5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Size 1.8MB
Sample260422-jmc2daa14k
SHA256 5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521
MD5 bf040951df9e55adba4458b42a83e0c4
SHA1 14ab05ff51bea3becfa3f16a385f158c578fc041
SHA512 62b56e84b457f162eaa83a12dd0fa95f52acde188659928d6012fc2ff089670536e6b96ae0645eddd9367185554e1d9a50838aa3d9293aac146c00c57655c51e
SSDEEP 24576:2GtJQzN/AUKd/Yp5zOHr36daE/ol4uuJ5MeJ5MTs:5tGzNIUg/6FOLXW04uq5M65MY
TLSH
T1DF957C12F7E8E5F1C1A90A300EAB836E2738FD518B118BDBE284771D1E717C54E7AA45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery vmprotect

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3280 created 616	3280	Explorer.EXE	5

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\eVNpejhyYdQQ0.sys	sdbinst.exe
File opened for modification	C:\Windows\system32\drivers\Ashj4tJ0gOPnK.bnq	sdbinst.exe
File created	C:\Windows\System32\drivers\2GV6NifjW.sys	sdbinst.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe

Executes dropped EXE 1 IoCs

pid	Process
3172	sdbinst.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	3172	sdbinst.exe

VMProtect packed file 11 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/3736-0-0x0000000000C00000-0x0000000000D07000-memory.dmp	vmprotect
behavioral1/memory/3736-1-0x0000000000C00000-0x0000000000D07000-memory.dmp	vmprotect
behavioral1/memory/3736-13-0x0000000000C00000-0x0000000000D07000-memory.dmp	vmprotect
behavioral1/memory/3280-19-0x000000000B4D0000-0x000000000B765000-memory.dmp	vmprotect
behavioral1/memory/3280-20-0x000000000B4D0000-0x000000000B765000-memory.dmp	vmprotect
behavioral1/memory/3280-45-0x000000000B4D0000-0x000000000B765000-memory.dmp	vmprotect
behavioral1/memory/3172-75-0x000001626D4D0000-0x000001626D7D6000-memory.dmp	vmprotect
behavioral1/memory/3172-76-0x000001626D4D0000-0x000001626D7D6000-memory.dmp	vmprotect
behavioral1/memory/3172-86-0x000001626D4D0000-0x000001626D7D6000-memory.dmp	vmprotect
behavioral1/memory/3736-111-0x0000000000C00000-0x0000000000D07000-memory.dmp	vmprotect
behavioral1/files/0x000800000000073b-149.dat	vmprotect

