7da1254753f2520d733f7dc27a5bbd7fca239953154e1eb8abf1c9981ceacc31

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/03/2025, 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc.msi
Size

21.1MB
MD5

e4d59f25997603b092e55b0041762565
SHA1

1906cb0da1f47fe137b284cc4c1f86eca8912cb7
SHA256

7da1254753f2520d733f7dc27a5bbd7fca239953154e1eb8abf1c9981ceacc31
SHA512

7bc341a0e7e212450639ba72d1761113e7b55568b6744e6485adb822c1c4895db6400bf6d025065cec5999935fb54568db30963f93aea918b9b51e2e911e0d82
SSDEEP

393216:ogAuec6b9ip//BFD7nrh8gaIy3tyVMdSenm4TXo:x9hZF3eLnY

Score

7^/10

collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Launchdemo_1.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 2084	2508	QQPlayer.exe	44
PID 2084 set thread context of 2164	2084	ftp.exe	46

Executes dropped EXE 12 IoCs

pid	Process
3012	ISBEW64.exe
1028	ISBEW64.exe
2196	ISBEW64.exe
2204	ISBEW64.exe
904	ISBEW64.exe
868	ISBEW64.exe
3048	ISBEW64.exe
2784	ISBEW64.exe
2856	ISBEW64.exe
1132	ISBEW64.exe
768	QQPlayer.exe
2508	QQPlayer.exe

