Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 09:59
Static task
static1
Behavioral task
behavioral1
Sample
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe
Resource
win10v2004-20241007-en
General
-
Target
setup_installer.exe
-
Size
3.3MB
-
MD5
937768008be3b71478be77f512943a75
-
SHA1
be2c1470c46eb18c49500dd5bb07a7cabe588398
-
SHA256
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
-
SHA512
0cba8d244ea822578021fdac8a215bf5ed2e6c3ff2d712bb01b4e80b004b8df326ac568ab682bb3d59a15cab6ff80b137b9fa9a66fe5b05438b8b6141d4ea469
-
SSDEEP
49152:xcBbNrb9o7jgMOHIT8SdFQE0+9DymbzgZklR2IM5AZ1UEEwJ84vLRaBtIl9mTScm:xerungqJnQrm/FP2wZ1WCvLUBsKScYv
Malware Config
Extracted
nullmixer
http://watira.xyz/
Extracted
redline
AniOLD
liezaphare.xyz:80
Signatures
-
Detect Fabookie payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_9.exe family_fabookie -
Fabookie family
-
Nullmixer family
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/2476-182-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/2476-182-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Sectoprat family
-
Vidar family
-
Detected Nirsoft tools 8 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
Processes:
resource yara_rule behavioral4/memory/4364-146-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/2768-143-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/1920-177-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/1544-180-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/5104-199-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/4368-202-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/408-211-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/4488-213-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft -
Vidar Stealer 1 IoCs
Processes:
resource yara_rule behavioral4/memory/2832-181-0x0000000000400000-0x00000000032A0000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\libcurlpp.dll aspack_v212_v242 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setup_installer.exesahiba_1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sahiba_1.exe -
Executes dropped EXE 22 IoCs
Processes:
setup_install.exesahiba_4.exesahiba_3.exesahiba_6.exesahiba_5.exesahiba_9.exesahiba_8.exesahiba_7.exesahiba_1.exesahiba_2.exesahiba_5.tmpsahiba_8.tmpsahiba_1.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exesahiba_4.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exepid process 1416 setup_install.exe 2356 sahiba_4.exe 2832 sahiba_3.exe 2444 sahiba_6.exe 1412 sahiba_5.exe 2064 sahiba_9.exe 1396 sahiba_8.exe 3192 sahiba_7.exe 3548 sahiba_1.exe 388 sahiba_2.exe 2724 sahiba_5.tmp 4236 sahiba_8.tmp 2248 sahiba_1.exe 2768 jfiag3g_gg.exe 4364 jfiag3g_gg.exe 1920 jfiag3g_gg.exe 1544 jfiag3g_gg.exe 2476 sahiba_4.exe 5104 jfiag3g_gg.exe 4368 jfiag3g_gg.exe 408 jfiag3g_gg.exe 4488 jfiag3g_gg.exe -
Loads dropped DLL 8 IoCs
Processes:
setup_install.exesahiba_5.tmpsahiba_8.tmppid process 1416 setup_install.exe 1416 setup_install.exe 1416 setup_install.exe 1416 setup_install.exe 1416 setup_install.exe 1416 setup_install.exe 2724 sahiba_5.tmp 4236 sahiba_8.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 ip-api.com 20 api.db-ip.com 22 api.db-ip.com 9 ipinfo.io 10 ipinfo.io -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sahiba_4.exedescription pid process target process PID 2356 set thread context of 2476 2356 sahiba_4.exe sahiba_4.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral4/memory/4364-146-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/2768-143-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/2768-134-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/1920-177-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/1544-180-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/5104-199-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/4368-202-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/408-211-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/4488-213-0x0000000000400000-0x000000000045B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4504 388 WerFault.exe sahiba_2.exe 4232 1416 WerFault.exe setup_install.exe 2780 2832 WerFault.exe sahiba_3.exe -
