Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/09/2024, 16:13
Behavioral task
behavioral1
Sample
3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe
Resource
win7-20240708-en
windows7-x64
34 signatures
150 seconds
General
-
Target
3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe
-
Size
8.9MB
-
MD5
1f9ad8367647ae321e2ab53f221ace48
-
SHA1
e19db0c1288c81909378852c9130983bc65cfcfb
-
SHA256
3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd
-
SHA512
7aa1aa242288397027b690d2816763e37f30b87898e781bff617085d41737cfb0a620d9b690ad1abbef3e5b95d487da2601452595d3efc1d80c2fd953b850d04
-
SSDEEP
196608:Dl1PkID0eA2EhGE9Fy1GlkkyzLSMo/Mpz0YIpP8L2+7/A1Yt:RFm2EgE9Fy0TOkMp1ImL2k/2Yt
Malware Config
Signatures
-
Detect Neshta payload 3 IoCs
resource yara_rule behavioral1/files/0x0008000000015ce7-1.dat family_neshta behavioral1/memory/2140-163-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2140-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
resource yara_rule behavioral1/memory/2688-44-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2688-44-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ÉÏ¿¨¶Ë.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Phiya.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Phiya.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ÉÏ¿¨¶Ë.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ÉÏ¿¨¶Ë.exe -
Executes dropped EXE 6 IoCs
pid Process 2140 dadoudou_skd1.8.exe 2252 dadoudou_skd1.8.exe 2840 ÉÏ¿¨¶Ë.exe 2688 SB360.exe 2824 Phiya.exe 336 Phiya.exe -
Loads dropped DLL 10 IoCs
pid Process 2056 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe 2056 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe 2140 dadoudou_skd1.8.exe 2140 dadoudou_skd1.8.exe 2252 dadoudou_skd1.8.exe 2252 dadoudou_skd1.8.exe 2712 cmd.exe 2776 cmd.exe 2776 cmd.exe 2140 dadoudou_skd1.8.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" dadoudou_skd1.8.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0007000000016688-42.dat themida behavioral1/memory/2840-55-0x00000000003A0000-0x0000000000F3A000-memory.dmp themida behavioral1/memory/2840-56-0x00000000003A0000-0x0000000000F3A000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ÉÏ¿¨¶Ë.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Phiya.exe File opened (read-only) \??\T: Phiya.exe File opened (read-only) \??\X: Phiya.exe File opened (read-only) \??\M: Phiya.exe File opened (read-only) \??\O: Phiya.exe File opened (read-only) \??\S: Phiya.exe File opened (read-only) \??\Z: Phiya.exe File opened (read-only) \??\B: Phiya.exe File opened (read-only) \??\K: Phiya.exe File opened (read-only) \??\L: Phiya.exe File opened (read-only) \??\I: Phiya.exe File opened (read-only) \??\N: Phiya.exe File opened (read-only) \??\Y: Phiya.exe File opened (read-only) \??\J: Phiya.exe File opened (read-only) \??\P: Phiya.exe File opened (read-only) \??\Q: Phiya.exe File opened (read-only) \??\U: Phiya.exe File opened (read-only) \??\V: Phiya.exe File opened (read-only) \??\E: Phiya.exe File opened (read-only) \??\G: Phiya.exe File opened (read-only) \??\H: Phiya.exe File opened (read-only) \??\W: Phiya.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Phiya.exe SB360.exe File opened for modification C:\Windows\SysWOW64\Phiya.exe SB360.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2840 ÉÏ¿¨¶Ë.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe dadoudou_skd1.8.exe File created C:\Program Files\ddd\dadoudou_skd1.8.exe 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE dadoudou_skd1.8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE dadoudou_skd1.8.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com dadoudou_skd1.8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SB360.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phiya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dadoudou_skd1.8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dadoudou_skd1.8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ÉÏ¿¨¶Ë.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phiya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2628 cmd.exe 2008 PING.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Phiya.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Phiya.exe -
