blackmoon | 3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
Size

2.6MB
MD5

ee93f85ebd4faadb04fc34a3d7321a4e
SHA1

0ef87a6904b5f0668a66a12521f1737971c6bcee
SHA256

3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20
SHA512

8479b6b67727e3fe76cb6b9dc99d9c8cfee57ec24a14e5fce5fb477bcdc60b51db72055843e1f6c7a7c717e04241b5fe257b85ca0dba681e60ea1a6f2216b5d1
SSDEEP

49152:Mp6qkpHtyyj+KmfFYEMGjHOcI0zVGrlHOFhVcpP4Ru040vSwK:YQt1Lmf/HlFVGrlH2s4Ru040a

Score

10^/10

blackmoon banker discovery spyware stealer trojan upx

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 27 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023c71-6.dat	family_blackmoon
behavioral2/files/0x0008000000023c75-11.dat	family_blackmoon
behavioral2/memory/656-13-0x0000000002850000-0x0000000002A7F000-memory.dmp	family_blackmoon
behavioral2/memory/656-14-0x0000000002850000-0x0000000002A7F000-memory.dmp	family_blackmoon
behavioral2/memory/656-24-0x0000000002850000-0x0000000002A7F000-memory.dmp	family_blackmoon
behavioral2/memory/656-35-0x0000000002750000-0x0000000002761000-memory.dmp	family_blackmoon
behavioral2/memory/656-47-0x0000000002850000-0x0000000002A7F000-memory.dmp	family_blackmoon
behavioral2/memory/656-39-0x0000000002750000-0x0000000002761000-memory.dmp	family_blackmoon
behavioral2/memory/656-34-0x0000000002750000-0x0000000002761000-memory.dmp	family_blackmoon
behavioral2/memory/656-25-0x0000000002640000-0x000000000264F000-memory.dmp	family_blackmoon
behavioral2/memory/656-37-0x0000000002850000-0x0000000002A7F000-memory.dmp	family_blackmoon
behavioral2/memory/656-48-0x0000000002850000-0x0000000002A7F000-memory.dmp	family_blackmoon
behavioral2/memory/656-50-0x0000000002850000-0x0000000002A7F000-memory.dmp	family_blackmoon
behavioral2/memory/656-53-0x0000000000400000-0x0000000000891000-memory.dmp	family_blackmoon
behavioral2/memory/656-55-0x0000000002850000-0x0000000002A7F000-memory.dmp	family_blackmoon
behavioral2/memory/2760-57-0x0000000002580000-0x00000000027AF000-memory.dmp	family_blackmoon
behavioral2/memory/2760-85-0x00000000029A0000-0x00000000029B1000-memory.dmp	family_blackmoon
behavioral2/memory/2760-84-0x00000000029A0000-0x00000000029B1000-memory.dmp	family_blackmoon
behavioral2/memory/2760-75-0x0000000002850000-0x000000000285F000-memory.dmp	family_blackmoon
behavioral2/memory/2760-68-0x0000000002580000-0x00000000027AF000-memory.dmp	family_blackmoon
behavioral2/memory/2760-90-0x0000000002580000-0x00000000027AF000-memory.dmp	family_blackmoon
behavioral2/memory/2760-94-0x0000000002580000-0x00000000027AF000-memory.dmp	family_blackmoon
behavioral2/memory/2760-97-0x0000000002580000-0x00000000027AF000-memory.dmp	family_blackmoon
behavioral2/memory/2760-98-0x0000000000400000-0x0000000000891000-memory.dmp	family_blackmoon
behavioral2/memory/2760-101-0x0000000002580000-0x00000000027AF000-memory.dmp	family_blackmoon
behavioral2/memory/2760-102-0x0000000002580000-0x00000000027AF000-memory.dmp	family_blackmoon
behavioral2/memory/2760-103-0x0000000000400000-0x0000000000891000-memory.dmp	family_blackmoon

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	¾ýÁÙÌìÏÂ.exe
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	¾ýÁÙÌìÏÂ.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023c80-43.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	¾ýÁÙÌìÏÂ.exe

Executes dropped EXE 3 IoCs

pid	Process
2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
656	¾ýÁÙÌìÏÂ.exe
2760	¾ýÁÙÌìÏÂ.exe