System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
jfiag3g_gg.exejfiag3g_gg.exesahiba_4.execmd.exesahiba_7.exesahiba_8.exesahiba_5.tmpjfiag3g_gg.execmd.execmd.exesahiba_5.exesahiba_1.execmd.exejfiag3g_gg.exesetup_installer.exejfiag3g_gg.execmd.exesahiba_3.exesahiba_9.exesahiba_4.exesahiba_8.tmpjfiag3g_gg.exejfiag3g_gg.execmd.exejfiag3g_gg.execmd.execmd.execmd.exesahiba_2.exesahiba_1.exesetup_install.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sahiba_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_install.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sahiba_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
sahiba_7.exepid process 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe 3192 sahiba_7.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
sahiba_6.exesahiba_4.exedescription pid process Token: SeDebugPrivilege 2444 sahiba_6.exe Token: SeDebugPrivilege 2476 sahiba_4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesahiba_5.exesahiba_8.exesahiba_4.exedescription pid process target process PID 2936 wrote to memory of 1416 2936 setup_installer.exe setup_install.exe PID 2936 wrote to memory of 1416 2936 setup_installer.exe setup_install.exe PID 2936 wrote to memory of 1416 2936 setup_installer.exe setup_install.exe PID 1416 wrote to memory of 2852 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2852 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2852 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 5020 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 5020 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 5020 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 116 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 116 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 116 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 4204 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 4204 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 4204 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2420 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2420 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2420 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 3004 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 3004 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 3004 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2256 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2256 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2256 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 3992 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 3992 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 3992 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2440 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2440 1416 setup_install.exe cmd.exe PID 1416 wrote to memory of 2440 1416 setup_install.exe cmd.exe PID 2852 wrote to memory of 3548 2852 cmd.exe sahiba_1.exe PID 2852 wrote to memory of 3548 2852 cmd.exe sahiba_1.exe PID 2852 wrote to memory of 3548 2852 cmd.exe sahiba_1.exe PID 5020 wrote to memory of 388 5020 cmd.exe sahiba_2.exe PID 5020 wrote to memory of 388 5020 cmd.exe sahiba_2.exe PID 5020 wrote to memory of 388 5020 cmd.exe sahiba_2.exe PID 4204 wrote to memory of 2356 4204 cmd.exe sahiba_4.exe