Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
031020240441x.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
031020240441x.exe
Resource
win10v2004-20240802-en
General
-
Target
031020240441x.exe
-
Size
1.5MB
-
MD5
ecf3199706ba49d6bb45b0e34a310a80
-
SHA1
777c33cac377231d97a0e0b710b6ba44840d2548
-
SHA256
866e2794cc1ae74f3b18b3cfd3e98edea83f6eaf2bf3121f88df4caf2f2e0fd1
-
SHA512
d6965a55bacc37350175f9000b4537cce571840f6e2922c7b826744567cb63a203fc7bd6c50b1b70ec73a5be0fe14fef62118d1b0ef007782ea51e41a37e7871
-
SSDEEP
24576:SMPbnR3IqWwQ16oEMN22K+mEZ+JNP+jK37K3evi91e:SMl49tRYjde+v93Fa9
Malware Config
Extracted
Protocol: smtp- Host:
s82.gocheapweb.com - Port:
587 - Username:
[email protected] - Password:
london@1759
Extracted
agenttesla
Protocol: smtp- Host:
s82.gocheapweb.com - Port:
587 - Username:
[email protected] - Password:
london@1759 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 62 IoCs
resource yara_rule behavioral2/memory/5064-3-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-7-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-8-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-11-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-16-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-26-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-50-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-66-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-65-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-64-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-63-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-61-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-60-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-59-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-58-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-56-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-57-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-55-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-53-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-52-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-51-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-49-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-46-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-44-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-43-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-41-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-40-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-39-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-37-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-35-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-34-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-62-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-33-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-31-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-54-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-28-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-48-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-47-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-25-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-45-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-24-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-42-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-23-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-22-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-38-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-21-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-36-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-20-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-19-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-32-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-18-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-30-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-29-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-17-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-27-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-15-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-14-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-13-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-12-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-10-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/5064-9-0x0000000002DC0000-0x0000000003DC0000-memory.dmp modiloader_stage2 behavioral2/memory/4032-667-0x0000000140000000-0x0000000140155000-memory.dmp modiloader_stage2 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1460 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation lxsyrsiW.pif Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation server_BTC.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk server_BTC.exe -
Executes dropped EXE 18 IoCs
pid Process 3696 alpha.pif 840 alpha.pif 2552 alpha.pif 2340 xpha.pif 4460 per.exe 3644 pha.pif 3720 alpha.pif 2824 alpha.pif 5108 alpha.pif 4248 lxsyrsiW.pif 4536 alg.exe 1412 neworigin.exe 4088 server_BTC.exe 3640 elevation_service.exe 2808 elevation_service.exe 4032 maintenanceservice.exe 2936 OSE.EXE 4940 TrojanAIbot.exe -
Loads dropped DLL 1 IoCs