Modifies data under HKEY_USERS 12 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software Phiya.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Phiya.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Phiya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Phiya.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Phiya.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Phiya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Phiya.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Phiya.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Phiya.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Phiya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Phiya.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Phiya.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" dadoudou_skd1.8.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ÉÏ¿¨¶Ë.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ÉÏ¿¨¶Ë.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2008 PING.EXE -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe 336 Phiya.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 336 Phiya.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2840 ÉÏ¿¨¶Ë.exe Token: SeIncBasePriorityPrivilege 2688 SB360.exe Token: SeLoadDriverPrivilege 336 Phiya.exe Token: 33 336 Phiya.exe Token: SeIncBasePriorityPrivilege 336 Phiya.exe Token: 33 336 Phiya.exe Token: SeIncBasePriorityPrivilege 336 Phiya.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2056 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe 2056 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe 2252 dadoudou_skd1.8.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2140 2056 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe 30 PID 2056 wrote to memory of 2140 2056 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe 30 PID 2056 wrote to memory of 2140 2056 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe 30 PID 2056 wrote to memory of 2140 2056 3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe 30 PID 2140 wrote to memory of 2252 2140 dadoudou_skd1.8.exe 31 PID 2140 wrote to memory of 2252 2140 dadoudou_skd1.8.exe 31 PID 2140 wrote to memory of 2252 2140 dadoudou_skd1.8.exe 31 PID 2140 wrote to memory of 2252 2140 dadoudou_skd1.8.exe 31 PID 2252 wrote to memory of 2712 2252 dadoudou_skd1.8.exe 32 PID 2252 wrote to memory of 2712 2252 dadoudou_skd1.8.exe 32 PID 2252 wrote to memory of 2712 2252 dadoudou_skd1.8.exe 32 PID 2252 wrote to memory of 2712 2252 dadoudou_skd1.8.exe 32 PID 2252 wrote to memory of 2776 2252 dadoudou_skd1.8.exe 33 PID 2252 wrote to memory of 2776 2252 dadoudou_skd1.8.exe 33 PID 2252 wrote to memory of 2776 2252 dadoudou_skd1.8.exe 33 PID 2252 wrote to memory of 2776 2252 dadoudou_skd1.8.exe 33 PID 2712 wrote to memory of 2688 2712 cmd.exe 36 PID 2712 wrote to memory of 2688 2712 cmd.exe 36 PID 2712 wrote to memory of 2688 2712 cmd.exe 36 PID 2712 wrote to memory of 2688 2712 cmd.exe 36 PID 2776 wrote to memory of 2840 2776 cmd.exe 37 PID 2776 wrote to memory of 2840 2776 cmd.exe 37 PID 2776 wrote to memory of 2840 2776 cmd.exe 37 PID 2776 wrote to memory of 2840 2776 cmd.exe 37 PID 2688 wrote to memory of 2628 2688 SB360.exe 39 PID 2688 wrote to memory