PID 4204 wrote to memory of 2356 4204 cmd.exe sahiba_4.exe PID 4204 wrote to memory of 2356 4204 cmd.exe sahiba_4.exe PID 116 wrote to memory of 2832 116 cmd.exe sahiba_3.exe PID 116 wrote to memory of 2832 116 cmd.exe sahiba_3.exe PID 116 wrote to memory of 2832 116 cmd.exe sahiba_3.exe PID 3004 wrote to memory of 2444 3004 cmd.exe sahiba_6.exe PID 3004 wrote to memory of 2444 3004 cmd.exe sahiba_6.exe PID 2420 wrote to memory of 1412 2420 cmd.exe sahiba_5.exe PID 2420 wrote to memory of 1412 2420 cmd.exe sahiba_5.exe PID 2420 wrote to memory of 1412 2420 cmd.exe sahiba_5.exe PID 2440 wrote to memory of 2064 2440 cmd.exe sahiba_9.exe PID 2440 wrote to memory of 2064 2440 cmd.exe sahiba_9.exe PID 2440 wrote to memory of 2064 2440 cmd.exe sahiba_9.exe PID 3992 wrote to memory of 1396 3992 cmd.exe sahiba_8.exe PID 3992 wrote to memory of 1396 3992 cmd.exe sahiba_8.exe PID 3992 wrote to memory of 1396 3992 cmd.exe sahiba_8.exe PID 2256 wrote to memory of 3192 2256 cmd.exe sahiba_7.exe PID 2256 wrote to memory of 3192 2256 cmd.exe sahiba_7.exe PID 2256 wrote to memory of 3192 2256 cmd.exe sahiba_7.exe PID 1412 wrote to memory of 2724 1412 sahiba_5.exe sahiba_5.tmp PID 1412 wrote to memory of 2724 1412 sahiba_5.exe sahiba_5.tmp PID 1412 wrote to memory of 2724 1412 sahiba_5.exe sahiba_5.tmp PID 1396 wrote to memory of 4236 1396 sahiba_8.exe sahiba_8.tmp PID 1396 wrote to memory of 4236 1396 sahiba_8.exe sahiba_8.tmp PID 1396 wrote to memory of 4236 1396 sahiba_8.exe sahiba_8.tmp PID 2356 wrote to memory of 2476 2356 sahiba_4.exe sahiba_4.exe PID 2356 wrote to memory of 2476 2356 sahiba_4.exe sahiba_4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_1.exesahiba_1.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_1.exe" -a5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_2.exesahiba_2.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 3605⤵
- Program crash
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_3.exesahiba_3.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 10285⤵
- Program crash
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_4.exesahiba_4.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_4.exeC:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_4.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_5.exesahiba_5.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\is-GM86I.tmp\sahiba_5.tmp"C:\Users\Admin\AppData\Local\Temp\is-GM86I.tmp\sahiba_5.tmp" /SL5="$7003C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_5.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_6.exesahiba_6.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_7.exesahiba_7.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_8.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_8.exesahiba_8.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\is-FQC6B.tmp\sahiba_8.tmp"C:\Users\Admin\AppData\Local\Temp\is-FQC6B.tmp\sahiba_8.tmp" /SL5="$6021C,238351,154624,C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_8.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_9.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\7zS87B593B7\sahiba_9.exesahiba_9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /DeleteCookiesWildcard "*.facebook.com"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:408 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 5563⤵
- Program crash
PID:4232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1416 -ip 14161⤵PID:2944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 388 -ip 3881⤵PID:4224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2832 -ip 28321⤵PID:4296
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
700B
MD5e5352797047ad2c91b83e933b24fbc4f
SHA19bf8ac99b6cbf7ce86ce69524c25e3df75b4d772