pid Process 4460 per.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wisrysxl = "C:\\Users\\Public\\Wisrysxl.url" 031020240441x.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 27 drive.google.com 24 drive.google.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 72 api.ipify.org 73 api.ipify.org -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe lxsyrsiW.pif File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7c2e1037240c1bce.bin alg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5064 set thread context of 4248 5064 031020240441x.exe 116 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91656\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 031020240441x.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxsyrsiW.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server_BTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neworigin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TrojanAIbot.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3988 esentutl.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4388 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2792 schtasks.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 27 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 29 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4940 TrojanAIbot.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3644 pha.pif 3644 pha.pif 3644 pha.pif 1412 neworigin.exe 1412 neworigin.exe 1412 neworigin.exe 1460 powershell.exe 1460 powershell.exe 1460 powershell.exe 1412 neworigin.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3644 pha.pif Token: SeTakeOwnershipPrivilege 4248 lxsyrsiW.pif Token: SeDebugPrivilege 1412 neworigin.exe Token: SeDebugPrivilege 4088 server_BTC.exe Token: SeDebugPrivilege 1460 powershell.exe Token: SeDebugPrivilege 4940 TrojanAIbot.exe Token: SeDebugPrivilege 4536 alg.exe Token: SeDebugPrivilege 4536 alg.exe Token: SeDebugPrivilege 4536 alg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4236 5064 031020240441x.exe 96 PID 5064 wrote to memory of 4236 5064 031020240441x.exe 96 PID 5064 wrote to memory of 4236 5064 031020240441x.exe 96 PID 4236 wrote to memory of 4324 4236 cmd.exe 99 PID 4236 wrote to memory of 4324 4236 cmd.exe 99 PID 4236 wrote to memory of 4324 4236 cmd.exe 99 PID 4236 wrote to memory of 3988 4236 cmd.exe 100 PID 4236 wrote to memory of 3988 4236 cmd.exe 100 PID 4236 wrote to memory of 3988 4236 cmd.exe 100 PID 4236 wrote to memory of 3696 4236 cmd.exe 101 PID 4236 wrote to memory of 3696 4236 cmd.exe 101 PID 4236 wrote to memory of 3696 4236 cmd.exe 101 PID 4236 wrote to memory of 840 4236 cmd.exe 102 PID 4236 wrote to memory of 840 4236 cmd.exe 102 PID 4236 wrote to memory of 840 4236 cmd.exe 102 PID 4236 wrote to memory of 2552 4236 cmd.exe 103 PID 4236 wrote to memory of 2552 4236 cmd.exe 103 PID 4236 wrote to memory of 2552 4236 cmd.exe 103 PID 2552 wrote to memory of 2340 2552 alpha.pif 104 PID 2552 wrote to memory of 2340 2552 alpha.pif 104 PID 2552 wrote to memory of 2340 2552 alpha.pif 104 PID 4236 wrote to memory of 4460 4236 cmd.exe 107 PID 4236 wrote to memory of 4460 4236 cmd.exe 107 PID 4460 wrote to memory of 4824 4460 per.exe 108 PID 4460 wrote to memory of 4824 4460 per.exe 108 PID 4460 wrote to memory of 3644 4460 per.exe 110 PID 4460 wrote to memory of 3644 4460 per.exe 110 PID 4236 wrote to memory of 3720 4236 cmd.exe 112 PID 4236 wrote to memory of 3720 4236 cmd.exe 112 PID 4236 wrote to memory of 3720 4236 cmd.exe 112 PID 4236 wrote to memory of 2824 4236 cmd.exe 113 PID 4236 wrote to memory of 2824 4236 cmd.exe 113 PID 4236 wrote to memory of 2824 4236 cmd.exe 113 PID 4236 wrote to memory of 5108 4236 cmd.exe 114 PID 4236 wrote to memory of 5108 4236 cmd.exe 114 PID 4236 wrote to memory of 5108 4236 cmd.exe 114 PID 5064 wrote to memory of 5032 5064 031020240441x.exe 115 PID 5064 wrote to memory of 5032 5064 031020240441x.exe 115 PID 5064 wrote to memory of 5032 5064 031020240441x.exe 115 PID 5064 wrote to memory of 4248 5064 031020240441x.exe 116 PID 5064 wrote to memory of 4248 5064 031020240441x.exe 116 PID 5064 wrote to memory of 4248 5064 031020240441x.exe 116 PID 5064 wrote to memory of 4248 5064 031020240441x.exe 116 PID 5064 wrote to memory of 4248 5064 031020240441x.exe 116 PID 4248 wrote to memory of 1412 4248 lxsyrsiW.pif 119 PID 4248 wrote to memory of 1412 4248 lxsyrsiW.pif 119 PID 4248 wrote to memory of 1412 4248 lxsyrsiW.pif 119 PID 4248 wrote to memory of 4088 4248 lxsyrsiW.pif 120 PID 4248 wrote to memory of 4088 4248 lxsyrsiW.pif 120 PID 4248 wrote to memory of 4088 4248 lxsyrsiW.pif 120 PID 4088 wrote to memory of 1460 4088 server_BTC.exe 125 PID 4088 wrote to memory of 1460 4088 server_BTC.exe 125 PID 4088 wrote to memory of 1460 4088 server_BTC.exe 125 PID 4088 wrote to memory of 2792 4088 server_BTC.exe 126 PID 4088 wrote to memory of 2792 4088 server_BTC.exe 126 PID 4088 wrote to memory of 2792 4088 server_BTC.exe 126 PID 4088 wrote to memory of 4940 4088 server_BTC.exe 129 PID 4088 wrote to memory of 4940 4088 server_BTC.exe 129 PID 4088 wrote to memory of 4940 4088 server_BTC.exe 129 PID 4088 wrote to memory of 2652 4088 server_BTC.exe 130 PID 4088 wrote to memory of 2652 4088 server_BTC.exe 130 PID 4088 wrote to memory of 2652 4088 server_BTC.exe 130 PID 2652 wrote to memory of 4388 2652 cmd.exe 132 PID 2652 wrote to memory of 4388 2652 cmd.exe 132
Processes
-
C:\Users\Admin\AppData\Local\Temp\031020240441x.exe"C:\Users\Admin\AppData\Local\Temp\031020240441x.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o3⤵PID:4324
