Overview
overview
10Static
static
1#!~#0PEn_9...up.exe
windows7-x64
10#!~#0PEn_9...up.exe
windows10-2004-x64
10#!~#0PEn_9...sh.apk
windows7-x64
1#!~#0PEn_9...sh.apk
windows10-2004-x64
1#!~#0PEn_9...c_.dll
windows7-x64
1#!~#0PEn_9...c_.dll
windows10-2004-x64
1#!~#0PEn_9...m_.dll
windows7-x64
1#!~#0PEn_9...m_.dll
windows10-2004-x64
1#!~#0PEn_9...t_.dll
windows7-x64
1#!~#0PEn_9...t_.dll
windows10-2004-x64
1#!~#0PEn_9...20.dll
windows7-x64
3#!~#0PEn_9...20.dll
windows10-2004-x64
3#!~#0PEn_9...20.dll
windows7-x64
1#!~#0PEn_9...20.dll
windows10-2004-x64
1#!~#0PEn_9...20.dll
windows7-x64
3#!~#0PEn_9...20.dll
windows10-2004-x64
3#!~#0PEn_9...40.dll
windows7-x64
3#!~#0PEn_9...40.dll
windows10-2004-x64
3#!~#0PEn_9...pp.dll
windows7-x64
1#!~#0PEn_9...pp.dll
windows10-2004-x64
3#!~#0PEn_9...1].exe
windows7-x64
1#!~#0PEn_9...1].exe
windows10-2004-x64
1#!~#0PEn_9...1].exe
windows7-x64
1#!~#0PEn_9...1].exe
windows10-2004-x64
3#!~#0PEn_9...1].exe
windows7-x64
1#!~#0PEn_9...1].exe
windows10-2004-x64
1#!~#0PEn_9...-1.dll
windows10-2004-x64
1#!~#0PEn_9...-0.dll
windows10-2004-x64
1#!~#0PEn_9...-0.dll
windows10-2004-x64
1#!~#0PEn_9...-0.dll
windows10-2004-x64
1#!~#0PEn_9...-0.dll
windows10-2004-x64
1#!~#0PEn_9...-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
157s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 14:48
Static task
static1
Behavioral task
behavioral1
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/Setup.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/coalfish.apk
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/coalfish.apk
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/madbasic_.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/madbasic_.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/maddisAsm_.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/maddisAsm_.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/madexcept_.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/madexcept_.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/rtl120.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/rtl120.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/vcl120.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/vcl120.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/vclx120.dll
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/vclx120.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/vcruntime140.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/vcruntime140.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/vcruntime140_app.dll
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/vcruntime140_app.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/HDHelper_[0MB]_[1].exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/HDHelper_[0MB]_[1].exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/NvStereoUtilityOGL_[1MB]_[1].exe
Resource
win7-20240419-en
Behavioral task
behavioral24
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/NvStereoUtilityOGL_[1MB]_[1].exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/VSLauncher_[0MB]_[1].exe
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/VSLauncher_[0MB]_[1].exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/api-ms-win-core-profile-l1-1-0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/api-ms-win-core-rtlsupport-l1-1-0.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral30
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/api-ms-win-core-string-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/api-ms-win-core-synch-l1-1-0.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral32
Sample
#!~#0PEn_9797_P@$SW0rd~!^!!$/x86/api-ms-win-core-synch-l1-2-0.dll
Resource
win10v2004-20240508-en
General
-
Target
#!~#0PEn_9797_P@$SW0rd~!^!!$/Setup.exe
-
Size
2.3MB
-
MD5
5d52ef45b6e5bf144307a84c2af1581b
-
SHA1
414a899ec327d4a9daa53983544245b209f25142
-
SHA256
26a24d3b0206c6808615c7049859c2fe62c4dcd87e7858be40ae8112b0482616
-
SHA512