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\KBYn8FW2pBduBa.sys	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA5EE.cat	sdbinst.exe
File opened for modification	C:\Windows\system32\WgUkq1Gryi.abe	sdbinst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA64B.cat	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA705.cat	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA765.cat	sdbinst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA61B.cat	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA6D8.cat	sdbinst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	sdbinst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA735.cat	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA67B.cat	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA6A8.cat	sdbinst.exe
File created	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\80sQlb8f.cat	sdbinst.exe
File created	C:\Windows\system32\ \Windows\System32\KJeJchtJb.sys	sdbinst.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA5BE.cat	sdbinst.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WdXZof8faiBi.cee	sdbinst.exe
File opened for modification	C:\Program Files\Windows Mail\manifest.json	sdbinst.exe
File opened for modification	C:\Program Files\Windows Mail\47c174dc.html	sdbinst.exe
File opened for modification	C:\Program Files\Windows Mail\lib\64753d34.js	sdbinst.exe
File created	C:\Program Files\sdbinst.exe	Explorer.EXE
File opened for modification	C:\Program Files\sdbinst.exe	Explorer.EXE
File opened for modification	C:\Program Files\o5u2RuT1ExRxIT.sys	sdbinst.exe
File opened for modification	C:\Program Files\ANyTtAnv2Tds.jok	sdbinst.exe
File opened for modification	C:\Program Files (x86)\EA2oHD56iRyd.sys	sdbinst.exe
File opened for modification	C:\Program Files\Windows Mail\396790b0.js	sdbinst.exe
File opened for modification	C:\Program Files\Windows Mail\561b5908.js	sdbinst.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\3I7fVK.sys	sdbinst.exe
File opened for modification	C:\Windows\rx0Fh8hLeOLpJ.sys	sdbinst.exe
File opened for modification	C:\Windows\akTPFC9h5q.ssn	sdbinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	sdbinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	sdbinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	sdbinst.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2584	timeout.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	sdbinst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	sdbinst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	sdbinst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	sdbinst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	sdbinst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	sdbinst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	sdbinst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	sdbinst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	sdbinst.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe
3172	sdbinst.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3280	Explorer.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Token: SeTcbPrivilege	3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Token: SeDebugPrivilege	3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Token: SeDebugPrivilege	3280	Explorer.EXE
Token: SeDebugPrivilege	3280	Explorer.EXE
Token: SeDebugPrivilege	3172	sdbinst.exe
Token: SeDebugPrivilege	3172	sdbinst.exe
Token: SeDebugPrivilege	3172	sdbinst.exe
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeDebugPrivilege	3172	sdbinst.exe
Token: SeDebugPrivilege	2136	mstsc.exe
Token: SeDebugPrivilege	3172	sdbinst.exe
Token: SeBackupPrivilege	3172	sdbinst.exe
Token: SeIncBasePriorityPrivilege	3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3280	3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe	56
PID 3736 wrote to memory of 3280	3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe	56
PID 3736 wrote to memory of 3280	3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe	56
PID 3280 wrote to memory of 3172	3280	Explorer.EXE	84
PID 3280 wrote to memory of 3172	3280	Explorer.EXE	84
PID 3280 wrote to memory of 3172	3280	Explorer.EXE	84
PID 3280 wrote to memory of 3172	3280	Explorer.EXE	84
PID 3280 wrote to memory of 3836	3280	Explorer.EXE
PID 3280 wrote to memory of 3796	3280	Explorer.EXE
PID 3280 wrote to memory of 912	3280	Explorer.EXE
PID 3172 wrote to memory of 2136	3172	sdbinst.exe	97
PID 3172 wrote to memory of 2136	3172	sdbinst.exe	97
PID 3172 wrote to memory of 2136	3172	sdbinst.exe	97
PID 3736 wrote to memory of 1048	3736	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe	98
PID 1048 wrote to memory of 2584	1048	cmd.exe	100
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3172 wrote to memory of 3280	3172	sdbinst.exe	56
PID 3280 wrote to memory of 2416	3280	Explorer.EXE
PID 3280 wrote to memory of 116	3280	Explorer.EXE
PID 3280 wrote to memory of 748	3280	Explorer.EXE
PID 3280 wrote to memory of 2728	3280	Explorer.EXE
PID 3280 wrote to memory of 2900	3280	Explorer.EXE
PID 3280 wrote to memory of 1356	3280	Explorer.EXE
PID 3280 wrote to memory of 2588	3280	Explorer.EXE
PID 3280 wrote to memory of 2652	3280	Explorer.EXE
PID 3280 wrote to memory of 4352	3280	Explorer.EXE
PID 3280 wrote to memory of 680	3280	Explorer.EXE
PID 3280 wrote to memory of 4120	3280	Explorer.EXE	92
PID 3280 wrote to memory of 1140	3280	Explorer.EXE
PID 3280 wrote to memory of 1744	3280	Explorer.EXE
PID 3280 wrote to memory of 4768	3280	Explorer.EXE	94
PID 3280 wrote to memory of 5048	3280	Explorer.EXE
PID 3280 wrote to memory of 3836	3280	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Program Files\sdbinst.exe
  "C:\Program Files\sdbinst.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Unexpected DNS network traffic destination
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\system32\mstsc.exe
    "C:\Windows\system32\mstsc.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2136

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
  "C:\Users\Admin\AppData\Local\Temp\5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2584

