Analysis
-
max time kernel
123s -
max time network
126s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
10-03-2021 13:53
Static task
static1
Behavioral task
behavioral1
Sample
638127191.exe
Resource
win7v20201028
General
-
Target
638127191.exe
-
Size
256KB
-
MD5
5c9e61f7399d08070ee86d8796b4b126
-
SHA1
12e16e5c06ae479d216975ac63ac6a935ec9b189
-
SHA256
23861faf3ed06c8f76c905f6d592e3aacd4adfb0a63a3af08f94aa42c1a3f57f
-
SHA512
bc5243e325e9c57b743bf1919b84bff709387554b2f028a37aefcfa7b0e8f61c3265666d5a99e7fc24c5cae85ed7240f6856b70e70bd3c28d236edcb7fcc4226
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1300-55-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral1/memory/1300-56-0x000000000041E192-mapping.dmp family_redline behavioral1/memory/1300-59-0x0000000000400000-0x0000000000426000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
794066702.exe1712476341.exe1712476341.exe1712476341.exepid process 1004 794066702.exe 1580 1712476341.exe 1268 1712476341.exe 1300 1712476341.exe -
Loads dropped DLL 12 IoCs
Processes:
638127191.exeWerFault.exe1712476341.exepid process 1596 638127191.exe 1596 638127191.exe 1596 638127191.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1580 1712476341.exe 1580 1712476341.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
1712476341.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths 1712476341.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions 1712476341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1712476341.exe = "0" 1712476341.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
1712476341.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1712476341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1712476341.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
1712476341.exepid process 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1712476341.exedescription pid process target process PID 1580 set thread context of 1300 1580 1712476341.exe 1712476341.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1572 1004 WerFault.exe 794066702.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1392 timeout.exe -
Processes:
638127191.exe1712476341.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 638127191.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 638127191.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 1712476341.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1712476341.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1712476341.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1712476341.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exe1712476341.exepowershell.exe1712476341.exepid process 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1580 1712476341.exe 1932 powershell.exe 1932 powershell.exe 1300 1712476341.exe 1300 1712476341.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
638127191.exeWerFault.exe1712476341.exepowershell.exe1712476341.exedescription pid process Token: SeDebugPrivilege 1596 638127191.exe Token: SeDebugPrivilege 1572 WerFault.exe Token: SeDebugPrivilege 1580 1712476341.exe Token: SeDebugPrivilege 1932 powershell.exe Token: SeDebugPrivilege 1300 1712476341.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
638127191.exe794066702.exe1712476341.execmd.exedescription pid process target process PID 1596 wrote to memory of 1004 1596 638127191.exe 794066702.exe PID 1596 wrote to memory of 1004 1596 638127191.exe 794066702.exe PID 1596 wrote to memory of 1004 1596 638127191.exe 794066702.exe PID 1596 wrote to memory of 1004 1596 638127191.exe 794066702.exe PID 1004 wrote to memory of 1572 1004 794066702.exe WerFault.exe PID 1004 wrote to memory of 1572 1004 794066702.exe WerFault.exe PID 1004 wrote to memory of 1572 1004 794066702.exe WerFault.exe PID 1004 wrote to memory of 1572 1004 794066702.exe WerFault.exe PID 1596 wrote to memory of 1580 1596 638127191.exe 1712476341.exe PID 1596 wrote to memory of 1580 1596 638127191.exe 1712476341.exe PID 1596 wrote to memory of 1580 1596 638127191.exe 1712476341.exe PID 1596 wrote to memory of 1580 1596 638127191.exe 1712476341.exe PID 1580 wrote to memory of 1932 1580 1712476341.exe powershell.exe PID 1580 wrote to memory of 1932 1580 1712476341.exe powershell.exe PID 1580 wrote to memory of 1932 1580 1712476341.exe powershell.exe PID 1580 wrote to memory of 1932 1580 1712476341.exe powershell.exe PID 1580 wrote to memory of 752 1580 1712476341.exe cmd.exe PID 1580 wrote to memory of 752 1580 1712476341.exe cmd.exe PID 1580 wrote to memory of 752 1580 1712476341.exe cmd.exe PID 1580 wrote to memory of 752 1580 1712476341.exe cmd.exe PID 752 wrote to memory of 1392 752 cmd.exe timeout.exe