bdaejec | ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168

Resubmissions

15-11-2024 10:26

241115-mgsreswpap 10

11-11-2024 20:56

241111-zrhenazjfm 10

Analysis

max time kernel
136s
max time network
147s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15-11-2024 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe
Size

776KB
MD5

3299acdbd8a544780abb6eae4668d1aa
SHA1

9e7a81e25b980faa44c4048171027eea865e874b
SHA256

ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168
SHA512

f468b7e85d5ccde05b025ee57d5e9f55286fc7d8fc4dd90b1e600f6f1ba30e6f73ec83cc9f2d88f245ab41d9659a5cb2637837f438f7234f942f5cc9a64fd6cd
SSDEEP

12288:FeTBslq08I3L92xhqmqUVWFxjPc/jxEnU2vMQs:UtI3L9WqdjPU67

Score

10^/10

bdaejec trickbot top115 aspackv2 backdoor banker discovery spyware stealer trojan

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Extracted

Family

trickbot

Version

100019

Botnet

top115

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Bdaejec family
bdaejec

Detects Bdaejec Backdoor. 2 IoCs

Bdaejec is backdoor written in C++.

Processes:

resource	yara_rule
behavioral1/memory/1196-11-0x0000000001130000-0x0000000001139000-memory.dmp	family_bdaejec_backdoor
behavioral1/memory/1196-53-0x0000000001130000-0x0000000001139000-memory.dmp	family_bdaejec_backdoor

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Trickbot family
trickbot

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
behavioral1/files/0x000a00000001202c-2.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exechrome.exechrome.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 14 IoCs

Processes:

BprpheQ.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeelevation_service.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	Process
1196	BprpheQ.exe
3052	chrome.exe
1128	chrome.exe
2516	chrome.exe
2776	chrome.exe
3040	chrome.exe
448	chrome.exe
840	chrome.exe
2324	elevation_service.exe
880	chrome.exe
1612	chrome.exe
2844	chrome.exe
2440	chrome.exe
316	chrome.exe

Loads dropped DLL 3 IoCs

Processes:

ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe

pid	Process
2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe
2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe
1200

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

Processes:

BprpheQ.exe

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\sidebar.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	BprpheQ.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE	BprpheQ.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaw.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	BprpheQ.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	BprpheQ.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	BprpheQ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exeBprpheQ.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BprpheQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

Processes:

ipconfig.exe

pid	Process
2192	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exe

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wermgr.exechrome.exe

description	pid	Process
Token: SeDebugPrivilege	2388	wermgr.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe

pid	Process
2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe
2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exeBprpheQ.execmd.exechrome.exe

description	pid	Process	procid_target
PID 2632 wrote to memory of 1196	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	30
PID 2632 wrote to memory of 1196	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	30
PID 2632 wrote to memory of 1196	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	30
PID 2632 wrote to memory of 1196	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	30
PID 2632 wrote to memory of 2388	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	31
PID 2632 wrote to memory of 2388	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	31
PID 2632 wrote to memory of 2388	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	31
PID 2632 wrote to memory of 2388	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	31
PID 2632 wrote to memory of 2504	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	32
PID 2632 wrote to memory of 2504	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	32
PID 2632 wrote to memory of 2504	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	32
PID 2632 wrote to memory of 2504	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	32
PID 2632 wrote to memory of 2388	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	31
PID 2632 wrote to memory of 2388	2632	ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe	31
PID 1196 wrote to memory of 2736	1196	BprpheQ.exe	34
PID 1196 wrote to memory of 2736	1196	BprpheQ.exe	34
PID 1196 wrote to memory of 2736	1196	BprpheQ.exe	34
PID 1196 wrote to memory of 2736	1196	BprpheQ.exe	34
PID 1500 wrote to memory of 2192	1500	cmd.exe	39
PID 1500 wrote to memory of 2192	1500	cmd.exe	39
PID 1500 wrote to memory of 2192	1500	cmd.exe	39
PID 3052 wrote to memory of 1128	3052	chrome.exe	41
PID 3052 wrote to memory of 1128	3052	chrome.exe	41
PID 3052 wrote to memory of 1128	3052	chrome.exe	41
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2516	3052	chrome.exe	43
PID 3052 wrote to memory of 2776	3052	chrome.exe	44

C:\Users\Admin\AppData\Local\Temp\ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe
"C:\Users\Admin\AppData\Local\Temp\ddc2c78d6f8510947bef12901b68da4f595e0733d9bc82434791d293cdc9e168.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\BprpheQ.exe
  C:\Users\Admin\AppData\Local\Temp\BprpheQ.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\3d677207.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2504

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4d89758,0x7fef4d89768,0x7fef4d89778
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2268 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2276 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1784 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1552 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 --field-trial-handle=1476,i,2062515949670806585,12731606035617640503,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:2440

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
1.6MB

MD5
ec6386b63c3a5ffe0577905e94262c3a

SHA1
8f8c428d0e7f32c9d733ca28384ded413a060588

SHA256
302c968ab3e1227d54df4e72f39088d7483d25eeb3037f0b16bc39cef2728fa4

SHA512
ddbefb759858493de1f9d7addc6ff4488c8be3164374e0a88c3cbe97751510005dfe6d91c5499fcbdc35aa33a8eda2d45591a66e54ab9462277dc833faef77c3

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
095092f4e746810c5829038d48afd55a