458f47c1e4ccf41edaacc57abb663ee77ca098fffc596fad941bbdea67653aeabc79b34d607078b9ee5adb45614e26f5c28a09e8faf9532081fdd5dec9ac3c48
-
SSDEEP
49152:DzO+g39FbI0eQf/Z3CarWedoYAmXviDTMtT2wkqN5K:DzO19Fnf/hdoYAm9ZkqN5K
Malware Config
Extracted
stealc
Signatures
-
Detect Vidar Stealer 10 IoCs
Processes:
resource yara_rule behavioral2/memory/4292-39-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 behavioral2/memory/4292-42-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 behavioral2/memory/4292-45-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 behavioral2/memory/4292-123-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 behavioral2/memory/4292-140-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 behavioral2/memory/4292-166-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 behavioral2/memory/4292-173-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 behavioral2/memory/4292-182-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 behavioral2/memory/4292-193-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 behavioral2/memory/4292-194-0x0000000001400000-0x0000000001B4C000-memory.dmp family_vidar_v7 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dcom.au3description ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation dcom.au3 -
Suspicious use of SetThreadContext 5 IoCs
Processes:
Setup.exeDHDAKFCGIJ.exeAFBAKKFCBF.exeftp.exeMSBuild.exedescription pid process target process PID 2144 set thread context of 2612 2144 Setup.exe netsh.exe PID 4704 set thread context of 3636 4704 DHDAKFCGIJ.exe ftp.exe PID 1280 set thread context of 4112 1280 AFBAKKFCBF.exe ftp.exe PID 4112 set thread context of 4500 4112 ftp.exe MSBuild.exe PID 4500 set thread context of 4644 4500 MSBuild.exe ngen.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
ftp.exeftp.exedescription ioc process File created C:\Windows\Tasks\Watcher Com SH.job ftp.exe File created C:\Windows\Tasks\TWI Cloud Host.job ftp.exe -
Executes dropped EXE 2 IoCs
Processes:
DHDAKFCGIJ.exeAFBAKKFCBF.exepid process 4704 DHDAKFCGIJ.exe 1280 AFBAKKFCBF.exe -
Loads dropped DLL 3 IoCs
Processes:
dcom.au3pid process 4292 dcom.au3 4292 dcom.au3 4292 dcom.au3 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dcom.au3description ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dcom.au3 -
Processes:
dcom.au3description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 dcom.au3 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e dcom.au3 -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Setup.exenetsh.exedcom.au3DHDAKFCGIJ.exeAFBAKKFCBF.exeftp.exeftp.exeMSBuild.exepid process 2144 Setup.exe 2144 Setup.exe 2612 netsh.exe 2612 netsh.exe 4292 dcom.au3 4292 dcom.au3 4292 dcom.au3 4292 dcom.au3 4292 dcom.au3 4292 dcom.au3 4292 dcom.au3 4292 dcom.au3 4292 dcom.au3 4292 dcom.au3 4704 DHDAKFCGIJ.exe 1280 AFBAKKFCBF.exe 4704 DHDAKFCGIJ.exe 4704 DHDAKFCGIJ.exe 1280 AFBAKKFCBF.exe 1280 AFBAKKFCBF.exe 3636 ftp.exe 3636 ftp.exe 3636 ftp.exe 3636 ftp.exe 4112 ftp.exe 4112 ftp.exe 4112 ftp.exe 4112 ftp.exe 4500 MSBuild.exe 4500 MSBuild.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Setup.exenetsh.exeDHDAKFCGIJ.exeAFBAKKFCBF.exeftp.exeftp.exepid process 2144 Setup.exe 2612 netsh.exe 4704 DHDAKFCGIJ.exe 1280 AFBAKKFCBF.exe 4112 ftp.exe 4112 ftp.exe 3636 ftp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
MSBuild.exengen.exedescription pid process Token: SeDebugPrivilege 4500 MSBuild.exe Token: SeLockMemoryPrivilege 4644 ngen.exe Token: SeLockMemoryPrivilege 4644 ngen.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
ngen.exepid process 4644 ngen.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