PID 752 wrote to memory of 1392 752 cmd.exe timeout.exe PID 752 wrote to memory of 1392 752 cmd.exe timeout.exe PID 752 wrote to memory of 1392 752 cmd.exe timeout.exe PID 1580 wrote to memory of 1268 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1268 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1268 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1268 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1300 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1300 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1300 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1300 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1300 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1300 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1300 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1300 1580 1712476341.exe 1712476341.exe PID 1580 wrote to memory of 1300 1580 1712476341.exe 1712476341.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
1712476341.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1712476341.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\638127191.exe"C:\Users\Admin\AppData\Local\Temp\638127191.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\794066702.exe"C:\Users\Admin\AppData\Local\Temp\794066702.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 883⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exe"C:\Users\Admin\AppData\Local\Temp\1712476341.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1712476341.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exe"C:\Users\Admin\AppData\Local\Temp\1712476341.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exe"C:\Users\Admin\AppData\Local\Temp\1712476341.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
C:\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
memory/752-45-0x0000000000000000-mapping.dmp
-
memory/1004-18-0x0000000000000000-mapping.dmp
-
memory/1300-59-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1300-55-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1300-56-0x000000000041E192-mapping.dmp
-
memory/1300-58-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1300-96-0x00000000045C0000-0x00000000045C1000-memory.dmpFilesize
4KB
-
memory/1392-46-0x0000000000000000-mapping.dmp
-
memory/1572-41-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1572-26-0x0000000002170000-0x0000000002181000-memory.dmpFilesize
68KB
-
memory/1572-38-0x0000000002660000-0x0000000002671000-memory.dmpFilesize
68KB
-
memory/1572-20-0x0000000000000000-mapping.dmp
-
memory/1572-22-0x0000000002170000-0x0000000002181000-memory.dmpFilesize
68KB
-
memory/1580-23-0x0000000000000000-mapping.dmp
-
memory/1580-42-0x0000000005D60000-0x0000000005DF6000-memory.dmpFilesize
600KB
-
memory/1580-40-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB
-
memory/1580-36-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/1580-35-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1596-4-0x0000000000810000-0x000000000081A000-memory.dmpFilesize
40KB
-
memory/1596-13-0x0000000000880000-0x0000000000889000-memory.dmpFilesize
36KB
-
memory/1596-12-0x00000000049D3000-0x00000000049D4000-memory.dmpFilesize
4KB
-
memory/1596-2-0x0000000001F90000-0x0000000001FA1000-memory.dmpFilesize
68KB
-
memory/1596-14-0x00000000049D4000-0x00000000049D6000-memory.dmpFilesize
8KB
-
memory/1596-3-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1596-10-0x00000000049D1000-0x00000000049D2000-memory.dmpFilesize
4KB
-
memory/1596-11-0x00000000049D2000-0x00000000049D3000-memory.dmpFilesize
4KB
-
memory/1932-44-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/1932-51-0x0000000004942000-0x0000000004943000-memory.dmpFilesize
4KB
-
memory/1932-50-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/1932-49-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/1932-48-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/1932-47-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1932-61-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB
-
memory/1932-62-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/1932-65-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/1932-70-0x0000000006050000-0x0000000006051000-memory.dmpFilesize
4KB
-
memory/1932-71-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1932-72-0x00000000060A0000-0x00000000060A1000-memory.dmpFilesize
4KB
-
memory/1932-79-0x0000000006240000-0x0000000006241000-memory.dmpFilesize
4KB
-
memory/1932-80-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/1932-94-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/1932-95-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1932-43-0x0000000000000000-mapping.dmp