Loads dropped DLL 2 IoCs

pid	Process
656	¾ýÁÙÌìÏÂ.exe
2760	¾ýÁÙÌìÏÂ.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\R:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\W:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\T:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\U:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\E:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\G:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\I:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\M:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\O:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\S:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\X:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\Z:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\H:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\J:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\K:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\L:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\P:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\B:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\N:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\Q:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\V:	¾ýÁÙÌìÏÂ.exe
File opened (read-only)	\??\Y:	¾ýÁÙÌìÏÂ.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvcp30.ini	¾ýÁÙÌìÏÂ.exe
File opened for modification	C:\Windows\SysWOW64\msvcp30.dll	¾ýÁÙÌìÏÂ.exe
File opened for modification	C:\Windows\SysWOW64\msvcp30.ini	¾ýÁÙÌìÏÂ.exe
File created	C:\Windows\SysWOW64\msvcp30.dll	¾ýÁÙÌìÏÂ.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/656-35-0x0000000002750000-0x0000000002761000-memory.dmp	upx
behavioral2/files/0x0007000000023c80-43.dat	upx
behavioral2/memory/656-44-0x00000000742A0000-0x00000000742DC000-memory.dmp	upx
behavioral2/memory/656-39-0x0000000002750000-0x0000000002761000-memory.dmp	upx
behavioral2/memory/656-34-0x0000000002750000-0x0000000002761000-memory.dmp	upx
behavioral2/memory/656-30-0x0000000002750000-0x0000000002761000-memory.dmp	upx
behavioral2/memory/656-56-0x00000000742A0000-0x00000000742DC000-memory.dmp	upx
behavioral2/memory/2760-85-0x00000000029A0000-0x00000000029B1000-memory.dmp	upx
behavioral2/memory/2760-89-0x0000000074270000-0x00000000742AC000-memory.dmp	upx
behavioral2/memory/2760-84-0x00000000029A0000-0x00000000029B1000-memory.dmp	upx
behavioral2/memory/2760-81-0x00000000029A0000-0x00000000029B1000-memory.dmp	upx
behavioral2/memory/2760-100-0x0000000074270000-0x00000000742AC000-memory.dmp	upx
behavioral2/memory/2760-105-0x0000000074270000-0x00000000742AC000-memory.dmp	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\msvcp30.dll	¾ýÁÙÌìÏÂ.exe
File opened for modification	C:\Windows\msvcp30.ico	¾ýÁÙÌìÏÂ.exe
File opened for modification	C:\Windows\msvcp30.ini	¾ýÁÙÌìÏÂ.exe
File opened for modification	C:\Windows\msvcp30.dll	¾ýÁÙÌìÏÂ.exe
File created	C:\Windows\msvcp30.ico	¾ýÁÙÌìÏÂ.exe
File opened for modification	C:\Windows\msvcp30.ini	¾ýÁÙÌìÏÂ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	¾ýÁÙÌìÏÂ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	¾ýÁÙÌìÏÂ.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe
4452	msedge.exe
4452	msedge.exe
888	identity_helper.exe
888	identity_helper.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
Token: SeDebugPrivilege	3240	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
Token: SeDebugPrivilege	2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
Token: SeDebugPrivilege	2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
Token: SeDebugPrivilege	2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
Token: SeDebugPrivilege	656	¾ýÁÙÌìÏÂ.exe
Token: SeDebugPrivilege	656	¾ýÁÙÌìÏÂ.exe
Token: SeDebugPrivilege	2760	¾ýÁÙÌìÏÂ.exe
Token: SeDebugPrivilege	2760	¾ýÁÙÌìÏÂ.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
3240	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
3240	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3240	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
656	¾ýÁÙÌìÏÂ.exe
2760	¾ýÁÙÌìÏÂ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 2176	3240	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe	82
PID 3240 wrote to memory of 2176	3240	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe	82
PID 3240 wrote to memory of 2176	3240	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe	82
PID 2176 wrote to memory of 656	2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe	84
PID 2176 wrote to memory of 656	2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe	84
PID 2176 wrote to memory of 656	2176	3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe	84
PID 656 wrote to memory of 2760	656	¾ýÁÙÌìÏÂ.exe	85
PID 656 wrote to memory of 2760	656	¾ýÁÙÌìÏÂ.exe	85
PID 656 wrote to memory of 2760	656	¾ýÁÙÌìÏÂ.exe	85
PID 2760 wrote to memory of 4452	2760	¾ýÁÙÌìÏÂ.exe	90
PID 2760 wrote to memory of 4452	2760	¾ýÁÙÌìÏÂ.exe	90
PID 4452 wrote to memory of 4416	4452	msedge.exe	91
PID 4452 wrote to memory of 4416	4452	msedge.exe	91
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 3476	4452	msedge.exe	92
PID 4452 wrote to memory of 1900	4452	msedge.exe	93
PID 4452 wrote to memory of 1900	4452	msedge.exe	93
PID 4452 wrote to memory of 2460	4452	msedge.exe	94
PID 4452 wrote to memory of 2460	4452	msedge.exe	94
PID 4452 wrote to memory of 2460	4452	msedge.exe	94
PID 4452 wrote to memory of 2460	4452	msedge.exe	94
PID 4452 wrote to memory of 2460	4452	msedge.exe	94
PID 4452 wrote to memory of 2460	4452	msedge.exe	94
PID 4452 wrote to memory of 2460	4452	msedge.exe	94
PID 4452 wrote to memory of 2460	4452	msedge.exe	94
PID 4452 wrote to memory of 2460	4452	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
"C:\Users\Admin\AppData\Local\Temp\3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Roaming\¾ýÁÙÌìÏÂ\3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe
  "C:\Users\Admin\AppData\Roaming\¾ýÁÙÌìÏÂ\3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Roaming\¾ýÁÙÌìÏÂ\¾ýÁÙÌìÏÂ.exe
    "C:\Users\Admin\AppData\Roaming\¾ýÁÙÌìÏÂ\¾ýÁÙÌìÏÂ.exe"
    3⤵
    - Drops file in Drivers directory
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Users\Admin\AppData\Roaming\¾ýÁÙÌìÏÂ\¾ýÁÙÌìÏÂ.exe
      "C:\Users\Admin\AppData\Roaming\¾ýÁÙÌìÏÂ\¾ýÁÙÌìÏÂ.exe" Master
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.30my.com/
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf4,0x78,0xec,0xf0,0x118,0x7ffb16ff46f8,0x7ffb16ff4708,0x7ffb16ff4718
        6⤵
        