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4120

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sdbinst.exe

Path C:\Program Files\sdbinst.exe
Size 24KB
SHA256 6a35a458bdce60abc8236c8ec2915505adc9370812e78fcdeaac8c494f563fb1
MD5 0d1846aa458bed45c564f6b050cecc44
SHA1 105b3ac07af3849e9a6acb064ab9bdcbeb80f326
SHA512 05725c0375cb728d547158766c256346591997a7c712e380895c7c396c9d55472adc28dba187884d969d9bb0fec3fdda47d8b9c4bb8c66050333c66bb31c7721
SSDEEP 384:pbwRvEgNKgGXZ/bgtIhaRkZE6SFZKhi/EUzdZl99y2Bc2zFrWAgW:1wRCJDgtChqm4dZl99y2Bc2zFX
TLSH
T1A0B2081AA7AC20F9F57B4A3498A60205997674302B3156FF1AF0C63D1F27BD1E939B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2B0DA61B.cat

Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0DA61B.cat
Size 5KB
SHA256 494280628758aaad9ca11c5843af59d3292d8680151ea8302fd9c1db612006b2
MD5 14abf2b885340e7205a4a6e5ce993c9a
SHA1 7d14cf5d84075cdf87315a60902bc910a0db8fbf
SHA512 ac802361b3b467944437688be21211f2c1946cab12d66467c74359a07b33d9a9fda54776d2a11fa799ab3e498c80a3354883e3386717a52e85e56401fd629d24
SSDEEP 96:dyDmIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOG1:DIrXL0UIRIzw3jtlAur9ZCspE+TMQrO8
TLSH
T1B4B1C6D709082456EC865B91D5C6D66FED3467A52EC861A680B291992EC3BF07B0E80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rx0Fh8hLeOLpJ.sys

Path C:\Windows\rx0Fh8hLeOLpJ.sys
Size 171KB
SHA256 7860ba948f5df7266d40724ac9dd430afe36b7462eb41a96871116b01141d3d3
MD5 696d4e10f25431a27ed9c92ff514e5e5
SHA1 116d9aa544743ccfddddd3af42c3f95e17980ed4
SHA512 be90281b054c4eb2d7c1a0cf15a86b34b03b54de3d17352ffd0bb776abf1dcbc0687ab9aa5b86b9af92aca98264d7982f9d84201ed21a4109ebdf63406029a18
SSDEEP 3072:a+IaIfIEHlbySWsjhWDodnRlzYVucprnuRbW6kR/eKPkW79imuWgDSgpLIgWy:7INg4bYsjKodR567prnQW6u/e2Zidl
TLSH
T1810412C290D891F3D50C54BCBA5351E882E8307BE921C369F9443FBDBC5519AED42ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2136-92-0x0000028AD1850000-0x0000028AD1880000-memory.dmp