of 2628 2688 SB360.exe 39 PID 2688 wrote to memory of 2628 2688 SB360.exe 39 PID 2688 wrote to memory of 2628 2688 SB360.exe 39 PID 2824 wrote to memory of 336 2824 Phiya.exe 41 PID 2824 wrote to memory of 336 2824 Phiya.exe 41 PID 2824 wrote to memory of 336 2824 Phiya.exe 41 PID 2824 wrote to memory of 336 2824 Phiya.exe 41 PID 2628 wrote to memory of 2008 2628 cmd.exe 42 PID 2628 wrote to memory of 2008 2628 cmd.exe 42 PID 2628 wrote to memory of 2008 2628 cmd.exe 42 PID 2628 wrote to memory of 2008 2628 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe"C:\Users\Admin\AppData\Local\Temp\3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files\ddd\dadoudou_skd1.8.exe"C:\Program Files\ddd\dadoudou_skd1.8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3582-490\dadoudou_skd1.8.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\dadoudou_skd1.8.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.execmd /c start C:\Users\Admin\AppData\Local\Temp\\SB360.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\SB360.exeC:\Users\Admin\AppData\Local\Temp\\SB360.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SB360.exe > nul6⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.17⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2008
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c start C:\Users\Admin\AppData\Local\Temp\\ÉÏ¿¨¶Ë.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\ÉÏ¿¨¶Ë.exeC:\Users\Admin\AppData\Local\Temp\\ÉÏ¿¨¶Ë.exe5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
-
-
-
C:\Windows\SysWOW64\Phiya.exeC:\Windows\SysWOW64\Phiya.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Phiya.exeC:\Windows\SysWOW64\Phiya.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:336
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Peripheral Device Discovery
1Query Registry
4Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD57fd0a3aa60c35d5eba5249f354216e02
SHA150eb2680fb4d1de48e542fbaea16aa85bdfd924f
SHA2569392e25660fc55b43f03dfe57312ec0e6c540322640234caff8032f325050a72
SHA512de5ad23ce99bf61595b436f0ca23179a3e577751dc2a91192f863329a38bae92c1e0ca85cd6f1ac548145cac1714b7a6b667e5891bde9d729a3a774fc4fa7551
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
8.3MB
MD519c6b4bd8d9963b05ebf55a829a048d9
SHA116e5c75e74f1aa7cd5cc70d336f65c5d5f07a9e3
SHA256e17205c47fed992a15c0b5e4520601a6aae94075c4b7d7902fe6192345d65545
SHA512aab1ebf2033d1a7db2ca0928f9e38e8a5a78b86d4ac409c62b7047bf73ea4ee6560e937d30cbfa584e7dfc7ea1889eb59e883c44c5dac9cfd09322c2f91c7ef6
-
Filesize
8.2MB
MD5e3583f6b5670ebec804bf2e7aa3cd325
SHA194b8fc19bcb0cb7c4267ecba71d3166c9fdd90de
SHA2565afd815d7ad1bba7510f591d789e8efe10802a37a5e579d6ee9e7a26161c7524
SHA51210607de92cadd9f200ae57180a10bc497fbb8a96004ed5eaad37ce2e5e76bf90ab6fef229401a584e4fd97ccb820930f0e464307d1ad2ec96ca397e7292eda03
-
Filesize
1.1MB
MD597c8fe752e354b2945e4c593a87e4a8b
SHA103ab4c91535ecf14b13e0258f3a7be459a7957f9
SHA256820d8dd49baed0da44d42555ad361d78e068115661dce72ae6578dcdab6baead
SHA512af4492c08d6659d21ebfefe752b0d71210d2542c1788f1d2d9f86a85f01c3dd05eebf61c925e18b5e870aec7e9794e4a7050a04f4c58d90dca93324485690bcc
-
Filesize
56KB
MD5d63851f89c7ad4615565ca300e8b8e27
SHA11c9a6c1ce94581f85be0e99e2d370384b959578f
SHA2560a6ae72df15cbca21c6af32bc2c13ca876e191008f1078228b3b98add9fc9d8d
SHA512623e9e9beb5d2a9f3a6a75e5fac9dda5b437246fd3b10db4bba680f61bc68aae6714f11a12938b7d22b1c7691f45a75c4406ba06fa901da8ce05e784038970d2
-
Filesize
1.3MB
MD581250dab88064c74cef402a33d906934
SHA1ce063f39ccd18b5a9a1c0be221cd9f3bec557729
SHA2563690b1a6c63b925b6f34a84e86befcb816c99e8d9bb06611520262310aeaa5f2
SHA512497f8e9c57f8a45afc4b131a95ca6a1a897fad55773ac49aa0d47efd642518c0d028b59c9e54aa3b12551c1e0c99fa6e78f71f0fe5a9748d8f14b007e3e1cbf1