redline | 677618666eb31c80e9dbecb17907676d2da2a39d24f7c20785ef577239ef5e6f

Analysis

max time kernel
43s
max time network
115s
platform
windows7_x64
resource
win7v20201028
submitted
23-02-2021 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TI.exe
Size

2.5MB
MD5

a5d3fdf55abb54ec0b632dee9d3459d4
SHA1

c177421eb77f0d341e5d1bd6cfbccb60e0c86a1c
SHA256

677618666eb31c80e9dbecb17907676d2da2a39d24f7c20785ef577239ef5e6f
SHA512

4faafc484d66545a3355ba4d76da6dd021b556a06ec5b15fa8b4b8a4f1161b44ffad5e654991cf658fc6bd49b458e59586155dfdf339e1150b278ff5b9a41324

Score

10^/10

redline xmrig discovery evasion infostealer miner spyware themida trojan

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

XMRig Miner Payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/632-32-0x000000013F320000-0x00000001404D8000-memory.dmp	xmrig

Executes dropped EXE 3 IoCs

Processes:

4q23ttwg.exe1pbrc0xw.execpu.exe

pid process

620 4q23ttwg.exe
1016 1pbrc0xw.exe
632 cpu.exe

pid	process
620	4q23ttwg.exe
1016	1pbrc0xw.exe
632	cpu.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1pbrc0xw.exeTI.exe4q23ttwg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1pbrc0xw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1pbrc0xw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4q23ttwg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4q23ttwg.exe

Loads dropped DLL 3 IoCs

Processes:

TI.exe1pbrc0xw.exe

pid process

1784 TI.exe
1784 TI.exe
1016 1pbrc0xw.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1784	TI.exe
1784	TI.exe
1016	1pbrc0xw.exe

themida 11 IoCs

Detects Themida, Advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1784-5-0x0000000000B40000-0x0000000000B41000-memory.dmp	themida
\Users\Admin\AppData\Local\4q23ttwg.exe	themida
C:\Users\Admin\AppData\Local\4q23ttwg.exe	themida
behavioral1/memory/620-14-0x00000000008D0000-0x00000000008D1000-memory.dmp	themida
\Users\Admin\AppData\Local\1pbrc0xw.exe	themida
C:\Users\Admin\AppData\Local\1pbrc0xw.exe	themida
behavioral1/memory/1016-23-0x0000000000BE0000-0x0000000000BE1000-memory.dmp	themida
C:\Users\Admin\AppData\Local\1pbrc0xw.exe	themida
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe	themida
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe	themida
behavioral1/memory/912-41-0x00000000002F0000-0x00000000002F1000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

TI.exe4q23ttwg.exe1pbrc0xw.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4q23ttwg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1pbrc0xw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

TI.exe4q23ttwg.exe1pbrc0xw.exe

pid process

1784 TI.exe
620 4q23ttwg.exe
1016 1pbrc0xw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

760 schtasks.exe

pid	process
1784	TI.exe
620	4q23ttwg.exe
1016	1pbrc0xw.exe

pid	process
760	schtasks.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

TI.exe1pbrc0xw.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	TI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	1pbrc0xw.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	1pbrc0xw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1pbrc0xw.exe

pid	process
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

TI.exe1pbrc0xw.execpu.exe4q23ttwg.exe

description	pid	process
Token: SeDebugPrivilege	1784	TI.exe
Token: SeDebugPrivilege	1016	1pbrc0xw.exe
Token: SeLockMemoryPrivilege	632	cpu.exe
Token: SeLockMemoryPrivilege	632	cpu.exe
Token: SeDebugPrivilege	620	4q23ttwg.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

TI.exe1pbrc0xw.exe

description	pid	process	target process
PID 1784 wrote to memory of 620	1784	TI.exe	4q23ttwg.exe
PID 1784 wrote to memory of 620	1784	TI.exe	4q23ttwg.exe
PID 1784 wrote to memory of 620	1784	TI.exe	4q23ttwg.exe
PID 1784 wrote to memory of 620	1784	TI.exe	4q23ttwg.exe
PID 1784 wrote to memory of 1016	1784	TI.exe	1pbrc0xw.exe
PID 1784 wrote to memory of 1016	1784	TI.exe	1pbrc0xw.exe
PID 1784 wrote to memory of 1016	1784	TI.exe	1pbrc0xw.exe
PID 1784 wrote to memory of 1016	1784	TI.exe	1pbrc0xw.exe
PID 1016 wrote to memory of 760	1016	1pbrc0xw.exe	schtasks.exe
PID 1016 wrote to memory of 760	1016	1pbrc0xw.exe	schtasks.exe
PID 1016 wrote to memory of 760	1016	1pbrc0xw.exe	schtasks.exe
PID 1016 wrote to memory of 760	1016	1pbrc0xw.exe	schtasks.exe
PID 1016 wrote to memory of 632	1016	1pbrc0xw.exe	cpu.exe
PID 1016 wrote to memory of 632	1016	1pbrc0xw.exe	cpu.exe
PID 1016 wrote to memory of 632	1016	1pbrc0xw.exe	cpu.exe
PID 1016 wrote to memory of 632	1016	1pbrc0xw.exe	cpu.exe

C:\Users\Admin\AppData\Local\Temp\TI.exe
"C:\Users\Admin\AppData\Local\Temp\TI.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784