Loads dropped DLL 57 IoCs

pid	Process
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
2684	MsiExec.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
768	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2084	ftp.exe
2084	ftp.exe
2164	Launchdemo_1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2180	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ftp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPlayer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
768	QQPlayer.exe
2508	QQPlayer.exe
2508	QQPlayer.exe
2084	ftp.exe
2084	ftp.exe
2164	Launchdemo_1.exe
2164	Launchdemo_1.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2508	QQPlayer.exe
2084	ftp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2180	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2180	msiexec.exe
Token: SeRestorePrivilege	2756	msiexec.exe
Token: SeTakeOwnershipPrivilege	2756	msiexec.exe
Token: SeSecurityPrivilege	2756	msiexec.exe
Token: SeCreateTokenPrivilege	2180	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2180	msiexec.exe
Token: SeLockMemoryPrivilege	2180	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2180	msiexec.exe
Token: SeMachineAccountPrivilege	2180	msiexec.exe
Token: SeTcbPrivilege	2180	msiexec.exe
Token: SeSecurityPrivilege	2180	msiexec.exe
Token: SeTakeOwnershipPrivilege	2180	msiexec.exe
Token: SeLoadDriverPrivilege	2180	msiexec.exe
Token: SeSystemProfilePrivilege	2180	msiexec.exe
Token: SeSystemtimePrivilege	2180	msiexec.exe
Token: SeProfSingleProcessPrivilege	2180	msiexec.exe
Token: SeIncBasePriorityPrivilege	2180	msiexec.exe
Token: SeCreatePagefilePrivilege	2180	msiexec.exe
Token: SeCreatePermanentPrivilege	2180	msiexec.exe
Token: SeBackupPrivilege	2180	msiexec.exe
Token: SeRestorePrivilege	2180	msiexec.exe
Token: SeShutdownPrivilege	2180	msiexec.exe
Token: SeDebugPrivilege	2180	msiexec.exe
Token: SeAuditPrivilege	2180	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2180	msiexec.exe
Token: SeChangeNotifyPrivilege	2180	msiexec.exe
Token: SeRemoteShutdownPrivilege	2180	msiexec.exe
Token: SeUndockPrivilege	2180	msiexec.exe
Token: SeSyncAgentPrivilege	2180	msiexec.exe
Token: SeEnableDelegationPrivilege	2180	msiexec.exe
Token: SeManageVolumePrivilege	2180	msiexec.exe
Token: SeImpersonatePrivilege	2180	msiexec.exe
Token: SeCreateGlobalPrivilege	2180	msiexec.exe
Token: SeCreateTokenPrivilege	2180	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2180	msiexec.exe
Token: SeLockMemoryPrivilege	2180	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2180	msiexec.exe
Token: SeMachineAccountPrivilege	2180	msiexec.exe
Token: SeTcbPrivilege	2180	msiexec.exe
Token: SeSecurityPrivilege	2180	msiexec.exe
Token: SeTakeOwnershipPrivilege	2180	msiexec.exe
Token: SeLoadDriverPrivilege	2180	msiexec.exe
Token: SeSystemProfilePrivilege	2180	msiexec.exe
Token: SeSystemtimePrivilege	2180	msiexec.exe
Token: SeProfSingleProcessPrivilege	2180	msiexec.exe
Token: SeIncBasePriorityPrivilege	2180	msiexec.exe
Token: SeCreatePagefilePrivilege	2180	msiexec.exe
Token: SeCreatePermanentPrivilege	2180	msiexec.exe
Token: SeBackupPrivilege	2180	msiexec.exe
Token: SeRestorePrivilege	2180	msiexec.exe
Token: SeShutdownPrivilege	2180	msiexec.exe
Token: SeDebugPrivilege	2180	msiexec.exe
Token: SeAuditPrivilege	2180	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2180	msiexec.exe
Token: SeChangeNotifyPrivilege	2180	msiexec.exe
Token: SeRemoteShutdownPrivilege	2180	msiexec.exe
Token: SeUndockPrivilege	2180	msiexec.exe
Token: SeSyncAgentPrivilege	2180	msiexec.exe
Token: SeEnableDelegationPrivilege	2180	msiexec.exe
Token: SeManageVolumePrivilege	2180	msiexec.exe
Token: SeImpersonatePrivilege	2180	msiexec.exe
Token: SeCreateGlobalPrivilege	2180	msiexec.exe
Token: SeCreateTokenPrivilege	2180	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2180	msiexec.exe
2180	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2684	2756	msiexec.exe	31
PID 2756 wrote to memory of 2684	2756	msiexec.exe	31
PID 2756 wrote to memory of 2684	2756	msiexec.exe	31
PID 2756 wrote to memory of 2684	2756	msiexec.exe	31
PID 2756 wrote to memory of 2684	2756	msiexec.exe	31
PID 2756 wrote to memory of 2684	2756	msiexec.exe	31
PID 2756 wrote to memory of 2684	2756	msiexec.exe	31
PID 2684 wrote to memory of 3012	2684	MsiExec.exe	32
PID 2684 wrote to memory of 3012	2684	MsiExec.exe	32
PID 2684 wrote to memory of 3012	2684	MsiExec.exe	32
PID 2684 wrote to memory of 3012	2684	MsiExec.exe	32
PID 2684 wrote to memory of 1028	2684	MsiExec.exe	33
PID 2684 wrote to memory of 1028	2684	MsiExec.exe	33
PID 2684 wrote to memory of 1028	2684	MsiExec.exe	33
PID 2684 wrote to memory of 1028	2684	MsiExec.exe	33
PID 2684 wrote to memory of 2196	2684	MsiExec.exe	34
PID 2684 wrote to memory of 2196	2684	MsiExec.exe	34
PID 2684 wrote to memory of 2196	2684	MsiExec.exe	34
PID 2684 wrote to memory of 2196	2684	MsiExec.exe	34
PID 2684 wrote to memory of 2204	2684	MsiExec.exe	35
PID 2684 wrote to memory of 2204	2684	MsiExec.exe	35
PID 2684 wrote to memory of 2204	2684	MsiExec.exe	35
PID 2684 wrote to memory of 2204	2684	MsiExec.exe	35
PID 2684 wrote to memory of 904	2684	MsiExec.exe	36
PID 2684 wrote to memory of 904	2684	MsiExec.exe	36
PID 2684 wrote to memory of 904	2684	MsiExec.exe	36
PID 2684 wrote to memory of 904	2684	MsiExec.exe	36
PID 2684 wrote to memory of 868	2684	MsiExec.exe	37
PID 2684 wrote to memory of 868	2684	MsiExec.exe	37
PID 2684 wrote to memory of 868	2684	MsiExec.exe	37
PID 2684 wrote to memory of 868	2684	MsiExec.exe	37
PID 2684 wrote to memory of 3048	2684	MsiExec.exe	38
PID 2684 wrote to memory of 3048	2684	MsiExec.exe	38
PID 2684 wrote to memory of 3048	2684	MsiExec.exe	38
PID 2684 wrote to memory of 3048	2684	MsiExec.exe	38
PID 2684 wrote to memory of 2784	2684	MsiExec.exe	39
PID 2684 wrote to memory of 2784	2684	MsiExec.exe	39
PID 2684 wrote to memory of 2784	2684	MsiExec.exe	39
PID 2684 wrote to memory of 2784	2684	MsiExec.exe	39
PID 2684 wrote to memory of 2856	2684	MsiExec.exe	40
PID 2684 wrote to memory of 2856	2684	MsiExec.exe	40
PID 2684 wrote to memory of 2856	2684	MsiExec.exe	40
PID 2684 wrote to memory of 2856	2684	MsiExec.exe	40
PID 2684 wrote to memory of 1132	2684	MsiExec.exe	41
PID 2684 wrote to memory of 1132	2684	MsiExec.exe	41
PID 2684 wrote to memory of 1132	2684	MsiExec.exe	41
PID 2684 wrote to memory of 1132	2684	MsiExec.exe	41
PID 2684 wrote to memory of 768	2684	MsiExec.exe	42
PID 2684 wrote to memory of 768	2684	MsiExec.exe	42
PID 2684 wrote to memory of 768	2684	MsiExec.exe	42
PID 2684 wrote to memory of 768	2684	MsiExec.exe	42
PID 768 wrote to memory of 2508	768	QQPlayer.exe	43
PID 768 wrote to memory of 2508	768	QQPlayer.exe	43
PID 768 wrote to memory of 2508	768	QQPlayer.exe	43
PID 768 wrote to memory of 2508	768	QQPlayer.exe	43
PID 2508 wrote to memory of 2084	2508	QQPlayer.exe	44
PID 2508 wrote to memory of 2084	2508	QQPlayer.exe	44
PID 2508 wrote to memory of 2084	2508	QQPlayer.exe	44
PID 2508 wrote to memory of 2084	2508	QQPlayer.exe	44
PID 2508 wrote to memory of 2084	2508	QQPlayer.exe	44
PID 2084 wrote to memory of 2164	2084	ftp.exe	46
PID 2084 wrote to memory of 2164	2084	ftp.exe	46
PID 2084 wrote to memory of 2164	2084	ftp.exe	46
PID 2084 wrote to memory of 2164	2084	ftp.exe	46