        PID:4416
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        6⤵
        
        PID:3476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
        6⤵
        
        PID:2460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        6⤵
        
        PID:4872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        6⤵
        
        PID:3716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
        6⤵
        
        PID:780
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
        6⤵
        
        PID:2188
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
        6⤵
        
        PID:2164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
        6⤵
        
        PID:1704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
        6⤵
        
        PID:1028
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
        6⤵
        
        PID:2580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16305862091725319528,8393406642419945194,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:2
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
13b5f79ad37549d5e4abca1fd6ac701f

SHA1
4bd2ddb84a887ed059238bfa5701b197903dd9ae

SHA256
ccaaa2dd0dda3ba99fdb384296dea19fb8d9e51adcc56bfada3055d0f4f88d33

SHA512
0bb75a63c2d531a3c0add171c177cfa19df36ce63283d8f767e03c55dd79d6d73355492182ff9f027ac33a4eb9c29b0d626a1b58a3cdab0e262efca98412b67e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
62f4d6ea4b17ce4a5906ace189ed60e4

SHA1
08fab9894950e537143d80a7c78e2bb65209eebb

SHA256
6605611fbe56b33c12491c8118c3a3fc5a27456f74f9c5fbadd7e0ff6e3ea723

SHA512
8b596ede908031a0c954e684454b7a0fdac542a7a2122ccc9a20ec0a259bde2b84f934b329cdb3480a58fc0fccea95f66ab01885b8c9ed974bb06f0b2a539d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
85f3e38f9e17fe1ab82f94d64cd83c0f

SHA1
3108f24341831f450f844c76bd783d029c73995e

SHA256
fb3d3ab1e8180a1905078f19e93cc0031cafb238506465fdacb4306e782036c6

SHA512
ba4f9fe04771d912e371cc45d9ac49b3bca98a7f49d93385f33bf2bf763635a7ed0fcf3f029b08d8369f99599c7a6dfb9c04bc063d9604cb9bf3e3ab40444134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b63da2596b1c3edd19962a83e92d1096

SHA1
4c9b0ad5cb69af7a9a354daabc6e8837d625e980

SHA256
0d2db888e852b5a9d48443ec33a7dcccc2f4f61dbc1eab462385c0e735bbabf5

SHA512
146df1d7cd2b7bf9ea28a59637bce790d235243490445399c4ba8c41cc808bd84bd366dc4902f3dfca7413b70a69f9866bfec22906ab05a357991607751662a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a4c654c32d606cef88478df5a746bb92