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3988
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3696
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:840
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 104⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2340
-
-
-
C:\Windows \SysWOW64\per.exe"C:\\Windows \\SysWOW64\\per.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SYSTEM32\esentutl.exeesentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o4⤵PID:4824
-
-
C:\Users\Public\pha.pifC:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3720
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW643⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5108
-
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\031020240441x.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o2⤵PID:5032
-
-
C:\Users\Public\Libraries\lxsyrsiW.pifC:\Users\Public\Libraries\lxsyrsiW.pif2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\neworigin.exe"C:\Users\Admin\AppData\Local\Temp\neworigin.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
C:\Users\Admin\AppData\Local\Temp\server_BTC.exe"C:\Users\Admin\AppData\Local\Temp\server_BTC.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 08:39 /du 23:59 /sc daily /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2792
-
-
C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe"C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB06A.tmp.cmd""4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\timeout.exetimeout 65⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4388
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4260,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:81⤵PID:2984
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3640
-
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2808
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4032
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2936
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD55794358d09117f1ad4c19830c13cc834
SHA159c171e7059521321131652fbd6ed697908b07bb
SHA256b6def83bb2a9f9c6b71151f0aed4a786298a35dadaae58e0abf676673f3781ad
SHA5124ccd8ef730e24f7e7c099952818c2c894a48f17510dfcc0511efb4cd6d9cb3cf0053e4d06206d41d8c489996079542fe9b352d21c1a4cb1d4e7f56aeb3e513d8
-
Filesize
1.3MB
MD533ef255d7e11f548d04db856030081b5
SHA1730d291cc8f260dec6fa9a1fb29a35ef8fb9b152
SHA2562f9cd113cd6bd87befb6389b2e308f0180623c58a5b99a150316c7064bf55e8b
SHA512a6340af3cf9c48a24cc900f280bece2aedddb8e5d91df81fb23651e5f369096e8880b19503a5683a4321844c877507a22e2812d384c3fab85febd080c9f491b8
-
Filesize
1.3MB
MD50126fb772af0d18cb01a1b4a70c96d81
SHA1248ea4f5e8277ba70e15bde878e8c539407e11aa
SHA256fc95531d874b2fc2b047859b75dabf3070a38adb3b5cbbdf12d65c668c713057
SHA512654917b53704712005a5ba7a6a70bbf0ac8141d7e63c63613445abfd441eacb383b7a22384ff4fb8282274a191480bc85d052b886287503b4dd9d4df5b7911cc
-
Filesize
2.1MB
MD5bd655621518bdb5227784bb523f0d3a0
SHA1528981bd902fdf360f3abd6b0174cb9432ed7677
SHA256a2fb2cfee80d5db6c9809d23311aba31df333743062a1058b31225c30d63fea7
SHA5126be6ff616cc91b5098824bd0a15f0899c9482207bd31653816c261f66a89802df9d247cdc2434cd573ca0e96fdc5ba4824185da95ef58121624f29ea15fc4982
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
244KB
MD5d6a4cf0966d24c1ea836ba9a899751e5
SHA1392d68c000137b8039155df6bb331d643909e7e7
SHA256dc441006cb45c2cfac6c521f6cd4c16860615d21081563bd9e368de6f7e8ab6b
SHA5129fa7aa65b4a0414596d8fd3e7d75a09740a5a6c3db8262f00cb66cd4c8b43d17658c42179422ae0127913deb854db7ed02621d0eeb8ddff1fac221a8e0d1ca35
-
Filesize
226KB
MD550d015016f20da0905fd5b37d7834823
SHA16c39c84acf3616a12ae179715a3369c4e3543541
SHA25636fe89b3218d2d0bbf865967cdc01b9004e3ba13269909e3d24d7ff209f28fc5
SHA51255f639006a137732b2fa0527cd1be24b58f5df387ce6aa6b8dd47d1419566f87c95fc1a6b99383e8bd0bcba06cc39ad7b32556496e46d7220c6a7b6d8390f7fc
-
Filesize
162B
MD57760a6c17b0be32be8b2d49f4f349d88
SHA11db7a3c830ae47cfa6458f60038f153b1807fc40
SHA25674e3be04fa37bbfc45d8669c101dd416a79128260abee875d1081a4f524accda
SHA512c92cbac54aad1a400c51aed6e0c78bde98ab03d3173054b25f01c24cbda07dfd374b338f10effad688ba81835239ff1da2d5f0993bd6776c86accdaf32b268a4
-
Filesize
60KB
MD5b87f096cbc25570329e2bb59fee57580
SHA1d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA51272901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
-
Filesize
66KB
MD5c116d3604ceafe7057d77ff27552c215
SHA1452b14432fb5758b46f2897aeccd89f7c82a727d
SHA2567bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA5129202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
18KB
MD5b3624dd758ccecf93a1226cef252ca12
SHA1fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA2564aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838
-
Filesize
115KB
MD56d23fe871b2064c6d13580a5745f23cb
SHA150e113c0e2269cf7972466a828822803537a8f6e
SHA256c835f2a1234b62ab7684694af378f62770903d07d6fdfbe3a371509e2b4ccc67
SHA5121244be1ab0a9cabc0eb02249d4b083939e3f088ebda4b58dc03c61618fce56f27a3f58cfd74d39fb06010db7515520307766c16815f6700507a0371d03765e1a
-
Filesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7
-
Filesize
1.2MB
MD5f765f550ecce38059937ebadc31cc5ce
SHA12072edbefb70e5de236564a8f9ee2a1499ce9fe6
SHA25669756659461be78d298a6b940cbcc98b5fb570dde06f1bdbab0a51c08e511bf0
SHA512ebb5ad2a6c45508c3117ead95da6f9e0097b470dbfe2add8d92d5a3ba6d7a3f9a31a0929c634645f5b3406c0bfdd951d7247e512fe7308e4e02cdf62b39705c2