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Launchdemo_1.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\abc.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2180

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD85B149F8525EC11733B2D0DD22DF81 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EFAC5112-40EE-4605-8EA0-149BA976414A}
    3⤵
    - Executes dropped EXE
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A303A8ED-4C46-40EB-A172-AAECC6270A7E}
    3⤵
    - Executes dropped EXE
    PID:1028
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{770CAB30-0193-47A8-A638-D4AB985333C6}
    3⤵
    - Executes dropped EXE
    PID:2196
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F5D250EA-C18C-4601-9631-1DE9959BFF53}
    3⤵
    - Executes dropped EXE
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6D96ACF8-15F4-4885-B66D-33A1C9AF5D0B}
    3⤵
    - Executes dropped EXE
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3F661410-FD2C-4936-8FBC-015B2D114875}
    3⤵
    - Executes dropped EXE
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41B825AE-7DC2-4377-A5BF-41769BA8DCF5}
    3⤵
    - Executes dropped EXE
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E817519-E1D0-4880-9686-58B10C0451BA}
    3⤵
    - Executes dropped EXE
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CE720E48-1A70-401B-BB9F-B36B059C989D}
    3⤵
    - Executes dropped EXE
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{38E3B2C5-808C-46B9-8EEC-901133037BAD}
    3⤵
    - Executes dropped EXE
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe
    C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe
      C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\Windows\SysWOW64\ftp.exe
        
