Analysis
-
max time kernel
147s -
max time network
298s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03/04/2021, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
General
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
pony
http://www.oldhorse.info
Extracted
fickerstealer
deniedfight.com:80
untouchablename.com:80
Extracted
metasploit
windows/single_exec
Extracted
redline
rimu
rlmushahel.xyz:80
Extracted
redline
02042021
panenewak.xyz:80
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba Payload 3 IoCs
resource yara_rule behavioral2/memory/5240-231-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral2/memory/5240-230-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral2/memory/5240-233-0x00000000025C0000-0x0000000002ECA000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral2/memory/3460-287-0x0000000000400000-0x0000000000430000-memory.dmp family_redline behavioral2/memory/5876-297-0x0000000000400000-0x0000000000430000-memory.dmp family_redline -
Taurus Stealer Payload 1 IoCs
resource yara_rule behavioral2/memory/4084-408-0x0000000000400000-0x000000000587C000-memory.dmp family_taurus_stealer -
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/4604-216-0x0000000001B10000-0x0000000001B5C000-memory.dmp Vidar behavioral2/memory/4604-217-0x0000000000400000-0x0000000000450000-memory.dmp Vidar -
XMRig Miner Payload 4 IoCs
resource yara_rule behavioral2/memory/5068-158-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral2/memory/5068-159-0x00000001402CA898-mapping.dmp xmrig behavioral2/memory/5068-174-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral2/memory/5068-234-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 11 IoCs
pid Process 2128 keygen-pr.exe 2088 keygen-step-1.exe 2568 keygen-step-3.exe 3964 keygen-step-4.exe 1844 key.exe 1508 Setup.exe 2364 key.exe 1000 multitimer.exe 2280 setups.exe 3792 askinstall20.exe 2260 setups.tmp -
Loads dropped DLL 7 IoCs
pid Process 2260 setups.tmp 2260 setups.tmp 2260 setups.tmp 2260 setups.tmp 2260 setups.tmp 2260 setups.tmp 2260 setups.tmp -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 95 api.ipify.org 105 ipinfo.io 110 ipinfo.io 148 ip-api.com 170 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1844 set thread context of 2364 1844 key.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
pid Process 4136 timeout.exe -
Kills process with taskkill 2 IoCs
pid Process 3968 taskkill.exe 5520 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall20.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 2512 PING.EXE 5164 PING.EXE 4752 PING.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 108 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 113 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2260 setups.tmp 2260 setups.tmp -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1508 Setup.exe Token: SeCreateTokenPrivilege 3792 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 3792 askinstall20.exe Token: SeLockMemoryPrivilege 3792 askinstall20.exe Token: SeIncreaseQuotaPrivilege 3792 askinstall20.exe Token: SeMachineAccountPrivilege 3792 askinstall20.exe Token: SeTcbPrivilege 3792 askinstall20.exe Token: SeSecurityPrivilege 3792 askinstall20.exe Token: SeTakeOwnershipPrivilege 3792 askinstall20.exe Token: SeLoadDriverPrivilege 3792 askinstall20.exe Token: SeSystemProfilePrivilege 3792 askinstall20.exe Token: SeSystemtimePrivilege 3792 askinstall20.exe Token: SeProfSingleProcessPrivilege 3792 askinstall20.exe Token: SeIncBasePriorityPrivilege 3792 askinstall20.exe Token: SeCreatePagefilePrivilege 3792 askinstall20.exe Token: SeCreatePermanentPrivilege 3792 askinstall20.exe Token: SeBackupPrivilege 3792 askinstall20.exe Token: SeRestorePrivilege 3792 askinstall20.exe Token: SeShutdownPrivilege 3792 askinstall20.exe Token: SeDebugPrivilege 3792 askinstall20.exe Token: SeAuditPrivilege 3792 askinstall20.exe Token: SeSystemEnvironmentPrivilege 3792 askinstall20.exe Token: SeChangeNotifyPrivilege 3792 askinstall20.exe Token: SeRemoteShutdownPrivilege 3792 askinstall20.exe Token: SeUndockPrivilege 3792 askinstall20.exe Token: SeSyncAgentPrivilege 3792 askinstall20.exe Token: SeEnableDelegationPrivilege 3792 askinstall20.exe Token: SeManageVolumePrivilege 3792 askinstall20.exe Token: SeImpersonatePrivilege 3792 askinstall20.exe Token: SeCreateGlobalPrivilege 3792 askinstall20.exe Token: 31 3792 askinstall20.exe Token: 32 3792 askinstall20.exe Token: 33 3792 askinstall20.exe Token: 34 3792 askinstall20.exe Token: 35 3792 askinstall20.exe Token: SeDebugPrivilege 1000 multitimer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2280 setups.exe 2260 setups.tmp -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 720 wrote to memory of 2696 720 Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe 78 PID 720 wrote to memory of 2696 720 Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe 78 PID 720 wrote to memory of 2696 720 Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe 78 PID 2696 wrote to memory of 2128 2696 cmd.exe 81 PID 2696 wrote to memory of 2128 2696 cmd.exe 81 PID 2696 wrote to memory of 2128 2696 cmd.exe 81 PID 2696 wrote to memory of 2088 2696 cmd.exe 82 PID 2696 wrote to memory of 2088 2696 cmd.exe 82 PID 2696 wrote to memory of 2088 2696 cmd.exe 82 PID 2696 wrote to memory of 2568 2696 cmd.exe 83 PID 2696 wrote to memory of 2568 2696 cmd.exe 83 PID 2696 wrote to memory of 2568 2696 cmd.exe 83 PID 2696 wrote to memory of 3964 2696 cmd.exe 84 PID 2696 wrote to memory of 3964 2696 cmd.exe 84 PID 2696 wrote to memory of 3964 2696 cmd.exe 84 PID 2128 wrote to memory of 1844 2128 keygen-pr.exe 86 PID 2128 wrote to memory of 1844 2128 keygen-pr.exe 86 PID 2128 wrote to memory of 1844 2128 keygen-pr.exe 86 PID 3964 wrote to memory of 1508 3964 keygen-step-4.exe 85 PID 3964 wrote to memory of 1508 3964 keygen-step-4.exe 85 PID 2568 wrote to memory of 4052 2568 keygen-step-3.exe 87 PID 2568 wrote to memory of 4052 2568 keygen-step-3.exe 87 PID 2568 wrote to memory of 4052 2568 keygen-step-3.exe 87 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 1844 wrote to memory of 2364 1844 key.exe 89 PID 4052 wrote to memory of 2512 4052 cmd.exe 91 PID 4052 wrote to memory of 2512 4052 cmd.exe 91 PID 4052 wrote to memory of 2512 4052 cmd.exe 91 PID 1508 wrote to memory of 1000 1508 Setup.exe 92 PID 1508 wrote to memory of 1000 1508 Setup.exe 92 PID 1508 wrote to memory of 2280 1508 Setup.exe 93 PID 1508 wrote to memory of 2280 1508 Setup.exe 93 PID 1508 wrote to memory of 2280 1508 Setup.exe 93 PID 3964 wrote to memory of 3792 3964 keygen-step-4.exe 94 PID 3964 wrote to memory of 3792 3964 keygen-step-4.exe 94 PID 3964 wrote to memory of 3792 3964 keygen-step-4.exe 94 PID 2280 wrote to memory of 2260 2280 setups.exe 95 PID 2280 wrote to memory of 2260 2280 setups.exe 95 PID 2280 wrote to memory of 2260 2280 setups.exe 95 PID 3792 wrote to memory of 3548 3792 askinstall20.exe 98 PID 3792 wrote to memory of 3548 3792 askinstall20.exe 98 PID 3792 wrote to memory of 3548 3792 askinstall20.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe"C:\Users\Admin\AppData\Local\Temp\Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:2364
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:2512
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\8AOILG687V\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\8AOILG687V\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\8AOILG687V\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\8AOILG687V\multitimer.exe" 1 3.1617436197.60681e25be5d9 1016⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\8AOILG687V\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\8AOILG687V\multitimer.exe" 2 3.1617436197.60681e25be5d97⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\4ghpqslp5pu\luersjv1ros.exe"C:\Users\Admin\AppData\Local\Temp\4ghpqslp5pu\luersjv1ros.exe" /quiet SILENT=1 AF=7568⤵PID:3296
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\4ghpqslp5pu\luersjv1ros.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\4ghpqslp5pu\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617184175 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"9⤵PID:6052
-
-
-
C:\Users\Admin\AppData\Local\Temp\zivdknsft2j\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\zivdknsft2j\cpyrix.exe" /VERYSILENT8⤵PID:1040
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵PID:4540
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"10⤵PID:2620
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub10⤵PID:1624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe11⤵PID:5708
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe9⤵PID:5248
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"10⤵PID:5832
-
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"10⤵PID:5876
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\13cxlndqplt\KiffApp1.exe"C:\Users\Admin\AppData\Local\Temp\13cxlndqplt\KiffApp1.exe"8⤵PID:4300
-
-
C:\Users\Admin\AppData\Local\Temp\20qvd0hzs1y\1jtklt2whtl.exe"C:\Users\Admin\AppData\Local\Temp\20qvd0hzs1y\1jtklt2whtl.exe" /VERYSILENT8⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\is-U97L6.tmp\1jtklt2whtl.tmp"C:\Users\Admin\AppData\Local\Temp\is-U97L6.tmp\1jtklt2whtl.tmp" /SL5="$402E4,2592217,780800,C:\Users\Admin\AppData\Local\Temp\20qvd0hzs1y\1jtklt2whtl.exe" /VERYSILENT9⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\is-90QSO.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-90QSO.tmp\winlthsth.exe"10⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\xmFqkMzZu.exe"C:\Users\Admin\AppData\Local\Temp\xmFqkMzZu.exe"11⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\xmFqkMzZu.exe"C:\Users\Admin\AppData\Local\Temp\xmFqkMzZu.exe"12⤵PID:3724
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\haxcxn5ghjg\vpn.exe"C:\Users\Admin\AppData\Local\Temp\haxcxn5ghjg\vpn.exe" /silent /subid=4828⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\is-VIS35.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-VIS35.tmp\vpn.tmp" /SL5="$401E4,15170975,270336,C:\Users\Admin\AppData\Local\Temp\haxcxn5ghjg\vpn.exe" /silent /subid=4829⤵PID:4720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵PID:5380
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵PID:5576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵PID:1944
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵PID:1508
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rn2n3dcz00u\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\rn2n3dcz00u\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\is-C81HN.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-C81HN.tmp\IBInstaller_97039.tmp" /SL5="$302FA,14574851,721408,C:\Users\Admin\AppData\Local\Temp\rn2n3dcz00u\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵PID:5128
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-Q8MM8.tmp\{app}\microsoft.cab -F:* %ProgramData%10⤵PID:5320
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-Q8MM8.tmp\{app}\microsoft.cab -F:* C:\ProgramData11⤵PID:5512
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gnvizvbx4d5\rlksp1bmth0.exe"C:\Users\Admin\AppData\Local\Temp\gnvizvbx4d5\rlksp1bmth0.exe"8⤵PID:4680
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\gnvizvbx4d5\rlksp1bmth0.exe"9⤵PID:5916
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 300010⤵
- Runs ping.exe
PID:4752
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jsfmpwc0bf5\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\jsfmpwc0bf5\Setup3310.exe" /Verysilent /subid=5778⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\is-FDCK2.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-FDCK2.tmp\Setup3310.tmp" /SL5="$302AA,138429,56832,C:\Users\Admin\AppData\Local\Temp\jsfmpwc0bf5\Setup3310.exe" /Verysilent /subid=5779⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\is-FT7CF.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-FT7CF.tmp\Setup.exe" /Verysilent10⤵PID:5204
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"11⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵PID:5692
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵PID:5884
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"11⤵PID:5672
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"11⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\is-OP0SG.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-OP0SG.tmp\LabPicV3.tmp" /SL5="$302E8,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"12⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\is-IQFRF.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-IQFRF.tmp\ppppppfy.exe" /S /UID=lab21413⤵PID:204
-
C:\Program Files\Windows Defender\UDPMBLPUIN\prolab.exe"C:\Program Files\Windows Defender\UDPMBLPUIN\prolab.exe" /VERYSILENT14⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\is-TCE2B.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-TCE2B.tmp\prolab.tmp" /SL5="$402DE,575243,216576,C:\Program Files\Windows Defender\UDPMBLPUIN\prolab.exe" /VERYSILENT15⤵PID:5220
-
-
-
C:\Users\Admin\AppData\Local\Temp\6f-d70da-129-ef394-111dd33f5efdb\Lycipekyqo.exe"C:\Users\Admin\AppData\Local\Temp\6f-d70da-129-ef394-111dd33f5efdb\Lycipekyqo.exe"14⤵PID:4032
-
-
C:\Users\Admin\AppData\Local\Temp\1d-b30c2-649-305bf-610484b7258f2\Laekaerabafu.exe"C:\Users\Admin\AppData\Local\Temp\1d-b30c2-649-305bf-610484b7258f2\Laekaerabafu.exe"14⤵PID:4768
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"11⤵PID:5688
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"11⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\is-6BCG1.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-6BCG1.tmp\lylal220.tmp" /SL5="$40406,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"12⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\is-J4HBM.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-J4HBM.tmp\Microsoft.exe" /S /UID=lylal22013⤵PID:5896
-
C:\Program Files\Google\QULDGUTNTA\irecord.exe"C:\Program Files\Google\QULDGUTNTA\irecord.exe" /VERYSILENT14⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\is-7ULLV.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-7ULLV.tmp\irecord.tmp" /SL5="$7007E,6265333,408064,C:\Program Files\Google\QULDGUTNTA\irecord.exe" /VERYSILENT15⤵PID:2700
-
-
-
C:\Users\Admin\AppData\Local\Temp\8d-8010a-795-296ab-0c696d9a2775f\Rovyraqeje.exe"C:\Users\Admin\AppData\Local\Temp\8d-8010a-795-296ab-0c696d9a2775f\Rovyraqeje.exe"14⤵PID:2252
-
-
C:\Users\Admin\AppData\Local\Temp\99-75b3e-9b9-18bb8-3b497cfccf80a\Tuneshurebu.exe"C:\Users\Admin\AppData\Local\Temp\99-75b3e-9b9-18bb8-3b497cfccf80a\Tuneshurebu.exe"14⤵PID:2676
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"11⤵PID:5964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe12⤵PID:3460
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"11⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\TCYC7N0VDM\setups.exe"C:\Users\Admin\AppData\Local\Temp\TCYC7N0VDM\setups.exe" ll12⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\is-N069E.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-N069E.tmp\setups.tmp" /SL5="$20254,635399,250368,C:\Users\Admin\AppData\Local\Temp\TCYC7N0VDM\setups.exe" ll13⤵PID:3160
