azorult | ee487d789d2a43f9883d9f56c54c0b4c3cc26de47491030fe331b41abe906787

Analysis

max time kernel
60s
max time network
59s
platform
windows10_x64
resource
win10v20201028
submitted
03-04-2021 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fireeye.Agent.11.7.10.keygen.exe
Size

5.4MB
MD5

3b024ffc1fdf4ef5bc78fe48d0feb1a0
SHA1

859b62beef8bc1e7495a6d063d309586163869db
SHA256

4ff87821343d06ad2d65b085c487f825ca876e368c9367ad57a3d243c2633c81
SHA512

e68746f8a3ba67d83447be76372438512026fe698e5547d310b38f6e8e9d52f2e03492fb66e5687cd969032bcec9fda80dd45dedf0a40f0de7ad1b7d1cec0416

Score

10^/10

azorult xmrig infostealer miner trojan

Malware Config

Extracted

Family

azorult

http://kvaka.li/1210776429.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 3 IoCs

miner

resource	yara_rule
behavioral1/memory/5504-174-0x00000001402CA898-mapping.dmp	xmrig
behavioral1/memory/5504-171-0x0000000140000000-0x000000014070A000-memory.dmp	xmrig
behavioral1/memory/5504-183-0x0000000140000000-0x000000014070A000-memory.dmp	xmrig

Executes dropped EXE 10 IoCs

pid	Process
3124	keygen-pr.exe
428	keygen-step-1.exe
656	keygen-step-3.exe
4044	keygen-step-4.exe
1444	key.exe
1568	Setup.exe
2856	multitimer.exe
3672	setups.exe
4668	askinstall20.exe
2600	setups.tmp

Loads dropped DLL 7 IoCs

pid	Process
2600	setups.tmp
2600	setups.tmp
2600	setups.tmp
2600	setups.tmp
2600	setups.tmp
2600	setups.tmp
2600	setups.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
102	api.ipify.org
162	ipinfo.io
167	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
5108	taskkill.exe
6392	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	askinstall20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	askinstall20.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2368	PING.EXE
5176	PING.EXE
5620	PING.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	163	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	169	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2600	setups.tmp
2600	setups.tmp

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	Setup.exe
Token: SeCreateTokenPrivilege	4668	askinstall20.exe
Token: SeAssignPrimaryTokenPrivilege	4668	askinstall20.exe
Token: SeLockMemoryPrivilege	4668	askinstall20.exe
Token: SeIncreaseQuotaPrivilege	4668	askinstall20.exe
Token: SeMachineAccountPrivilege	4668	askinstall20.exe
Token: SeTcbPrivilege	4668	askinstall20.exe
Token: SeSecurityPrivilege	4668	askinstall20.exe
Token: SeTakeOwnershipPrivilege	4668	askinstall20.exe
Token: SeLoadDriverPrivilege	4668	askinstall20.exe
Token: SeSystemProfilePrivilege	4668	askinstall20.exe
Token: SeSystemtimePrivilege	4668	askinstall20.exe
Token: SeProfSingleProcessPrivilege	4668	askinstall20.exe
Token: SeIncBasePriorityPrivilege	4668	askinstall20.exe
Token: SeCreatePagefilePrivilege	4668	askinstall20.exe
Token: SeCreatePermanentPrivilege	4668	askinstall20.exe
Token: SeBackupPrivilege	4668	askinstall20.exe
Token: SeRestorePrivilege	4668	askinstall20.exe
Token: SeShutdownPrivilege	4668	askinstall20.exe
Token: SeDebugPrivilege	4668	askinstall20.exe
Token: SeAuditPrivilege	4668	askinstall20.exe
Token: SeSystemEnvironmentPrivilege	4668	askinstall20.exe
Token: SeChangeNotifyPrivilege	4668	askinstall20.exe
Token: SeRemoteShutdownPrivilege	4668	askinstall20.exe
Token: SeUndockPrivilege	4668	askinstall20.exe
Token: SeSyncAgentPrivilege	4668	askinstall20.exe
Token: SeEnableDelegationPrivilege	4668	askinstall20.exe
Token: SeManageVolumePrivilege	4668	askinstall20.exe
Token: SeImpersonatePrivilege	4668	askinstall20.exe
Token: SeCreateGlobalPrivilege	4668	askinstall20.exe
Token: 31	4668	askinstall20.exe
Token: 32	4668	askinstall20.exe
Token: 33	4668	askinstall20.exe
Token: 34	4668	askinstall20.exe
Token: 35	4668	askinstall20.exe
Token: SeDebugPrivilege	5108	taskkill.exe
Token: SeDebugPrivilege	2856	multitimer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3672	setups.exe
2600	setups.tmp