        C:\Windows\SysWOW64\ftp.exe
        5⤵
        Suspicious use of SetThreadContext
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe
        
        C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe
        6⤵
        Accesses Microsoft Outlook profiles
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        outlook_office_path
        
        PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI122A.tmp

Filesize
171KB

MD5
a0e940a3d3c1523416675125e3b0c07e

SHA1
2e29eeba6da9a4023bc8071158feee3b0277fd1b

SHA256
b8fa7aa425e4084ea3721780a13d11e08b8d53d1c5414b73f22faeca1bfd314f

SHA512
736ea06824388372aeef1938c6b11e66f4595e0b0589d7b4a87ff4abbabe52e82dff64d916293eab47aa869cf372ced2c66755dd8a8471b2ab0d3a37ba91d0b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI13EF.tmp

Filesize
2.5MB

MD5
ecb71be9e3f9a02edc1cad3cde1276ed

SHA1
15e9554b2aaf6613f64732352a6b62c3ec999206

SHA256
d549e6a37d39aa08c3a2718691d3c7589dba5f68036ab961d0b076627595dbb8

SHA512
4be026ba0f51cdf93910a535a0a6b22a32877ab13f6b061fb5772c238baf40864d3c9ad2c23b06de31b418941a746c0dcef631013a6a32beab88692d0aeac1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\AsyncTask.dll

Filesize
76KB

MD5
8ad07f53e87fcc18d62bd016ae18607d

SHA1
5dc05a1760c0c5530b7026192a103f8b6b71d987

SHA256
10ad2b5cee7cf2be73c8b5e33db376bf51af570e7365f7f8681670f8410f5883

SHA512
23118817c41c3c3123067a3b151939992d2c5548a8e7ddcacf2fef52cdd18e8f308a9ff796d8270a13ab1c383fb89bd97502451b515ef6a3244ba95ea6ae2ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\Common.dll

Filesize
1.7MB

MD5
db7f889a32083695ad19c0328f31503f

SHA1
d75d249716fd75623167c8d04ee68d2ab4a47148

SHA256
e3786ceef2b7207512140843702a2782f0c8351c486fda4c89081430c2980f55

SHA512
38bb16ef68e09d6a86b567ebc3c23f07152bbf1e5dadc7b27c6fff6fcfb9250ef23b364ea1171ba891b2dd7f97a740a592962856bcad0807698faabc05ceddfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\LIBEAY32.dll

Filesize
1.1MB

MD5
e709374bfc5d26439a4b626520d2dbbb

SHA1
4f0243611cfece832b086c2ed7ad2675ce11a203

SHA256
7cee2f68fa47f8f1657e9f5238b203b4966bd20cb3b506cb69c5da645a1cffde

SHA512
c0b55df21c615cea386825de0331325fbf2a1f0f78001d16ca30856c383427aec537edacff652e1b4bcc9e2b636b0d14505cedcfd6fa4c66ee3db7e4dfe12ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\LogManager.DLL

Filesize
611KB

MD5
02dddbe5c5305916b0d09566011d5c50

SHA1
f73b072c0074726f6fc0f2ca8a9b8bdd3881b9f5

SHA256
d25cb56b0090a015e4c759f44766a411203c01c3e76f02e5ad2b257954fd4e5f

SHA512
273d69422bd7095846a8f0cea596066a4c872987dd8ccac4806dac830b16ec02d98e3fa45fdd1f4ee76025d4a338cdc467ba1dde6758107008d735dd85030f20

