Resubmissions
03/07/2024, 16:09
240703-tl9n3ayepb03/07/2024, 16:04
240703-thygmaycpc1001/07/2024, 18:12
240701-ws6xvswbkj1001/07/2024, 18:03
240701-wm5sls1gka1001/07/2024, 18:03
240701-wm39sa1gjf1001/07/2024, 18:03
240701-wm2e7avhkj1001/07/2024, 18:03
240701-wmzxcs1fre1001/07/2024, 18:02
240701-wmzats1frc1001/07/2024, 18:02
240701-wmvbwa1fqh1022/11/2023, 17:02
231122-vkac9adg6410Analysis
- max time kernel
57s - max time network
157s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
03/07/2024, 16:04
General
- Target 1.bin/1.exe
- Size 12.5MB
- Sample240703-thygmaycpc
- SHA256 7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267
Malware Config
Extracted
-
formbook
-
4.0
-
w9z
-
crazzysex.com
-
hanferd.com
-
gteesrd.com
-
bayfrontbabyplace.com
-
jicuiquan.net
-
relationshiplink.net
-
ohchacyberphoto.com
-
kauegimenes.com
-
powerful-seldom.com
-
ketotoken.com
-
make-money-online-success.com
-
redgoldcollection.com
-
hannan-football.com
-
hamptondc.com
-
vllii.com
-
aa8520.com
-
platform35markethall.com
-
larozeimmo.com
-
oligopoly.net
-
llhak.info
Extracted
-
gozi
-
build
300869
-
exe_type
loader
Extracted
-
gozi
-
86920224
-
https://sibelikinciel.xyz
-
build
300869
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
Extracted
-
danabot
-
92.204.160.54
-
2.56.213.179
-
45.153.186.47
-
93.115.21.29
-
185.45.193.50
-
193.34.166.247
Extracted
-
formbook
-
4.1
-
i0qi
-
mytakeawaybox.com
-
goutaihuo.com
-
kuzey.site
-
uppertenpiercings.amsterdam
-
honeygrandpa.com
-
jenniferabramslaw.com
-
ncarian.com
-
heavilymeditatedhouston.com
-
gsbjyzx.com
-
akisanblog.com
-
taoyuanreed.com
-
jasperrvservices.com
-
yabbanet.com
-
myhealthfuldiet.com
-
flipdigitalcoins.com
-
toes.photos
-
shoottillyoumiss.com
-
maserental.com
-
smarteacher.net
-
hamdimagdeco.com
Extracted
-
qakbot
-
324.141
-
spx129
-
1590734339
-
94.10.81.239:443
-
94.52.160.116:443
-
67.0.74.119:443
-
175.137.136.79:443
-
73.232.165.200:995
-
79.119.67.149:443
-
62.38.111.70:2222
-
108.58.9.238:993
-
216.110.249.252:2222
-
67.209.195.198:3389
-
84.247.55.190:443
-
96.37.137.42:443
-
94.176.220.76:2222
-
173.245.152.231:443
-
96.227.122.123:443
-
188.192.75.8:995
-
24.229.245.124:995
-
71.163.225.75:443
-
75.71.77.59:443
-
104.36.135.227:443
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V1 payload 3 IoCs
- AgentTesla payload 14 IoCs
- CryptOne packer 2 IoCs
Detects CryptOne packer defined in NCC blogpost.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Formbook payload 3 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- ReZer0 packer 3 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Renames multiple (76) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Blocklisted process makes network request 9 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks QEMU agent file 2 TTPs 12 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
- Drops startup file 2 IoCs
- Executes dropped EXE 35 IoCs
- Loads dropped DLL 21 IoCs
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops desktop.ini file(s) 14 IoCs
- Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
- Suspicious use of SetThreadContext 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: CmdExeWriteProcessMemorySpam 30 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 13 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 9 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe"C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4624.tmp\4625.tmp\4626.bat C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"4⤵