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4156	4704	Fireeye.Agent.11.7.10.keygen.exe	78
PID 4704 wrote to memory of 4156	4704	Fireeye.Agent.11.7.10.keygen.exe	78
PID 4704 wrote to memory of 4156	4704	Fireeye.Agent.11.7.10.keygen.exe	78
PID 4156 wrote to memory of 3124	4156	cmd.exe	81
PID 4156 wrote to memory of 3124	4156	cmd.exe	81
PID 4156 wrote to memory of 3124	4156	cmd.exe	81
PID 4156 wrote to memory of 428	4156	cmd.exe	82
PID 4156 wrote to memory of 428	4156	cmd.exe	82
PID 4156 wrote to memory of 428	4156	cmd.exe	82
PID 4156 wrote to memory of 656	4156	cmd.exe	83
PID 4156 wrote to memory of 656	4156	cmd.exe	83
PID 4156 wrote to memory of 656	4156	cmd.exe	83
PID 4156 wrote to memory of 4044	4156	cmd.exe	84
PID 4156 wrote to memory of 4044	4156	cmd.exe	84
PID 4156 wrote to memory of 4044	4156	cmd.exe	84
PID 3124 wrote to memory of 1444	3124	keygen-pr.exe	85
PID 3124 wrote to memory of 1444	3124	keygen-pr.exe	85
PID 3124 wrote to memory of 1444	3124	keygen-pr.exe	85
PID 4044 wrote to memory of 1568	4044	keygen-step-4.exe	86
PID 4044 wrote to memory of 1568	4044	keygen-step-4.exe	86
PID 656 wrote to memory of 1748	656	keygen-step-3.exe	87
PID 656 wrote to memory of 1748	656	keygen-step-3.exe	87
PID 656 wrote to memory of 1748	656	keygen-step-3.exe	87
PID 1444 wrote to memory of 2080	1444	key.exe	89
PID 1444 wrote to memory of 2080	1444	key.exe	89
PID 1444 wrote to memory of 2080	1444	key.exe	89
PID 1748 wrote to memory of 2368	1748	cmd.exe	90
PID 1748 wrote to memory of 2368	1748	cmd.exe	90
PID 1748 wrote to memory of 2368	1748	cmd.exe	90
PID 1568 wrote to memory of 2856	1568	Setup.exe	91
PID 1568 wrote to memory of 2856	1568	Setup.exe	91
PID 1568 wrote to memory of 3672	1568	Setup.exe	92
PID 1568 wrote to memory of 3672	1568	Setup.exe	92
PID 1568 wrote to memory of 3672	1568	Setup.exe	92
PID 4044 wrote to memory of 4668	4044	keygen-step-4.exe	93
PID 4044 wrote to memory of 4668	4044	keygen-step-4.exe	93
PID 4044 wrote to memory of 4668	4044	keygen-step-4.exe	93
PID 3672 wrote to memory of 2600	3672	setups.exe	94
PID 3672 wrote to memory of 2600	3672	setups.exe	94
PID 3672 wrote to memory of 2600	3672	setups.exe	94
PID 4668 wrote to memory of 1536	4668	askinstall20.exe	96
PID 4668 wrote to memory of 1536	4668	askinstall20.exe	96
PID 4668 wrote to memory of 1536	4668	askinstall20.exe	96
PID 1536 wrote to memory of 5108	1536	cmd.exe	98
PID 1536 wrote to memory of 5108	1536	cmd.exe	98
PID 1536 wrote to memory of 5108	1536	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\Fireeye.Agent.11.7.10.keygen.exe
"C:\Users\Admin\AppData\Local\Temp\Fireeye.Agent.11.7.10.keygen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        
        PID:2080
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        Runs ping.exe
        