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\MSVCP140.dll

Filesize
429KB

MD5
1d8c79f293ca86e8857149fb4efe4452

SHA1
7474e7a5cb9c79c4b99fdf9fb50ef3011bef7e8f

SHA256
c09b126e7d4c1e6efb3ffcda2358252ce37383572c78e56ca97497a7f7c793e4

SHA512
83c4d842d4b07ba5cec559b6cd1c22ab8201941a667e7b173c405d2fc8862f7e5d9703e14bd7a1babd75165c30e1a2c95f9d1648f318340ea5e2b145d54919b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\MSVCR100.dll

Filesize
763KB

MD5
26b2d9c49e69a59bea22558525f3d643

SHA1
b32a7c2413b6f4652b8822d6b08a581f7b9120b5

SHA256
092b59a6c1c778ecf56ce7219b103b0a547a14fe3bd94abdd7fdc0c894b31e8f

SHA512
d50cbd211d945576e2d8f87391f39dd30744ee6f6c940a2f1768c4e9bb3f6e90b443409414e97ca0957596922ebd4f865cf1f3384cdde96ba585461e80fb0aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QLCommon.dll

Filesize
755KB

MD5
8f3ffde27110d14e7e691e4f68d6154f

SHA1
cb880924c20523ebfbd14bac45e731d5dfc7ced0

SHA256
6005266d708e7a6a4a3b744a53a533b544f090b1714accb85746fb4c9bde967e

SHA512
300b81e225adc87c7ab475f76009d522ee82aef7a8147c207f7ea9d14a96499d763dffa3fe19f1ed7338cf68bb8b010a2733ac3b1030e17c5b038e252cb46f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayerBase.dll

Filesize
88KB

MD5
fd0d21afaa1112d34f2317ffd17431c6

SHA1
eec4b2316a70dd75a6ce87369ac32542d6207503

SHA256
d0fec47c045e08635d0ae5459cae2ce6a4a9f75a38d0aa44c8afd4478c7f9a44

SHA512
6c11b8357bf4dfbb3c4887789434a4055ed9b7408fb6e85594784288df3c72c21a54f78da9d72e56ec89bf82671ae77d83d265f1021d53a557ec1c40435955cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayerCommon.DLL

Filesize
132KB

MD5
4913889ebb2912c097887d1e19b257f7

SHA1
df1df63abc1ccfd372b0db117d202ca414cd90a1

SHA256
4e3c712a87bb8e39127f7d113f05f45ad88cee974fe72176118eb0fbdf3d89cd

SHA512
f78247a19d703a7bd3704f1765b2c813903abfa747eca02ff7f23faa2ac3b4c4faa94540e1c77632db4a3f1085b2cbd81cf4ab963e2a80c2ae308024015a5275

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayerStatistic.dll

Filesize
416KB

MD5
383267627150fb4ae75d7a2b7d19a671

SHA1
cc46021b1331a9756c82501e68b238c454a3d9e9

SHA256
6877d61fa6813a94bb52b798fca5a9cf413a8b7931bed93169bedab22db73e92

SHA512
f2bc1c16919342d5528e3a0b195187366e22a5be268fb74db072f1dbbebd813031136fb568a49316029c05c7a11f4e4437ac6d6e0c7d959eb71da59e364f9c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\VCRUNTIME140.dll

Filesize
83KB

MD5
b77eeaeaf5f8493189b89852f3a7a712

SHA1
c40cf51c2eadb070a570b969b0525dc3fb684339

SHA256
b7c13f8519340257ba6ae3129afce961f137e394dde3e4e41971b9f912355f5e

SHA512
a09a1b60c9605969a30f99d3f6215d4bf923759b4057ba0a5375559234f17d47555a84268e340ffc9ad07e03d11f40dd1f3fb5da108d11eb7f7933b7d87f2de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\arkFS.dll

