Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-09-2024 01:40
Static task
static1
Behavioral task
behavioral1
Sample
ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe
Resource
win10v2004-20240802-en
General
-
Target
ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe
-
Size
5.4MB
-
MD5
cb001c3f82f9c3386ac03c2718f69ca4
-
SHA1
4cdf57dcdeb3c3ebbac40f7b5d8846da1a9b3f46
-
SHA256
ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5
-
SHA512
42508b96b9339e37766c25b4d826a4b5f2883ace5f51964f70457d33b636bfa1c1421a22751ec0bd856471fb85510512b48ca3486f5593a3720a6582d30f647e
-
SSDEEP
98304:sZVMlgGcASSOZMajAIuvkD2Lec3PYs7ecbwJMpjva81bkKyNTR1eXzs0cF:AMaGwEaj4vxeMQmecbuTRkzs5
Malware Config
Extracted
vidar
11
adff67a4d89d160d64a32272a3076979
https://t.me/jamsemlg
https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Extracted
lumma
https://reinforcenh.shop/api
https://stogeneratmns.shop/api
https://fragnantbui.shop/api
https://drawzhotdog.shop/api
https://vozmeatillu.shop/api
https://offensivedzvju.shop/api
https://ghostreedmnu.shop/api
https://gutterydhowi.shop/api
Extracted
vidar
11
c8450254a9a0920212cb81ae7f386da3
https://t.me/jamsemlg
https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Signatures
-
Detect Vidar Stealer 16 IoCs
resource yara_rule behavioral1/memory/2732-7-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-10-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-14-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-8-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-16-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-19-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-155-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-196-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-197-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-233-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-270-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/2732-289-0x0000000000400000-0x0000000000B77000-memory.dmp family_vidar_v7 behavioral1/memory/1740-410-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1740-414-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1740-417-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1740-412-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 1468 BFHDAEHDAK.exe 2504 CFHIIJDBKE.exe -
Loads dropped DLL 8 IoCs
pid Process 2732 RegAsm.exe 2732 RegAsm.exe 2732 RegAsm.exe 2732 RegAsm.exe 2732 RegAsm.exe 2732 RegAsm.exe 2732 RegAsm.exe 2732 RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2764 set thread context of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 1468 set thread context of 2028 1468 BFHDAEHDAK.exe 36 PID 2504 set thread context of 1740 2504 CFHIIJDBKE.exe 39 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFHDAEHDAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFHIIJDBKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 444 timeout.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2732 RegAsm.exe 2732 RegAsm.exe 2732 RegAsm.exe 2732 RegAsm.exe 1740 RegAsm.exe 1740 RegAsm.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2764 wrote to memory of 2732 2764 ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe 31 PID 2732 wrote to memory of 1468 2732 RegAsm.exe 34 PID 2732 wrote to memory of 1468 2732 RegAsm.exe 34 PID 2732 wrote to memory of 1468 2732 RegAsm.exe 34 PID 2732 wrote to memory of 1468 2732 RegAsm.exe 34 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 1468 wrote to memory of 2028 1468 BFHDAEHDAK.exe 36 PID 2732 wrote to memory of 2504 2732 RegAsm.exe 37 PID 2732 wrote to memory of 2504 2732 RegAsm.exe 37 PID 2732 wrote to memory of 2504 2732 RegAsm.exe 37 PID 2732 wrote to memory of 2504 2732 RegAsm.exe 37 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2504 wrote to memory of 1740 2504 CFHIIJDBKE.exe 39 PID 2732 wrote to memory of 2436 2732 RegAsm.exe 40 PID 2732 wrote to memory of 2436 2732 RegAsm.exe 40 PID 2732 wrote to memory of 2436 2732 RegAsm.exe 40 PID 2732 wrote to memory of 2436 2732 RegAsm.exe 40 PID 2436 wrote to memory of 444 2436 cmd.exe 42 PID 2436 wrote to memory of 444 2436 cmd.exe 42 PID 2436 wrote to memory of 444 2436 cmd.exe 42 PID 2436 wrote to memory of 444 2436 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe"C:\Users\Admin\AppData\Local\Temp\ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\ProgramData\BFHDAEHDAK.exe"C:\ProgramData\BFHDAEHDAK.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:2028
-
-
-
C:\ProgramData\CFHIIJDBKE.exe"C:\ProgramData\CFHIIJDBKE.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1740
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFBGCFCFHCFH" & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:444
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf0f02de46de445d698776dc4a8e47d8
SHA16f502ca0e916261d951fea5589a4b6f174189063
SHA2567f4f426d5e8eac23e9b0f92a7217231c946cf050bf449e2f2983eca19e8a8f2e
SHA512a09f3fe24ac732de2e814f2c9acc2a65c62835c989b27dc9c1bfb400e9fa758a9e89c1d6b3bac0f364f4a264be51e851655645cce6ce810cb48d095d42305fb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b071581dfebf60cc3e97de0009eb1f7
SHA12e1a64e4f9327ba6765ece7b1a468a8f56000356
SHA256a1178aa0bc6d7bd187c4c741193d3e2b13245bff1d7d73ce94437de7c45b03e2
SHA5126952d6c1ae3436c562fa130f45fd2e23e5d368ed687cfdd75f72941ea067259ed5bea97c3a209771c4bc118854a2a97b95e1223cb933e11b8bdd1753d624cfd8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\76561199780418869[1].htm
Filesize33KB
MD5c98a6462e75fb848c7cd3e5203218bf9
SHA1e80f10787b4536cd09a6a10032c131f5cee66e85
SHA256f752a0905a011f2aa6c76190fe2dbd02c5531f56e40393b7d94ef52dbe14014e
SHA5124ea9ce1339e10a3ba3183b588916f65f39e2e517b92fe24ab15243075bc3e811490c20a12e61b29c445d8e8a03bf5d887281d4f27da1b1dafc7e8cbcd7b7fe69
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
371KB
MD5052eafad306073dc67e384f1f371c415
SHA127b45865e79e48634533d3971ddf2a0164c4f3bb
SHA2569136c32467cd79e8fdb7ea154540093c005c6cf636bc52d7af6caf170a1a828b
SHA512ad82848aca1d1c7af997c35ebd7fa6a04d01b8d09ab89f6ebeb41fd3c1b147507d6a110602fa3b6a6087b3d1ccf30d9e81f2b76af431da28dc81f4b3c6bd032d
-
Filesize
404KB
MD507beff810640c60bf60464f5e1efb5b0
SHA12af2ee421ae26a98f9775bfe46821ffb47b406d3
SHA2562161f38eb7e940f7dadbf1cff93e3219846ad9dd1d181aceadddd9b1f549bf70
SHA5121ed5082b2652d1253c13803c3607afe4befa564c03f1203a6ad157f0187482382d7a1438e34a95667495c89a6ebe020d838fe61ec7f697de865fc55a3b031fa5