        PID:2368
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\19ACRQOVBM\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\19ACRQOVBM\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\19ACRQOVBM\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\19ACRQOVBM\multitimer.exe" 1 3.1617447913.60684be9871dc 101
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\19ACRQOVBM\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\19ACRQOVBM\multitimer.exe" 2 3.1617447913.60684be9871dc
        7⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\kuohmrbsmlq\KiffApp1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kuohmrbsmlq\KiffApp1.exe"
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\vgg5ff1kgsq\fvdd04uylpd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vgg5ff1kgsq\fvdd04uylpd.exe" /ustwo INSTALL
        8⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "fvdd04uylpd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\vgg5ff1kgsq\fvdd04uylpd.exe" & exit
        9⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "fvdd04uylpd.exe" /f
        10⤵
        Kills process with taskkill
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\tkd3bqc3obd\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tkd3bqc3obd\Setup3310.exe" /Verysilent /subid=577
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\is-BTG3O.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BTG3O.tmp\Setup3310.tmp" /SL5="$80302,138429,56832,C:\Users\Admin\AppData\Local\Temp\tkd3bqc3obd\Setup3310.exe" /Verysilent /subid=577
        9⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\is-14SHF.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-14SHF.tmp\Setup.exe" /Verysilent
        10⤵
        
        PID:5652
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"
        11⤵
        
        PID:5308
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"
        11⤵
        
        PID:4516
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"
        11⤵
        
        PID:4476
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        11⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\is-B1NOL.tmp\LabPicV3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-B1NOL.tmp\LabPicV3.tmp" /SL5="$30482,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        12⤵
        
        PID:5828
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
        11⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\is-7QO7S.tmp\lylal220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7QO7S.tmp\lylal220.tmp" /SL5="$30484,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
        12⤵
        
        PID:5736
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"
        11⤵
        
        PID:5788
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"
        11⤵
        
        PID:5944
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"
        11⤵
        
        PID:5356
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"
        11⤵
        
        PID:5148
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"
        11⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\bcor52hsjz5\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bcor52hsjz5\app.exe" /8-23
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\yjsofv1atnc\5clofalat3s.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yjsofv1atnc\5clofalat3s.exe" /VERYSILENT
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\is-MOU2U.tmp\5clofalat3s.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MOU2U.tmp\5clofalat3s.tmp" /SL5="$4030C,2592217,780800,C:\Users\Admin\AppData\Local\Temp\yjsofv1atnc\5clofalat3s.exe" /VERYSILENT
        9⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\is-CFHMB.tmp\winlthsth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-CFHMB.tmp\winlthsth.exe"
        10⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\iyehndusn24\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iyehndusn24\cpyrix.exe" /VERYSILENT
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        9⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        10⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        9⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\erxvcvzhyma\qn2qvcbveiv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\erxvcvzhyma\qn2qvcbveiv.exe" /quiet SILENT=1 AF=756
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\5obkfmabnu1\uea2e214lvg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5obkfmabnu1\uea2e214lvg.exe"
        8⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\5obkfmabnu1\uea2e214lvg.exe"
        9⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        10⤵
        Runs ping.exe
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\du001f03dup\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\du001f03dup\vpn.exe" /silent /subid=482
        8⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\is-4SEU5.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-4SEU5.tmp\vpn.tmp" /SL5="$30346,15170975,270336,C:\Users\Admin\AppData\Local\Temp\du001f03dup\vpn.exe" /silent /subid=482
        9⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\3yscipgzpen\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3yscipgzpen\vict.exe" /VERYSILENT /id=535
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\is-TSQCQ.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TSQCQ.tmp\vict.tmp" /SL5="$30434,870426,780800,C:\Users\Admin\AppData\Local\Temp\3yscipgzpen\vict.exe" /VERYSILENT /id=535
        9⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\is-G95RA.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-G95RA.tmp\win1host.exe" 535
        10⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\2op555do4ty\IBInstaller_97039.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2op555do4ty\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\is-R2KTT.tmp\IBInstaller_97039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-R2KTT.tmp\IBInstaller_97039.tmp" /SL5="$10446,14574917,721408,C:\Users\Admin\AppData\Local\Temp\2op555do4ty\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        9⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-CSFC3.tmp\{app}\microsoft.cab -F:* %ProgramData%
        10⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-CSFC3.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        11⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\UDG7HMWK09\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\UDG7HMWK09\setups.exe" ll
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\is-43PEQ.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-43PEQ.tmp\setups.tmp" /SL5="$50148,635399,250368,C:\Users\Admin\AppData\Local\Temp\UDG7HMWK09\setups.exe" ll
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1536
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"
      4⤵
      PID:1824
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        5⤵
        