Setup.exenetsh.exedcom.au3DHDAKFCGIJ.exeAFBAKKFCBF.exeftp.exeftp.exeMSBuild.exedescription pid process target process PID 2144 wrote to memory of 2612 2144 Setup.exe netsh.exe PID 2144 wrote to memory of 2612 2144 Setup.exe netsh.exe PID 2144 wrote to memory of 2612 2144 Setup.exe netsh.exe PID 2144 wrote to memory of 2612 2144 Setup.exe netsh.exe PID 2612 wrote to memory of 4292 2612 netsh.exe dcom.au3 PID 2612 wrote to memory of 4292 2612 netsh.exe dcom.au3 PID 2612 wrote to memory of 4292 2612 netsh.exe dcom.au3 PID 2612 wrote to memory of 4292 2612 netsh.exe dcom.au3 PID 2612 wrote to memory of 4292 2612 netsh.exe dcom.au3 PID 4292 wrote to memory of 4704 4292 dcom.au3 DHDAKFCGIJ.exe PID 4292 wrote to memory of 4704 4292 dcom.au3 DHDAKFCGIJ.exe PID 4292 wrote to memory of 4704 4292 dcom.au3 DHDAKFCGIJ.exe PID 4292 wrote to memory of 1280 4292 dcom.au3 AFBAKKFCBF.exe PID 4292 wrote to memory of 1280 4292 dcom.au3 AFBAKKFCBF.exe PID 4292 wrote to memory of 1280 4292 dcom.au3 AFBAKKFCBF.exe PID 4704 wrote to memory of 3636 4704 DHDAKFCGIJ.exe ftp.exe PID 4704 wrote to memory of 3636 4704 DHDAKFCGIJ.exe ftp.exe PID 4704 wrote to memory of 3636 4704 DHDAKFCGIJ.exe ftp.exe PID 1280 wrote to memory of 4112 1280 AFBAKKFCBF.exe ftp.exe PID 1280 wrote to memory of 4112 1280 AFBAKKFCBF.exe ftp.exe PID 1280 wrote to memory of 4112 1280 AFBAKKFCBF.exe ftp.exe PID 4704 wrote to memory of 3636 4704 DHDAKFCGIJ.exe ftp.exe PID 1280 wrote to memory of 4112 1280 AFBAKKFCBF.exe ftp.exe PID 4112 wrote to memory of 4500 4112 ftp.exe MSBuild.exe PID 4112 wrote to memory of 4500 4112 ftp.exe MSBuild.exe PID 3636 wrote to memory of 3720 3636 ftp.exe explorer.exe PID 3636 wrote to memory of 3720 3636 ftp.exe explorer.exe PID 3636 wrote to memory of 3720 3636 ftp.exe explorer.exe PID 4112 wrote to memory of 4500 4112 ftp.exe MSBuild.exe PID 4112 wrote to memory of 4500 4112 ftp.exe MSBuild.exe PID 3636 wrote to memory of 3720 3636 ftp.exe explorer.exe PID 4500 wrote to memory of 4644 4500 MSBuild.exe ngen.exe PID 4500 wrote to memory of 4644 4500 MSBuild.exe ngen.exe PID 4500 wrote to memory of 4644 4500 MSBuild.exe ngen.exe PID 4500 wrote to memory of 4644 4500 MSBuild.exe ngen.exe PID 4500 wrote to memory of 4644 4500 MSBuild.exe ngen.exe PID 4500 wrote to memory of 4644 4500 MSBuild.exe ngen.exe PID 4500 wrote to memory of 4644 4500 MSBuild.exe ngen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe"C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dcom.au3C:\Users\Admin\AppData\Local\Temp\dcom.au33⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\DHDAKFCGIJ.exe"C:\ProgramData\DHDAKFCGIJ.exe"4⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ftp.exeC:\Windows\SysWOW64\ftp.exe5⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
-
C:\ProgramData\AFBAKKFCBF.exe"C:\ProgramData\AFBAKKFCBF.exe"4⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ftp.exeC:\Windows\SysWOW64\ftp.exe5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4248 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2916 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:31⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\AFBAKKFCBF.exeFilesize
2.3MB
MD5daaff76b0baf0a1f9cec253560c5db20
SHA10311cf0eeb4beddd2c69c6e97462595313a41e78
SHA2565706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3
-
C:\ProgramData\DHDAKFCGIJ.exeFilesize
8.6MB
MD56cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8
-
C:\ProgramData\HDGIEBGHDAEB\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\HDGIEBGHDAEB\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch DictionariesFilesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
C:\Users\Admin\AppData\Local\Temp\30952b7cFilesize
6.8MB
MD5c72dbe62a344b8d98ae6fe1c28e7fb19
SHA10374c999e0f43dae3cc98c741f25761b29316ca7
SHA25697a5b686037eaedcdfb2ad97529c830ef44a23d21092cfdfbe0c7281727bce84
SHA512e50b5fd956793b0913f79921714de2bd021906b17b46a123e42a5dbe8dc4995a4c9cd2c30c3db0bd30404bbae3e4f7fc0270c11326d69613f36ad3c9407acf39
-
C:\Users\Admin\AppData\Local\Temp\58822b52Filesize
1.1MB
MD58d443e7cb87cacf0f589ce55599e008f
SHA1c7ff0475a3978271e0a8417ac4a826089c083772
SHA256e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5
-
C:\Users\Admin\AppData\Local\Temp\58ce8638Filesize
951KB
MD5c62f812e250409fbd3c78141984270f2