Download

memory/2136-85-0x0000028AD13A0000-0x0000028AD13A3000-memory.dmp

Download

memory/3172-43-0x00007FFED4440000-0x00007FFED4450000-memory.dmp

Download

memory/3172-71-0x000001626A0D0000-0x000001626A0D1000-memory.dmp

Download

memory/3172-100-0x000001626DE60000-0x000001626E03B000-memory.dmp

Download

memory/3172-94-0x000001626DE60000-0x000001626E03B000-memory.dmp

Download

memory/3172-93-0x000001626DE60000-0x000001626E03B000-memory.dmp

Download

memory/3172-81-0x000001626D400000-0x000001626D441000-memory.dmp

Download

memory/3172-91-0x000001626D400000-0x000001626D441000-memory.dmp

Download

memory/3172-90-0x000001626BC40000-0x000001626BC7F000-memory.dmp

Download

memory/3172-31-0x0000016269D10000-0x0000016269D13000-memory.dmp

Download

memory/3172-32-0x000001626B8D0000-0x000001626BB37000-memory.dmp

Download

memory/3172-35-0x000001626B8D0000-0x000001626BB37000-memory.dmp

Download

memory/3172-36-0x000001626B8D0000-0x000001626BB37000-memory.dmp

Download

memory/3172-86-0x000001626D4D0000-0x000001626D7D6000-memory.dmp

Download

memory/3172-42-0x000001626B8D0000-0x000001626BB37000-memory.dmp

Download

memory/3172-83-0x000001626A0B0000-0x000001626A0B1000-memory.dmp

Download

memory/3172-84-0x000001626A0B0000-0x000001626A0BC000-memory.dmp

Download

memory/3172-76-0x000001626D4D0000-0x000001626D7D6000-memory.dmp

Download

memory/3172-48-0x000001626B8D0000-0x000001626BB37000-memory.dmp

Download

memory/3172-49-0x0000016269F90000-0x0000016269FC0000-memory.dmp

Download

memory/3172-50-0x000001626A000000-0x000001626A001000-memory.dmp

Download

memory/3172-57-0x00007FFED4440000-0x00007FFED4450000-memory.dmp

Download

memory/3172-58-0x000001626A060000-0x000001626A061000-memory.dmp

Download

memory/3172-80-0x000001626BC40000-0x000001626BC7F000-memory.dmp

Download

memory/3172-75-0x000001626D4D0000-0x000001626D7D6000-memory.dmp

Download

memory/3172-72-0x000001626A0C0000-0x000001626A0C1000-memory.dmp

Download

memory/3172-65-0x000001626A0B0000-0x000001626A0B1000-memory.dmp

Download

memory/3172-66-0x000001626A0D0000-0x000001626A0D1000-memory.dmp

Download

memory/3172-67-0x000001626A060000-0x000001626A061000-memory.dmp

Download

memory/3280-15-0x0000000002550000-0x0000000002553000-memory.dmp

Download

memory/3280-208-0x0000000002B30000-0x0000000002B31000-memory.dmp

Download

memory/3280-60-0x0000000002510000-0x0000000002511000-memory.dmp

Download

memory/3280-59-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/3280-200-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/3280-46-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/3280-201-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/3280-45-0x000000000B4D0000-0x000000000B765000-memory.dmp

Download

memory/3280-202-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/3280-211-0x0000000002F70000-0x0000000002F71000-memory.dmp

Download

memory/3280-198-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/3280-26-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/3280-25-0x0000000002550000-0x0000000002553000-memory.dmp

Download

memory/3280-20-0x000000000B4D0000-0x000000000B765000-memory.dmp

Download

memory/3280-19-0x000000000B4D0000-0x000000000B765000-memory.dmp

Download

memory/3280-16-0x0000000002550000-0x0000000002553000-memory.dmp

Download

memory/3280-199-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/3280-135-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/3280-203-0x0000000000A70000-0x0000000000A71000-memory.dmp

Download

memory/3280-204-0x0000000002580000-0x0000000002581000-memory.dmp

Download

memory/3280-205-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Download

memory/3280-213-0x0000000002F90000-0x0000000002F91000-memory.dmp

Download

memory/3280-212-0x0000000002F80000-0x0000000002F81000-memory.dmp

Download

memory/3280-210-0x0000000002C60000-0x0000000002C61000-memory.dmp

Download

memory/3280-209-0x0000000002C50000-0x0000000002C51000-memory.dmp

Download

memory/3280-61-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/3280-207-0x0000000002B20000-0x0000000002B21000-memory.dmp

Download

memory/3280-206-0x0000000002B10000-0x0000000002B11000-memory.dmp

Download

memory/3736-1-0x0000000000C00000-0x0000000000D07000-memory.dmp

Download

memory/3736-11-0x0000000003BB0000-0x0000000003BB1000-memory.dmp

Download

memory/3736-111-0x0000000000C00000-0x0000000000D07000-memory.dmp

Download

memory/3736-14-0x0000000000DF0000-0x0000000000DF6000-memory.dmp

Download

memory/3736-0-0x0000000000C00000-0x0000000000D07000-memory.dmp

Download

memory/3736-34-0x0000000003BB0000-0x0000000003BB1000-memory.dmp

Download

memory/3736-13-0x0000000000C00000-0x0000000000D07000-memory.dmp

Download

memory/3736-12-0x0000000003BB0000-0x0000000003BB1000-memory.dmp

Download