        PID:4076
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        6⤵
        
        PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
      4⤵
      PID:2188
    - - C:\Users\Admin\AppData\Roaming\8CA5.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\8CA5.tmp.exe"
        5⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Roaming\8CA5.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\8CA5.tmp.exe"
        6⤵
        
        PID:212
    - - C:\Users\Admin\AppData\Roaming\8E2D.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\8E2D.tmp.exe"
        5⤵
        
        PID:2332
      - C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        6⤵
        
        PID:5196
      - C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Roaming\8F18.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\8F18.tmp.exe"
        5⤵
        
        PID:2128
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
        5⤵
        
        PID:5216
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
      4⤵
      PID:4176

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:3328

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:4252

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:852

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:1892

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5192
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 740CD34D08B74ACF0864753EA1FD8448 C
  2⤵
  PID:5428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/68-132-0x0000017CBDF60000-0x0000017CBDFC7000-memory.dmp

Filesize
412KB

Download
memory/212-150-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/212-146-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/860-106-0x0000026A7CC10000-0x0000026A7CC77000-memory.dmp

Filesize
412KB

Download
memory/1088-104-0x000001E88E440000-0x000001E88E4A7000-memory.dmp

Filesize
412KB

Download
memory/1136-119-0x0000013AD7830000-0x0000013AD7897000-memory.dmp

Filesize
412KB

Download
memory/1264-110-0x000001F1BB0B0000-0x000001F1BB117000-memory.dmp

Filesize
412KB

Download
memory/1300-123-0x000002A714E20000-0x000002A714E87000-memory.dmp

Filesize
412KB

Download
memory/1444-28-0x0000000003170000-0x000000000330C000-memory.dmp

Filesize
1.6MB

Download
memory/1568-30-0x000000001C000000-0x000000001C002000-memory.dmp

Filesize
8KB

Download
memory/1568-25-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp

Filesize
9.9MB

Download
memory/1568-26-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/1808-116-0x0000013F37620000-0x0000013F37687000-memory.dmp

Filesize
412KB

Download
memory/1892-225-0x000001E637500000-0x000001E637603000-memory.dmp

Filesize
1.0MB

Download
memory/1892-130-0x000001E634E80000-0x000001E634EE7000-memory.dmp

Filesize
412KB

Download
memory/1912-96-0x00000000029D0000-0x00000000029D2000-memory.dmp

Filesize
8KB

Download
memory/1912-78-0x00007FF84E760000-0x00007FF84F100000-memory.dmp

Filesize
9.6MB

Download
memory/2084-66-0x00007FF84E760000-0x00007FF84F100000-memory.dmp

Filesize
9.6MB

Download
memory/2084-71-0x0000000000E00000-0x0000000000E02000-memory.dmp

Filesize
8KB

Download
memory/2128-222-0x00000000074E0000-0x000000000C95C000-memory.dmp

Filesize
84.5MB

Download
memory/2176-100-0x0000016ED4680000-0x0000016ED46E7000-memory.dmp

Filesize
412KB

Download
memory/2188-144-0x00000000032F0000-0x0000000003338000-memory.dmp

Filesize
288KB

Download
memory/2188-75-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download
memory/2220-134-0x000001CE4CF40000-0x000001CE4CFA7000-memory.dmp