C:\Users\Admin\AppData\Local\4q23ttwg.exe
"C:\Users\Admin\AppData\Local\4q23ttwg.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Users\Admin\AppData\Local\1pbrc0xw.exe
"C:\Users\Admin\AppData\Local\1pbrc0xw.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service © Microsoft Corporation" /tr "C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe" /f
3⤵
- Creates scheduled task(s)
PID:760

C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe
"C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe" -o stratum+tcp://pool.minexmr.com:4444 --algo cn/r -u 42ZYH6myZTcdLqfmCpSCggN8ppdku4PK16kH8UFFyTesddFwT5ihd2QFsWS2BGnuwXWfnrtbJbr5w7dqgeBRZDJcUzia53j./ --donate-level=1
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\system32\taskeng.exe
taskeng.exe {CB74EA49-E2CB-4D8F-BEDE-C81CA726F63F} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
PID:1312

C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe
2⤵
PID:912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\1pbrc0xw.exe
MD5
f0ecefed65b00699cc2b57bf81492f56

SHA1
4e0fbc13af6c373c9944a53a40965517b619c274

SHA256
83f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325

SHA512
83bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f

Download Submit
C:\Users\Admin\AppData\Local\1pbrc0xw.exe
MD5
f0ecefed65b00699cc2b57bf81492f56

SHA1
4e0fbc13af6c373c9944a53a40965517b619c274

SHA256
83f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325

SHA512
83bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f

Download Submit
C:\Users\Admin\AppData\Local\4q23ttwg.exe
MD5
70dca411445d3b4394d9c467bf3ff994

SHA1
83f9120b2b184eb991d1dcbf4bb13d5f2f4a6097

SHA256
1d1f06c0d0965296755770b3f6a70a90e0d21a57ef5e47f9a26fcc4008ad45ef

SHA512
4a2f84a8fb4bb0eba8402eb417cadb8bcef6ac309ee4918a698cab756ea888ff076545e1ed02f85f5705fe15f7eb7ec01b68c3bc98f74b4e13f5b8e4f0184cd6

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe
MD5
e95f766a3748042efbf0f05d823f82b7

SHA1
fa4a29f9b95f4491e07eba54a677d52d8d061a19

SHA256
1aef2fba4058ad80e4ae16dce0d2609e9f946ba9a4f2203891a26a92b3f6578c

SHA512
e4d61199b57ae189c2bef7adc661224cfb00e9d6b3526c07624911238aad2d81d9548b52db1c6dbbf4a0e3f766d57080d2414ca836e037f0bb39728d1f1af55c

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe
MD5
f0ecefed65b00699cc2b57bf81492f56

SHA1
4e0fbc13af6c373c9944a53a40965517b619c274

SHA256
83f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325

SHA512
83bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe
MD5
f0ecefed65b00699cc2b57bf81492f56

SHA1
4e0fbc13af6c373c9944a53a40965517b619c274

SHA256
83f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325

SHA512
83bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f

Download Submit
\Users\Admin\AppData\Local\1pbrc0xw.exe
MD5
f0ecefed65b00699cc2b57bf81492f56

SHA1
4e0fbc13af6c373c9944a53a40965517b619c274

SHA256
83f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325

SHA512
83bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f

Download Submit
\Users\Admin\AppData\Local\4q23ttwg.exe
MD5
70dca411445d3b4394d9c467bf3ff994

SHA1
83f9120b2b184eb991d1dcbf4bb13d5f2f4a6097

SHA256
1d1f06c0d0965296755770b3f6a70a90e0d21a57ef5e47f9a26fcc4008ad45ef

SHA512
4a2f84a8fb4bb0eba8402eb417cadb8bcef6ac309ee4918a698cab756ea888ff076545e1ed02f85f5705fe15f7eb7ec01b68c3bc98f74b4e13f5b8e4f0184cd6

Download Submit
\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe
MD5
e95f766a3748042efbf0f05d823f82b7

SHA1
fa4a29f9b95f4491e07eba54a677d52d8d061a19

SHA256
1aef2fba4058ad80e4ae16dce0d2609e9f946ba9a4f2203891a26a92b3f6578c

SHA512
e4d61199b57ae189c2bef7adc661224cfb00e9d6b3526c07624911238aad2d81d9548b52db1c6dbbf4a0e3f766d57080d2414ca836e037f0bb39728d1f1af55c

Download Submit
memory/620-22-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/620-13-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/620-14-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/620-9-0x0000000000000000-mapping.dmp

Download
memory/632-29-0x0000000000000000-mapping.dmp

Download
memory/632-34-0x00000000002B0000-0x00000000002D0000-memory.dmp

Filesize
128KB

Download
memory/632-33-0x0000000000270000-0x0000000000290000-memory.dmp

Filesize
128KB

Download
memory/632-32-0x000000013F320000-0x00000001404D8000-memory.dmp

Filesize
17.7MB

Download
memory/632-31-0x00000000000F0000-0x0000000000104000-memory.dmp

Filesize
80KB

Download
memory/760-26-0x0000000000000000-mapping.dmp

Download
memory/912-36-0x0000000000000000-mapping.dmp

Download
memory/912-40-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/912-41-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/912-43-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/1016-27-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/1016-23-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/1016-21-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1016-17-0x0000000000000000-mapping.dmp

Download
memory/1784-7-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/1784-2-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1784-5-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1784-4-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download