SHA1
a68adb5773ade84a4e6e97a28d79c6a0251ddfa1

SHA256
bd86736fc3e7d5394471a9dd14212a62e2220bb1e76c42c861252a3a13373668

SHA512
f0f503762b462eef4bb41da8f8c895fb10d5ecf0175ec350d04caf84a100915ead425392353dea5a37f7b5f3638d05b6a8cc966dba5623d5df272ad05763b609

Download Submit
C:\Users\Admin\AppData\Roaming\¾ýÁÙÌìÏÂ\3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20.exe

Filesize
2.6MB

MD5
ee93f85ebd4faadb04fc34a3d7321a4e

SHA1
0ef87a6904b5f0668a66a12521f1737971c6bcee

SHA256
3068c17ad51cf407433cc89e71b9190e7fcd8c82f914785c0e9487d24de61b20

SHA512
8479b6b67727e3fe76cb6b9dc99d9c8cfee57ec24a14e5fce5fb477bcdc60b51db72055843e1f6c7a7c717e04241b5fe257b85ca0dba681e60ea1a6f2216b5d1

Download Submit
C:\Users\Admin\AppData\Roaming\¾ýÁÙÌìÏÂ\¾ýÁÙÌìÏÂ.exe

Filesize
4.5MB

MD5
08cfce375a93146a24759f7bbbeb7823

SHA1
6e7c44ced4eaf20201ada64118ee1b26c5d02678

SHA256
baeba054f69683238e8a87b27097254a0ce27d736967fc998eae9f80e4e0d42e

SHA512
ab049d59a998cf81f9e1718366fb72901482af8291c0e62fc85abdfa4b682625911be77d39c3b1aca5fcf3bd72971b6c6b26257b46fef0499f1e8a36076b01e3

Download Submit
C:\Users\Admin\Desktop\¾ýÁÙÌìÏÂ.lnk

Filesize
1KB

MD5
d4251ca4308eef229acf37365ff20833

SHA1
2d53addac64d01a4c4d301d8c1ae718260ec0047

SHA256
79c4c899fa175af57e618cec5f8ef23d3bdaa8adb15a1752d75233411f763227

SHA512
7aeea8fa1d82da149c7645066416d994d3e81a38629cddcd3d97d43d4371fab17e3d670caf01938985c82b4b855e990832ed41c863d244e70ef29638bd285974

Download Submit
C:\Users\Admin\Desktop\Ä§Óò·¢²¼Íø.url

Filesize
120B

MD5
5c8c7c3ce78aa0a9d56f96ab77676682

SHA1
1a591e2d34152149274f46d754174aa7a7bb2694

SHA256
40a172493bd1337c6bfd9c0af15be6d6e5d539135dd766577a05362e859ff806

SHA512
8ef03cf1967157cf019d1e7b585a45042642d5a1d82c90ef68f1256e40fe162460e7c26919b1fdf8c33de9f95201ee6a13e69676436d7251a017c04fdf047a77

Download Submit
C:\WINDOWS\system32\drivers\etc\hosts

Filesize
1KB

MD5
c06fec6d75762b5181389282098b299d

SHA1
bd823bd006cb0a6c18b8a155feb54672db799628

SHA256
af717e7dbdf0de9f042bdb55f6056f68d0d7b5cdf4c4de615ff36db496387ffe

SHA512
9a8f8423790ce0f30e4b1097279ce2020a90e388738ce264ec16a0b11e3d1d4f8abeb086e0c41b836409c7706ff58bd1e8d7f9870d48d15d6bd597f069d0d580

Download Submit
C:\Windows\SysWOW64\msvcp30.dll

Filesize
93KB

MD5
a6c4f055c797a43def0a92e5a85923a7

SHA1
efaa9c3a065aff6a64066f76e7c77ffcaaf779b2

SHA256
73bd285ac6fba28108cdc0d7311e37c4c4fc3ba7d0069c4370778ac3099e21a9

SHA512
d8120f7f59c212867c78af42f93db64d35f2d6eae7fc09021c0a6d8ca71a14bd2b2a3006027094ee2edcf65634dcdb3ac96da3ac810171fff021bed4c4254957