SHA1
246eb3d41194dddc826049bbafeb6fc522ec044a

SHA256
2f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588

SHA512
7f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\78c26ac1-f88e-4700-b3f3-68d7aa87b746.tmp

Filesize
356KB

MD5
4064f1b3e0abe6e3f6e8b4faa1bf8a08

SHA1
98881eb068b8e3e7cb7c7b139bad59bf9f3c5ddf

SHA256
2a7a72f6b282724d9397ca1a66202efa9a36177bb52c0a3c2c88defd2f404a82

SHA512
333a942d4990791f5382b949b068d4d5171025e1ef3806b98febb8c812e161e63869b94b2086ac93a96b9cfe9e866f47894c7e83aced924139123d6ab372db81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
afb6c08495e9c7c6ac18d7be63b66029

SHA1
11b295994fc2f07ea65fd42aaa1c7a4064b681a6

SHA256
6f5a94219f900ec965e1f770ddae2af1b0911c97d98ede1aa9a8c62965ee3145

SHA512
38000a4fa97ca7371798eb09ae1f9e846aea67e6a0b8043632b0e14885cd469bbfd057dc5d5b4867340e457bddd0c9cecaad60c8bbe6f46ee95f85858ca77537

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e384968d28c469218901f1f42bbcb66c

SHA1
b07f5236bea699795f5cb9d63dff86f56b08f2b5

SHA256
a9251d963e422951a21363be1ac091cb2b6909c4cc2e45062663a91e09759427

SHA512
2cbe5285fd8c13a2729918344bba66c586d95feb32c73ab3bac995546f62ab46f0959d34c880032ab98847ed41e089ac2e7a5966e820458baa3bacf1032b9bb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
177KB

MD5
7c9e1634826831dfbf70827361d47449

SHA1
6f18d6a178a7a2046880dfcc194ca6b3332f0eac

SHA256
ddd135354146e2f56dac71131807adf73b481f6f29f4094d307803a7c00f11cb

SHA512
9b53c2208e3b480b61dcadfd2150bef1a18e8e23fb988aea1bc99644c323aa6dc431a63ff0a0a00e63473eb0a7d1a2439595f2824b34620dbff3ace97314d557

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
372KB

MD5
d39d0897b4f4f18ed40ed0d8eee3ea10

SHA1
9066c1de872332f0813b8814d56e3dcd25f8bc3e

SHA256
164d2f230ae8b03f9f51d4f596f655b1e63c6e0c64877a1eb774803a10463fe4

SHA512
1392f2cc088c6eed547d4a8fa32bc76b08a68517ed360c2c23c85db2d778bad73a21304084d8d512ed05cea618a83e164923d4ae7eb26cafb1558a4c877e0706

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\k2[1].rar

Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3d677207.bat

Filesize
189B

MD5
d451dd9700ee76b26feec65b37606cb2

SHA1
c916558995815a14abf451dcc3bfd246a84188cf

SHA256
56b427e1a3d301cf8d017540bf21866a03dc3769216f6b660e32725e2b48d263

SHA512
1c8067678bdc9a0ab542a4f0dfc250efd8f5897562ced95fba36720a9777433ebfc2dab4d59a05da457c9f9e4c231dfa29d7bf7178b26c7f4e5782892fbf4734

Download Submit
C:\Users\Admin\AppData\Local\Temp\6FBB3AF1.exe

Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
\??\pipe\crashpad_3052_BQZQGOFVPOKCIPKL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files\Java\jre7\bin\javacpl.exe

Filesize
74KB

MD5
931b7ae616b78225bd2a3bcbbbb800ab

SHA1
530a78651469f64ea438d42ff67ab55b6f843ee5

SHA256
41cc8fa985caae53db27419b4bfa4aee82c135ec28dafa1cfdb43524ad323608

SHA512
6c6795a699216e3e28888774dba8eb4c80c1dfbb61fcaadd3c1e4ba3a5e88b5bd6502854517e34743cbea904b4e01aef13481a5517a0c03cd156ec1d28bbb1bf

Download Submit
\Users\Admin\AppData\Local\Temp\BprpheQ.exe

Filesize
15KB

MD5
f7d21de5c4e81341eccd280c11ddcc9a

SHA1
d4e9ef10d7685d491583c6fa93ae5d9105d815bd

SHA256
4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

SHA512
e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

Download Submit
memory/1196-53-0x0000000001130000-0x0000000001139000-memory.dmp

Filesize
36KB

Download
memory/1196-11-0x0000000001130000-0x0000000001139000-memory.dmp

Filesize
36KB

Download
memory/2388-31-0x0000000000060000-0x0000000000089000-memory.dmp

Filesize
164KB

Download
memory/2388-29-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2632-18-0x0000000000350000-0x000000000038C000-memory.dmp

Filesize
240KB

Download
memory/2632-0-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2632-22-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2632-30-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2632-19-0x0000000000660000-0x000000000069A000-memory.dmp

Filesize
232KB

Download
memory/2632-17-0x0000000000660000-0x000000000069A000-memory.dmp

Filesize
232KB

Download
memory/2632-13-0x0000000000390000-0x00000000003CF000-memory.dmp

Filesize
252KB

Download
memory/2632-21-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2632-55-0x0000000000660000-0x000000000069A000-memory.dmp

Filesize
232KB

Download
memory/2632-4-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download