

memory/1680-41-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1680-155-0x0000000000FC0000-0x000000000170C000-memory.dmp

Download

memory/2000-150-0x0000000072170000-0x00000000722EB000-memory.dmp

Download

memory/2000-125-0x0000000000B50000-0x0000000001063000-memory.dmp

Download

memory/2000-151-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

Download

memory/2000-167-0x0000000072170000-0x00000000722EB000-memory.dmp

Download

memory/2460-137-0x0000000000AD0000-0x0000000000D18000-memory.dmp

Download

memory/2460-144-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

Download

memory/2460-143-0x0000000072170000-0x00000000722EB000-memory.dmp

Download

memory/2460-160-0x0000000072170000-0x00000000722EB000-memory.dmp

Download

memory/3380-10-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

Download

memory/3380-12-0x0000000073D1E000-0x0000000073D20000-memory.dmp

Download

memory/3380-13-0x0000000073D11000-0x0000000073D1F000-memory.dmp

Download

memory/3380-17-0x0000000073D11000-0x0000000073D1F000-memory.dmp

Download

memory/3608-5-0x00007FFFA80B8000-0x00007FFFA80B9000-memory.dmp

Download

memory/3608-0-0x00007FFFA80A0000-0x00007FFFA8212000-memory.dmp

Download

memory/3608-7-0x00007FFFA80A0000-0x00007FFFA8212000-memory.dmp

Download

memory/3608-6-0x00007FFFA80A0000-0x00007FFFA8212000-memory.dmp

Download

memory/3984-209-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/3984-211-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/3984-206-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/3984-212-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/3984-210-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/3984-207-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/3984-208-0x000002E5A7630000-0x000002E5A7650000-memory.dmp

Download

memory/3984-204-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/4280-176-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

Download

memory/4460-200-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4460-195-0x00007FFFA6380000-0x00007FFFA79F7000-memory.dmp

Download

memory/4476-192-0x0000000072170000-0x00000000722EB000-memory.dmp

Download

memory/4476-177-0x0000000072170000-0x00000000722EB000-memory.dmp

Download

memory/4476-175-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

Download

memory/4768-199-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

Download