Download Submit
C:\Windows\SysWOW64\msvcp30.ini

Filesize
18B

MD5
2cd7883782c594d2e2654f8fe988fcbe

SHA1
042bcb87c29e901d70c0ad0f8fa53e0338c569fc

SHA256
aa98ce751ef6ac5401a9278f30c06e250dbbd5e8c2e2c378b0fdf33a205d7037

SHA512
88413dc63847682207d2b1e6cdfcb3de9cc73da5f900a1948e4aa262da20056bcb2486ee8a7c8a4f9b0aa3fdff6b99061262fbc67aebc99bf0b42e5bfc7db360

Download Submit
C:\Windows\msvcp30.ico

Filesize
264KB

MD5
bdccf3c42497089ae7001328305906ed

SHA1
cf6f28e09d98ebe516b408e6b15f03f5891fdc79

SHA256
5f191e3486c0bafdd237f8b79f6ce0f69d1f8c9f8c948d14ab061db36286b2f2

SHA512
d7876d8d414ca48903393aa523296ffe35bfa3c6b5bfc4ce70adfc93d31efa61a9bfeea571754cde2e205416e57c13df5c45551b5e6aae6eb53b951065ebbf5d

Download Submit
memory/656-55-0x0000000002850000-0x0000000002A7F000-memory.dmp

Filesize
2.2MB

Download
memory/656-34-0x0000000002750000-0x0000000002761000-memory.dmp

Filesize
68KB

Download
memory/656-48-0x0000000002850000-0x0000000002A7F000-memory.dmp

Filesize
2.2MB

Download
memory/656-50-0x0000000002850000-0x0000000002A7F000-memory.dmp

Filesize
2.2MB

Download
memory/656-51-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/656-53-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/656-56-0x00000000742A0000-0x00000000742DC000-memory.dmp

Filesize
240KB

Download
memory/656-25-0x0000000002640000-0x000000000264F000-memory.dmp

Filesize
60KB

Download
memory/656-13-0x0000000002850000-0x0000000002A7F000-memory.dmp

Filesize
2.2MB

Download
memory/656-14-0x0000000002850000-0x0000000002A7F000-memory.dmp

Filesize
2.2MB

Download
memory/656-19-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/656-24-0x0000000002850000-0x0000000002A7F000-memory.dmp

Filesize
2.2MB

Download
memory/656-35-0x0000000002750000-0x0000000002761000-memory.dmp

Filesize
68KB

Download
memory/656-47-0x0000000002850000-0x0000000002A7F000-memory.dmp

Filesize
2.2MB

Download
memory/656-44-0x00000000742A0000-0x00000000742DC000-memory.dmp

Filesize
240KB

Download
memory/656-39-0x0000000002750000-0x0000000002761000-memory.dmp

Filesize
68KB

Download
memory/656-37-0x0000000002850000-0x0000000002A7F000-memory.dmp

Filesize
2.2MB

Download
memory/656-30-0x0000000002750000-0x0000000002761000-memory.dmp

Filesize
68KB

Download
memory/2760-90-0x0000000002580000-0x00000000027AF000-memory.dmp

Filesize
2.2MB

Download
memory/2760-103-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/2760-98-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/2760-101-0x0000000002580000-0x00000000027AF000-memory.dmp

Filesize
2.2MB

Download
memory/2760-97-0x0000000002580000-0x00000000027AF000-memory.dmp

Filesize
2.2MB

Download
memory/2760-105-0x0000000074270000-0x00000000742AC000-memory.dmp

Filesize
240KB

Download
memory/2760-100-0x0000000074270000-0x00000000742AC000-memory.dmp

Filesize
240KB

Download
memory/2760-94-0x0000000002580000-0x00000000027AF000-memory.dmp

Filesize
2.2MB

Download
memory/2760-102-0x0000000002580000-0x00000000027AF000-memory.dmp

Filesize
2.2MB

Download
memory/2760-68-0x0000000002580000-0x00000000027AF000-memory.dmp

Filesize
2.2MB

Download
memory/2760-75-0x0000000002850000-0x000000000285F000-memory.dmp

Filesize
60KB

Download
memory/2760-81-0x00000000029A0000-0x00000000029B1000-memory.dmp

Filesize
68KB

Download
memory/2760-84-0x00000000029A0000-0x00000000029B1000-memory.dmp

Filesize
68KB

Download
memory/2760-89-0x0000000074270000-0x00000000742AC000-memory.dmp

Filesize
240KB

Download
memory/2760-85-0x00000000029A0000-0x00000000029B1000-memory.dmp

Filesize
68KB

Download
memory/2760-57-0x0000000002580000-0x00000000027AF000-memory.dmp

Filesize
2.2MB

Download