Filesize
65KB

MD5
c3207d5d8b4df7a13b678fca4c34f324

SHA1
0ad8d445eef3e224650fb299e834901d25c50685

SHA256
74ea46fc311a23b0c40d97306abc5cab49ace283052f595d0bc9a80f97ac1a12

SHA512
60033aebe094b04bbdf83ada96c346073746a2973b983a79f2135be601ed37f7e931ab49f80116647eb0f11912b0e8853616f18a2af95a2c747f69729fd5f8cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\arkIOStub.dll

Filesize
25KB

MD5
e6f65df00571bfdbea3f32773bb2de8b

SHA1
f2574a80c5f3e047f0c1a48520ae37da62c8b80c

SHA256
7a4b53fb08494c424070e7dfdfe52b801179f930adae374459f074ca6bd99e19

SHA512
0f363869b0d214c80df335f05ef2a8b506bdcdd613a124f21492e7f9ad602dd7881f6ca16bf3ff8b04c45c7d94f361310b7978705f5c75c22826a142dd86c332

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libcurl.dll

Filesize
2.1MB

MD5
9c7232e92a2936844d753239233246cd

SHA1
89ed97229795281b5843686a70a1661b0aecdde7

SHA256
7de31f5ace824ea7dd845b71a6eedb921a04ded24bd4172d21d849879de17129

SHA512
03fc1c4e5a17eca99c76fc899df140e65984da7317d727cbe966a8df7ad83253192a647a55fce57795bdc27231ea1cf03252dd16ff7d5280e129c4a7bab777be

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libexpat.dll

Filesize
123KB

MD5
e92990c951fdf5adf27348c42ee4fd87

SHA1
cdf27bb4b12e2306e3144cc9355e8a1e4ab2611b

SHA256
d5c80d353fa48fe010f0652cd92c571dacded2f8321c83210a37a633f3ea8172

SHA512
0404b7598ef6db80cfee7df83bca2a16aff825e6a7a05ed11698fa745ddeb1f582306a113055cbe296fc17a9d68ec1a422b641166ba422d070f11d65310dd952

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\sqlite.dll

Filesize
560KB

MD5
6b2b8821b446ebd13ea195fc111be8b9

SHA1
e0848937c03c85ff7ed4eba6f5b185f7691b8276

SHA256
16d1c6b627e36b3fa8ce3b69c9a3a9792aa0fc03f71beaaf6808958da7206dc9

SHA512
66b62d1a5994df5bc2d2c9f35f1f3b983ab44949fcdbe50b61638ce94f12d07c486769860ca5cf0a51f69d8967e8e20acd8168cfdbce1ae41a1172b6f03e26e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\tinyxml.dll

Filesize
65KB

MD5
19f1ed1a772ea201af1e986df1e109c1

SHA1
d660df3e089edf616b44812fede39c3d62ad446c

SHA256
7dff6b0e5686076247d1d62854b0475d909056078cbfd44326b94f835bac8870

SHA512
525ea43fd1d85b73ac4404949214f09b1cfc516b7e898749ef7d73a5e209299e2e2d99f52260fbe1c254201b4350d78e5e17060cba13e9a5cc17c3333759ad0b

Download Submit
\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

Filesize
178KB

MD5
40f3a092744e46f3531a40b917cca81e

SHA1
c73f62a44cb3a75933cecf1be73a48d0d623039b

SHA256
561f14cdece85b38617403e1c525ff0b1b752303797894607a4615d0bd66f97f

SHA512
1589b27db29051c772e5ba56953d9f798efbf74d75e0524fa8569df092d28960972779811a7916198d0707d35b1093d3e0dd7669a8179c412cfa7df7120733b2