SHA19c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA5127573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092
-
C:\Users\Admin\AppData\Local\Temp\5a55639cFilesize
1.1MB
MD524ee63d61846d5c681fd11bc175b8677
SHA185dd0289b1b9d2815db5824ad7b9b30a8b344f36
SHA2565ba7fccb1d10ab49f67ee3bc798ec3526deb40884a25f284d53e35df06d19189
SHA51263b83c530f118a7b7d2ca4aa3b72ea488a86447a100a046da1fc4b32a9a8c0d5addf195545db781c17cdfc92510d95960a12c341ca8ba3329851ea6825409c95
-
C:\Users\Admin\AppData\Local\Temp\5a757ad9Filesize
736KB
MD5038e252a69760e572c5d8195d91bed8e
SHA129b052cedbb9eec939a7cc26970dedf3f8251bab
SHA256ea0c6eb3cdf3aade407c22e3a13c47b4942d61041ed59aa9f41100043aadb4b2
SHA51224174e8cd3a02aa76f3fc35aa55e2a6aa412da294ce80b368c7d57edc5ac7f7e6ee002b3dd3d48ec517b74a500e270cb3efce3ceac4cf10c31e189b9199a066f
-
C:\Users\Admin\AppData\Local\Temp\dcom.au3Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
memory/1280-155-0x0000000000D50000-0x0000000000F98000-memory.dmpFilesize
2.3MB
-
memory/1280-164-0x0000000072B10000-0x0000000072C8B000-memory.dmpFilesize
1.5MB
-
memory/1280-165-0x00007FFEAA610000-0x00007FFEAA805000-memory.dmpFilesize
2.0MB
-
memory/1280-177-0x0000000072B10000-0x0000000072C8B000-memory.dmpFilesize
1.5MB
-
memory/2144-16-0x0000000050310000-0x0000000050349000-memory.dmpFilesize
228KB
-
memory/2144-15-0x0000000050120000-0x000000005030D000-memory.dmpFilesize
1.9MB
-
memory/2144-17-0x00000000744F2000-0x00000000744F4000-memory.dmpFilesize
8KB
-
memory/2144-19-0x00000000744E0000-0x000000007465B000-memory.dmpFilesize
1.5MB
-
memory/2144-18-0x00000000744E0000-0x000000007465B000-memory.dmpFilesize
1.5MB
-
memory/2144-10-0x0000000000400000-0x0000000000698000-memory.dmpFilesize
2.6MB
-
memory/2144-0-0x00000000744E0000-0x000000007465B000-memory.dmpFilesize
1.5MB
-
memory/2144-12-0x0000000050000000-0x0000000050116000-memory.dmpFilesize
1.1MB
-
memory/2144-14-0x0000000057000000-0x000000005703F000-memory.dmpFilesize
252KB
-
memory/2144-13-0x0000000057800000-0x0000000057812000-memory.dmpFilesize
72KB
-
memory/2144-11-0x0000000059800000-0x000000005986E000-memory.dmpFilesize
440KB
-
memory/2144-1-0x00007FFEAA610000-0x00007FFEAA805000-memory.dmpFilesize
2.0MB
-
memory/2612-28-0x00000000744E0000-0x000000007465B000-memory.dmpFilesize
1.5MB
-
memory/2612-33-0x00000000744E0000-0x000000007465B000-memory.dmpFilesize
1.5MB
-
memory/2612-30-0x00007FFEAA610000-0x00007FFEAA805000-memory.dmpFilesize
2.0MB
-
memory/2612-32-0x00000000744E0000-0x000000007465B000-memory.dmpFilesize
1.5MB
-
memory/3636-180-0x00007FFEAA610000-0x00007FFEAA805000-memory.dmpFilesize
2.0MB
-
memory/4112-183-0x0000000072B10000-0x0000000072C8B000-memory.dmpFilesize
1.5MB
-
memory/4112-181-0x00007FFEAA610000-0x00007FFEAA805000-memory.dmpFilesize
2.0MB
-
memory/4112-195-0x0000000072B10000-0x0000000072C8B000-memory.dmpFilesize
1.5MB
-
memory/4292-45-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4292-41-0x00007FFEAA610000-0x00007FFEAA805000-memory.dmpFilesize
2.0MB
-
memory/4292-39-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4292-166-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4292-173-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4292-194-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4292-42-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4292-193-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4292-46-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/4292-123-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4292-182-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4292-140-0x0000000001400000-0x0000000001B4C000-memory.dmpFilesize
7.3MB
-
memory/4500-202-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4704-162-0x00007FFEAA610000-0x00007FFEAA805000-memory.dmpFilesize
2.0MB
-
memory/4704-174-0x0000000072B10000-0x0000000072C8B000-memory.dmpFilesize
1.5MB
-
memory/4704-139-0x0000000000400000-0x0000000000913000-memory.dmpFilesize
5.1MB
-
memory/4704-161-0x0000000072B10000-0x0000000072C8B000-memory.dmpFilesize
1.5MB