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe5⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Users\Admin\AppData\Roaming\4.exeC:\Users\Admin\AppData\Roaming\4.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@19365⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f06⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Roaming\5.exeC:\Users\Admin\AppData\Roaming\5.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\6.exeC:\Users\Admin\AppData\Roaming\6.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\7.exeC:\Users\Admin\AppData\Roaming\7.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\8.exeC:\Users\Admin\AppData\Roaming\8.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"6⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Roaming\feeed.exe"C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\9.exeC:\Users\Admin\AppData\Roaming\9.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp780.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\10.exeC:\Users\Admin\AppData\Roaming\10.exe4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\11.exeC:\Users\Admin\AppData\Roaming\11.exe4⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4672.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\11.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe5⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\14.exeC:\Users\Admin\AppData\Roaming\14.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\15.exeC:\Users\Admin\AppData\Roaming\15.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\16.exeC:\Users\Admin\AppData\Roaming\16.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\AppData\Roaming\17.exeC:\Users\Admin\AppData\Roaming\17.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\18.exeC:\Users\Admin\AppData\Roaming\18.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\19.exeC:\Users\Admin\AppData\Roaming\19.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\21.exeC:\Users\Admin\AppData\Roaming\21.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4765⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Roaming\22.exeC:\Users\Admin\AppData\Roaming\22.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\23.exeC:\Users\Admin\AppData\Roaming\23.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\24.exeC:\Users\Admin\AppData\Roaming\24.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\24.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\25.exeC:\Users\Admin\AppData\Roaming\25.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\26.exeC:\Users\Admin\AppData\Roaming\26.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9B1.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
-
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe /C5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Youxtjx\mikonf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Youxtjx\mikonf.exe5⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Youxtjx\mikonf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Youxtjx\mikonf.exe /C6⤵
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hcvwdzk /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I hcvwdzk" /SC ONCE /Z /ST 16:10 /ET 16:225⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\28.exeC:\Users\Admin\AppData\Roaming\28.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\29.exeC:\Users\Admin\AppData\Roaming\29.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@20405⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f06⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Roaming\30.exeC:\Users\Admin\AppData\Roaming\30.exe4⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\31.exeC:\Users\Admin\AppData\Roaming\31.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\2.exe"3⤵
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\18.exe"3⤵
-
-
-
C:\Program Files (x86)\Aflr\gdi9rql.exe"C:\Program Files (x86)\Aflr\gdi9rql.exe"2⤵
-
C:\Program Files (x86)\Aflr\gdi9rql.exe"C:\Program Files (x86)\Aflr\gdi9rql.exe"3⤵
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
ProPlusWW.msi.id-E81584A0.[[email protected]].BOMBO
4626.bat
1.jar
10.exe
11.exe
12.exe
13.exe
14.exe
15.exe
16.exe
17.exe
18.exe
19.exe
2.exe
20.exe
21.exe
22.exe
23.exe
24.exe
25.exe
26.exe
27.exe
28.exe
29.exe
3.exe
30.exe
31.exe
4.exe
5.exe
6.exe
7.exe
8.exe
9.exe
index.html
license
license
.travis.yml
GOVERNANCE.md
LICENSE
README.md
2015-01-30.md
duplex-browser.js
duplex.js
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js
_stream_transform.js
_stream_writable.js
BufferList.js
destroy.js
stream-browser.js
stream.js
passthrough.js
readable-browser.js
readable.js
transform.js
writable-browser.js
writable.js
.travis.yml
LICENSE