SHA256b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c
SHA512dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
Filesize
323KB
MD5bb7409da9c80af6ca5ef4fdb40b08ed7
SHA1f415c4ab1ad47e2f14f5be85386d0f3537bebf78
SHA2566c64ee41cc2643df2f95efde9a4ab31c71bef2af1371c71931fd216e93209c2e
SHA5129b3fad8a7ead617be9b76a9b6bd6b3bb12f99362446609e5591e2609f4b13cb26271c4fce194627031be2633f274c2b95fd0fdb591ae798be4a413d7df3a7611
-
Filesize
660KB
MD54fa4a626bfe65bbb3ba048e66170556a
SHA105e0beeedc4a183056292c36cc87a9822f3a19af
SHA2567e1282097df8513b7a380803f31386373c178bb97102862d6a08816c0a8902f4
SHA5123236f3a9baf67ec60e1fef21c7c053df5f33d70b8fad9146ad45f2d9f55c9db95e468d5edabb6658a43bb11776a813f0a5448b560b7939f35a38490c2345e7cd
-
Filesize
390KB
MD5eb73f48eaf544bf7e035a58f95f73394
SHA1251f0d09f14452538ecfa0924a4618c3c16887e3
SHA256da72fa2ad767e22db3d55506846b5d4db7932cd7287391c483faa80c5e86bcce
SHA512a190b5e95308aa2a855dbb6c93841fbfbd79bd3c04b3f3c90e94b88c35c0409de68c39f31373b7dce38998ecdc35064541efad17f63978e14022ec9efac3b4c1
-
Filesize
749KB
MD54b300abf0da6582cde1e9ec29c214abf
SHA173ff7d346dd476d34236cbeb67268dcf0af570ac
SHA256783242dd1841ef1e7b62d7004291bfe3cd20816109dcd6932ec797aa5e6f09ff
SHA512d9c3a11830da2e39cd9b6b0e476f5a6bca7fe94d0a6300e838118bed998bde79c30f25ed758fba459d81ae06a87d9fc708eae318126c47529b23b4d17fba4587
-
Filesize
170KB
MD5255aac71617edb0cc31709ef30fbee0a
SHA198ef84fd1e1cc4ff60a52bab85d00db7093a8f01
SHA256d0812c78e146d7774b25061dbdabae004fefc503ea363b441fa691add1eef26b
SHA5122d2ae0e917453a52ab374ae4f0b12a4ec3e16ecf3c6aff2352a3daa187f189c000adc241ea48077fb7c1fbfc36cfa6702969a70a25502cc7db5ec9ef554121bc
-
Filesize
1.2MB
MD53011f2257b899aa8196e02447383a46b
SHA1cb90ff25622aa5e5e20e257f6c6cb3ce58bd6940
SHA2564df50c6d6d188c3413bdba53851cbeea7b281b92b0d5341c021a65912395fa5b
SHA512db29dcb83a786af54720ad0a6db69949f3479c95cc940e005b803000e28d00a5dbe3d68b075215c8c4c4f804986e9c3839a3de3a93751725326e1b62ef420323
-
Filesize
480KB
MD5c06e890154e59a75f67e2d37295c2bc9
SHA1e6deea575d36331a0c2f8d42586442c43f5d58b8
SHA25676d4acbc47089e7b075834a63bd148062da9d01b2d9bfada50dbe2bfc500cd97
SHA5123d64c2a95e738b50e1ae8a048fac79d974118e86fbdb6fde537a891bfa9a7dbbaeeaf068d3f7432567d1bf2f93b96182a61f49a71f718847f99ee1de3649ad5c
-
Filesize
983KB
MD5270dd1da0ab7f38cdff6fab84562ec7a
SHA1cf7be169ee4415085baeb4aeaa60932ac5abf4ac
SHA2567d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6
SHA512dc3d7d112a8e43c34261f3425ef6710d61cb92d797dd4a1e9b04e02971db42a4a2e2488bf5397c0ec9a6a1a6a718cec77c379377647402099cb7e4a5bb381286
-
Filesize
287KB
MD53e6e91a0a2292b94b83916d430ad0db5
SHA1ccbde14c585446acbfc7b981fdae3ec4f473b3b9
SHA2564ff18dc2fe0d3a6522a7bccb363eefce100f52d9da3566a3f4954ae0cae9f2fb
SHA51274757b04a31fc52f76b8bb079323616f3f5086405a61069d4b483d046c924f379b51fdb5f3686c4beaac5665c7b7bef4efc058ef5bc8cba30fde95a77ca9b11a
-
Filesize
31B
MD5b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
Filesize
790KB
MD51623272fc3047895b1db3c60b2dd7bc5
SHA1772e1f9d062d8b98d241ae54414c814b8a6610bb
SHA25689b72c11ec6a19aeb26bc5305912b5b734e732211fe12160d3a07507a0fd99c1
SHA512135c85f2f2eba58f6f64a218f5a4e76a57d97906d50fa9877fa5b9292bc34a341dda0b72470736019e1031403be32f7505cf3f797502292fe97c29adbc8daa73
-
Filesize
1.0MB
MD5b6cee06d96499009bc0fddd23dc935aa
SHA1ffaef1baa4456b6e10bb40c2612dba7b18743d01
SHA2569553aee4cfe474165afa02a4f89455aaba3e27fe03bfda46ec85ec7c6f01574f
SHA512b710767c8802981495368f0b4e0dd87a4b04833b974e6b82605c92a8303b1cf5525634b3c34a1e251193c73c59579aa15704260c3898a2d49f641770b2d95b4f
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
216KB
MD58f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
Filesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4