Overview
overview
10Static
static
103c7b097b31...0f.exe
windows7-x64
83c7b097b31...0f.exe
windows10-2004-x64
83c8a6c6cde...86.exe
windows7-x64
103c8a6c6cde...86.exe
windows10-2004-x64
103ca3e4676b...f1.exe
windows7-x64
103ca3e4676b...f1.exe
windows10-2004-x64
103cb47c4bbe...c1.exe
windows7-x64
103cb47c4bbe...c1.exe
windows10-2004-x64
103d18edb3bf...ff.exe
windows7-x64
13d18edb3bf...ff.exe
windows10-2004-x64
3d1ee6caf0...b4.exe
windows7-x64
103d1ee6caf0...b4.exe
windows10-2004-x64
103d2f05086d...0c.exe
windows7-x64
103d2f05086d...0c.exe
windows10-2004-x64
103d81f411b0...ba.exe
windows7-x64
103d81f411b0...ba.exe
windows10-2004-x64
103d90976d58...8c.exe
windows7-x64
103d90976d58...8c.exe
windows10-2004-x64
103d97ea72c5...9e.exe
windows7-x64
103d97ea72c5...9e.exe
windows10-2004-x64
103dd452b939...18.exe
windows7-x64
33dd452b939...18.exe
windows10-2004-x64
33dfc71cfc4...bd.exe
windows7-x64
103dfc71cfc4...bd.exe
windows10-2004-x64
103e435c9ff2...57.exe
windows7-x64
103e435c9ff2...57.exe
windows10-2004-x64
103e624f48a8...2b.exe
windows7-x64
13e624f48a8...2b.exe
windows10-2004-x64
43e8acfab95...cc.exe
windows7-x64
103e8acfab95...cc.exe
windows10-2004-x64
103e9a136b97...9d.exe
windows7-x64
103e9a136b97...9d.exe
windows10-2004-x64
10Analysis
-
max time kernel
102s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:25
Behavioral task
behavioral1
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win7-20250207-en
Behavioral task
behavioral16
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral27
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win10v2004-20250314-en
General
-
Target
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
-
Size
587KB
-
MD5
58388ff123bd5e52aa3e7fa34cfa8a7f
-
SHA1
6b43aa7430ad9e446acf2f8d04ecb8f6b6eaa4c5
-
SHA256
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c
-
SHA512
a4b5405d5e0c4f555e151c207c2d6d38e52b3dc3c59f3629729cec2578dc0426621b8f321ce770e69270e974e1d96f6eacc6d38d2f9b89c6aed4ed4ce397a991
-
SSDEEP
12288:tZFFZDJe6R3dvAheWxnMbbY1wLBuYEAmDUDAc5c:tZnR3ROWblBuYVD
Malware Config
Extracted
njrat
0.7d
Lammer
8f04f9cf1cb0a66772ec936fb174701b
-
reg_key
8f04f9cf1cb0a66772ec936fb174701b
-
splitter
|'|'|
Signatures
-
Njrat family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe -
Executes dropped EXE 1 IoCs
pid Process 4340 Trojan.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4656 set thread context of 5784 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4396 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe 4396 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 4396 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 89 PID 4656 wrote to memory of 4396 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 89 PID 4656 wrote to memory of 4396 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 89 PID 4656 wrote to memory of 5784 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 90 PID 4656 wrote to memory of 5784 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 90 PID 4656 wrote to memory of 5784 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 90 PID 4656 wrote to memory of 5784 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 90 PID 4656 wrote to memory of 5784 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 90 PID 4656 wrote to memory of 5784 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 90 PID 4656 wrote to memory of 5784 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 90 PID 4656 wrote to memory of 5784 4656 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe 90 PID 4396 wrote to memory of 3476 4396 AcroRd32.exe 91 PID 4396 wrote to memory of 3476 4396 AcroRd32.exe 91 PID 4396 wrote to memory of 3476 4396 AcroRd32.exe 91 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 4480 3476 RdrCEF.exe 92 PID 3476 wrote to memory of 5720 3476 RdrCEF.exe 93 PID 3476 wrote to memory of 5720 3476 RdrCEF.exe 93 PID 3476 wrote to memory of 5720 3476 RdrCEF.exe 93 PID 3476 wrote to memory of 5720 3476 RdrCEF.exe 93 PID 3476 wrote to memory of 5720 3476 RdrCEF.exe 93 PID 3476 wrote to memory of 5720 3476 RdrCEF.exe 93 PID 3476 wrote to memory of 5720 3476 RdrCEF.exe 93 PID 3476 wrote to memory of 5720 3476 RdrCEF.exe 93 PID 3476 wrote to memory of 5720 3476 RdrCEF.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe"C:\Users\Admin\AppData\Local\Temp\3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Proposta.pdf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5D423937DF113DBBC7031FE9F3667C3F --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4480
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4F2F29CF7AA26436EFEF1C5AAB240634 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4F2F29CF7AA26436EFEF1C5AAB240634 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:5720
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B15292880171A0CD2B69AD6811798CBE --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:972
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1CABDA49FB230D9D434310DA72E515A3 --mojo-platform-channel-handle=2396 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:5636
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CD56DF29A4D61C0E81FF43D3F414C09D --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4724
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=44CDB4DD5792E66771D3048646555A24 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=44CDB4DD5792E66771D3048646555A24 --renderer-client-id=7 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:1756
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe"C:\Users\Admin\AppData\Local\Temp\3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5784 -
C:\Users\Admin\AppData\Roaming\Trojan.exe"C:\Users\Admin\AppData\Roaming\Trojan.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD570c1d7f20b561835af59c50bd1c147ab
SHA142ddf6f1956039adb22b6cf618a39a715aff15f0
SHA25695bcfba19959e0176a9a06a2766f0007dcecf41a8a69ec0f4562253c89769bb6
SHA512bd3d75751c63941e568fa72b754d5b27740cb68d50d03b8c761439ec5dc29f9fa50ec1448297c6b08896d0907c164d2efb6c07cf9029aa9d243681748c48f167
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe.log
Filesize594B
MD5fdb26b3b547022b45cfaeee57eafd566
SHA111c6798b8a59233f404014c5e79b3363cd564b37
SHA2562707fc7f074413881b7bafca05079327b188db6005709951e7f69d39a2af97c0
SHA51244d9bb8c0f0b341690d00eda86e15a50f7f29ce9595925c1a2a7e19ad26202d10049a7a97bea278ecb7d429ad555de8edceeffff664d4b06309a9410a09bb700
-
Filesize
210KB
MD511dd9b4f7e3b192fb7b570a1dd587945
SHA10696d05623ee0b34e3b71bbd1ed69e04180848c5
SHA2564a90c56d35a677dd9bf91a9a89ae8396936cb47b5fdf6094b582d2208c76cd96
SHA5128aa5c5d7d522c14287d10db92ee7378f22ca96e18ae453b5cd7b72ac95207736b7ad721e08454de1cc5dec0387f455dac83cbd09144db711fdfe5591034a0f19
-
Filesize
587KB
MD558388ff123bd5e52aa3e7fa34cfa8a7f
SHA16b43aa7430ad9e446acf2f8d04ecb8f6b6eaa4c5
SHA2563d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c
SHA512a4b5405d5e0c4f555e151c207c2d6d38e52b3dc3c59f3629729cec2578dc0426621b8f321ce770e69270e974e1d96f6eacc6d38d2f9b89c6aed4ed4ce397a991