Download Submit
\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISRT.dll

Filesize
426KB

MD5
8af02bf8e358e11caec4f2e7884b43cc

SHA1
16badc6c610eeb08de121ab268093dd36b56bf27

SHA256
58a724d23c63387a2dda27ccfdbc8ca87fd4db671bea8bb636247667f6a5a11e

SHA512
d0228a8cc93ff6647c2f4ba645fa224dc9d114e2adb5b5d01670b6dafc2258b5b1be11629868748e77b346e291974325e8e8e1192042d7c04a35fc727ad4e3fd

Download Submit
\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\_isres_0x0409.dll

Filesize
1.8MB

MD5
7de024bc275f9cdeaf66a865e6fd8e58

SHA1
5086e4a26f9b80699ea8d9f2a33cead28a1819c0

SHA256
bd32468ee7e8885323f22eabbff9763a0f6ffef3cc151e0bd0481df5888f4152

SHA512
191c57e22ea13d13806dd390c4039029d40c7532918618d185d8a627aabc3969c7af2e532e3c933bde8f652b4723d951bf712e9ba0cc0d172dde693012f5ef1a

Download Submit
\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe

Filesize
257KB

MD5
597385a4d031b1ce29eb149e109d2056

SHA1
136786b1af5b7ea14f39d917c2854382dc90d48d

SHA256
9ffe2ee8c28ecd306328d61092cca5270c2c6f73b37c75d51c4f83d56bf02f56

SHA512
1fe6a85dc2332bffac5e25dc8a02c5e5ed084954ae50e747951489209a8027f39b3179d9b2912f11a382eeb4c4f309a66fa893db0e5e9e4aeb36d02e8418fe21

Download Submit
\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\zlib.dll

Filesize
79KB

MD5
5953ee89e5c1777f389bc6f571021110

SHA1
ccd673eb9ef3f5dd7d71afd7aeaf1297e198fbcd

SHA256
aedaae71c32fde725c894e68b6cdce302c9564b9fac08656d66e0be883dca93b

SHA512
89d271f9f6092d8cfe88b698f9c6359149c0666e849b1d7df94300535b9df67e46e1212ad33c124970cb42bdfbd101bd2b6e262fdc125ccee70159c0b0d62616

Download Submit
memory/768-118-0x0000000077210000-0x00000000773B9000-memory.dmp

Filesize
1.7MB

Download
memory/2084-163-0x0000000077210000-0x00000000773B9000-memory.dmp

Filesize
1.7MB

Download
memory/2084-166-0x0000000073AC0000-0x0000000073C34000-memory.dmp

Filesize
1.5MB

Download
memory/2164-175-0x0000000000160000-0x000000000047D000-memory.dmp

Filesize
3.1MB

Download
memory/2164-170-0x0000000000160000-0x000000000047D000-memory.dmp

Filesize
3.1MB

Download
memory/2164-171-0x0000000000160000-0x000000000047D000-memory.dmp

Filesize
3.1MB

Download
memory/2164-174-0x0000000000160000-0x000000000047D000-memory.dmp

Filesize
3.1MB

Download
memory/2164-176-0x0000000000160000-0x000000000047D000-memory.dmp

Filesize
3.1MB

Download
memory/2164-184-0x0000000000160000-0x000000000047D000-memory.dmp

Filesize
3.1MB

Download
memory/2164-185-0x0000000000160000-0x000000000047D000-memory.dmp

Filesize
3.1MB

Download
memory/2164-191-0x0000000000160000-0x000000000047D000-memory.dmp

Filesize
3.1MB

Download
memory/2164-192-0x0000000000160000-0x000000000047D000-memory.dmp

Filesize
3.1MB

Download
memory/2508-161-0x0000000077210000-0x00000000773B9000-memory.dmp

Filesize
1.7MB

Download
memory/2684-54-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/2684-57-0x0000000002E30000-0x0000000002FF7000-memory.dmp

Filesize
1.8MB

Download