-
-
-
C:\Users\Admin\AppData\Local\Temp\B3767VNUYF\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\B3767VNUYF\multitimer.exe" 0 306065bb10421b26.04333812 0 10312⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\B3767VNUYF\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\B3767VNUYF\multitimer.exe" 1 3.1617436316.60681e9c93407 10313⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\B3767VNUYF\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\B3767VNUYF\multitimer.exe" 2 3.1617436316.60681e9c9340714⤵PID:3992
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"11⤵PID:5768
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"11⤵PID:5760
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"12⤵PID:4968
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install13⤵PID:5744
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"11⤵PID:5740
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"12⤵PID:4292
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install13⤵PID:4992
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ckq4uvo5k5i\app.exe"C:\Users\Admin\AppData\Local\Temp\ckq4uvo5k5i\app.exe" /8-238⤵PID:5240
-
-
C:\Users\Admin\AppData\Local\Temp\tnlbdrg53ub\vict.exe"C:\Users\Admin\AppData\Local\Temp\tnlbdrg53ub\vict.exe" /VERYSILENT /id=5358⤵PID:4832
-
-
C:\Users\Admin\AppData\Local\Temp\jparrzwszdr\l1hqs3bg0gp.exe"C:\Users\Admin\AppData\Local\Temp\jparrzwszdr\l1hqs3bg0gp.exe" /ustwo INSTALL8⤵PID:4604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "l1hqs3bg0gp.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\jparrzwszdr\l1hqs3bg0gp.exe" & exit9⤵PID:6116
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "l1hqs3bg0gp.exe" /f10⤵
- Kills process with taskkill
PID:5520
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6FSHE7XQB2\setups.exe"C:\Users\Admin\AppData\Local\Temp\6FSHE7XQB2\setups.exe" ll5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\is-U19QR.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-U19QR.tmp\setups.tmp" /SL5="$40052,635399,250368,C:\Users\Admin\AppData\Local\Temp\6FSHE7XQB2\setups.exe" ll6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2260
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:3548
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:3968
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe"4⤵PID:4452
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"5⤵PID:4600
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install6⤵PID:4784
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵PID:4632
-
C:\Users\Admin\AppData\Roaming\CD6E.tmp.exe"C:\Users\Admin\AppData\Roaming\CD6E.tmp.exe"5⤵PID:4396
-
C:\Users\Admin\AppData\Roaming\CD6E.tmp.exe"C:\Users\Admin\AppData\Roaming\CD6E.tmp.exe"6⤵PID:1760
-
-
-
C:\Users\Admin\AppData\Roaming\D05D.tmp.exe"C:\Users\Admin\AppData\Roaming\D05D.tmp.exe"5⤵PID:4504
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵PID:4792
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵PID:5068
-
-
-
C:\Users\Admin\AppData\Roaming\D1C5.tmp.exe"C:\Users\Admin\AppData\Roaming\D1C5.tmp.exe"5⤵PID:4084
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\D1C5.tmp.exe6⤵PID:3840
-
C:\Windows\SysWOW64\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
PID:4136
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵PID:4788
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:5164
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵PID:3164
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵PID:4272
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵PID:6028
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:1832
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4136
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4892
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4656
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\142a3467f52a43a8aa0cea26fb535c54 /t 2328 /p 46561⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\is-APLU7.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-APLU7.tmp\vict.tmp" /SL5="$302F2,870426,780800,C:\Users\Admin\AppData\Local\Temp\tnlbdrg53ub\vict.exe" /VERYSILENT /id=5351⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\is-O77BM.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-O77BM.tmp\win1host.exe" 5352⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\zCCOXnkMe.exe"C:\Users\Admin\AppData\Local\Temp\zCCOXnkMe.exe"3⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\zCCOXnkMe.exe"C:\Users\Admin\AppData\Local\Temp\zCCOXnkMe.exe"4⤵PID:5932
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:5848
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7045CA1EC02012C37D46D1F62EA03979 C2⤵PID:4664
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 472C1886E8F246C72297302C423125D82⤵PID:5524
-