README.md
string_decoder.js
LICENSE
.npmignore
memory/632-587-0x0000000005090000-0x00000000050E6000-memory.dmp
memory/632-209-0x0000000001F10000-0x0000000001F72000-memory.dmp
memory/632-204-0x0000000000290000-0x0000000000328000-memory.dmp
memory/680-647-0x00000000004E0000-0x0000000000532000-memory.dmp
memory/680-201-0x0000000000DE0000-0x0000000000E4E000-memory.dmp
memory/680-650-0x0000000000710000-0x000000000073D000-memory.dmp
memory/680-648-0x0000000000460000-0x00000000004A0000-memory.dmp
memory/852-471-0x0000000000400000-0x000000000042D000-memory.dmp
memory/852-161-0x0000000000400000-0x000000000042D000-memory.dmp
memory/852-470-0x0000000000430000-0x0000000000503000-memory.dmp
memory/1204-164-0x0000000003B40000-0x0000000003C40000-memory.dmp
memory/1204-4856-0x00000000076D0000-0x00000000077E8000-memory.dmp
memory/1332-205-0x0000000000400000-0x0000000002DF6000-memory.dmp
memory/1568-12326-0x0000000000400000-0x0000000000452000-memory.dmp
memory/1636-533-0x00000000004A0000-0x00000000004A8000-memory.dmp
memory/1636-534-0x0000000000B50000-0x0000000000BA8000-memory.dmp
memory/1636-202-0x0000000000BB0000-0x0000000000C1A000-memory.dmp
memory/1692-476-0x0000000000230000-0x000000000023E000-memory.dmp
memory/1692-480-0x0000000000230000-0x000000000023E000-memory.dmp
memory/1924-540-0x00000000023A0000-0x00000000023F8000-memory.dmp
memory/1924-166-0x00000000008F0000-0x00000000009AE000-memory.dmp
memory/1936-582-0x0000000000400000-0x000000000300E000-memory.dmp
memory/1936-181-0x0000000003210000-0x0000000003487000-memory.dmp
memory/2040-545-0x0000000000400000-0x000000000301E000-memory.dmp
memory/2040-175-0x00000000033A0000-0x0000000003617000-memory.dmp
memory/2188-203-0x0000000000A50000-0x0000000000A56000-memory.dmp
memory/2188-529-0x00000000009A0000-0x00000000009A6000-memory.dmp
memory/2188-211-0x0000000009FA0000-0x000000000A13A000-memory.dmp
memory/2188-200-0x00000000013B0000-0x0000000001534000-memory.dmp
memory/2348-165-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2432-530-0x0000000000400000-0x0000000002DF6000-memory.dmp
memory/2628-127-0x00000000001E0000-0x00000000001F0000-memory.dmp
memory/2628-965-0x0000000000400000-0x0000000000439000-memory.dmp
memory/2856-206-0x0000000000610000-0x0000000000624000-memory.dmp
memory/2856-528-0x0000000000660000-0x0000000000668000-memory.dmp
memory/2856-451-0x0000000000630000-0x0000000000638000-memory.dmp
memory/2856-167-0x0000000000860000-0x000000000090C000-memory.dmp
memory/2856-584-0x0000000000670000-0x0000000000678000-memory.dmp
memory/2884-1621-0x00000000003B0000-0x00000000004B4000-memory.dmp
memory/2892-966-0x0000000000400000-0x0000000002DE1000-memory.dmp
memory/2924-967-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3064-450-0x0000000000230000-0x0000000000231000-memory.dmp
memory/3064-4276-0x0000000000230000-0x0000000000231000-memory.dmp
memory/3504-1728-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3504-1736-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/3504-1730-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3504-1739-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3504-1732-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3504-1734-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3504-1738-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3504-1737-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3708-3466-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3708-2775-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3708-2782-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3708-2779-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/3724-652-0x00000000023B0000-0x000000000261B000-memory.dmp
memory/3792-975-0x00000000023C0000-0x000000000262B000-memory.dmp
memory/3800-978-0x0000000002150000-0x00000000023BB000-memory.dmp
memory/3808-653-0x0000000002250000-0x00000000024BB000-memory.dmp
memory/4412-8773-0x0000000001060000-0x000000000110C000-memory.dmp
memory/4412-8774-0x0000000000620000-0x0000000000634000-memory.dmp
memory/8144-11006-0x0000000000400000-0x0000000000452000-memory.dmp
memory/8224-11526-0x0000000000400000-0x0000000000450000-memory.dmp