Filesize
412KB

Download
memory/2396-126-0x00000294F6040000-0x00000294F60A7000-memory.dmp

Filesize
412KB

Download
memory/2408-129-0x000001D2DE530000-0x000001D2DE597000-memory.dmp

Filesize
412KB

Download
memory/2532-120-0x0000025CF9200000-0x0000025CF9267000-memory.dmp

Filesize
412KB

Download
memory/2600-48-0x0000000003141000-0x0000000003143000-memory.dmp

Filesize
8KB

Download
memory/2600-56-0x00000000031B1000-0x00000000031B8000-memory.dmp

Filesize
28KB

Download
memory/2600-52-0x0000000003171000-0x000000000319C000-memory.dmp

Filesize
172KB

Download
memory/2600-58-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2856-57-0x00000000026C0000-0x00000000026C2000-memory.dmp

Filesize
8KB

Download
memory/2856-42-0x00007FF84E760000-0x00007FF84F100000-memory.dmp

Filesize
9.6MB

Download
memory/3672-53-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/3860-145-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download
memory/3860-149-0x0000000001B00000-0x0000000001B47000-memory.dmp

Filesize
284KB

Download
memory/4516-269-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/4816-97-0x0000000004DC0000-0x0000000004DFA000-memory.dmp

Filesize
232KB

Download
memory/4816-101-0x0000000004E50000-0x0000000004EA6000-memory.dmp

Filesize
344KB

Download
memory/4876-112-0x0000025158A00000-0x0000025158A67000-memory.dmp

Filesize
412KB

Download
memory/4876-84-0x0000025158940000-0x0000025158984000-memory.dmp

Filesize
272KB

Download
memory/5148-279-0x000000001D260000-0x000000001D262000-memory.dmp

Filesize
8KB

Download
memory/5148-266-0x0000000002540000-0x0000000002F2C000-memory.dmp

Filesize
9.9MB

Download
memory/5196-151-0x0000000140000000-0x0000000140383000-memory.dmp

Filesize
3.5MB

Download
memory/5196-163-0x0000000140000000-0x0000000140383000-memory.dmp

Filesize
3.5MB

Download
memory/5276-237-0x0000000002904000-0x0000000002905000-memory.dmp

Filesize
4KB

Download
memory/5276-166-0x0000000002900000-0x0000000002902000-memory.dmp

Filesize
8KB

Download
memory/5276-158-0x00007FF84E760000-0x00007FF84F100000-memory.dmp

Filesize
9.6MB

Download
memory/5300-188-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/5300-191-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5300-190-0x00000000017F0000-0x000000000183C000-memory.dmp

Filesize
304KB

Download
memory/5356-267-0x00007FF84E760000-0x00007FF84F100000-memory.dmp

Filesize
9.6MB

Download
memory/5356-268-0x0000000001520000-0x0000000001522000-memory.dmp

Filesize
8KB

Download
memory/5396-172-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/5408-173-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/5448-251-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/5448-246-0x000000006F190000-0x000000006F87E000-memory.dmp

Filesize
6.9MB

Download
memory/5448-252-0x0000000005A10000-0x0000000005A11000-memory.dmp

Filesize
4KB

Download
memory/5448-254-0x0000000005890000-0x0000000005895000-memory.dmp

Filesize
20KB

Download
memory/5448-250-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/5448-253-0x0000000005C20000-0x0000000005C21000-memory.dmp

Filesize
4KB

Download
memory/5448-247-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/5448-249-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/5476-202-0x0000000000400000-0x0000000000D24000-memory.dmp

Filesize
9.1MB

Download
memory/5476-199-0x00000000024A0000-0x0000000002DAA000-memory.dmp

Filesize
9.0MB

Download
memory/5476-201-0x0000000000400000-0x0000000000D24000-memory.dmp

Filesize
9.1MB

Download
memory/5476-195-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/5492-210-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/5492-186-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/5492-189-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/5492-187-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/5492-185-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/5492-184-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/5492-192-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/5492-194-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/5492-178-0x0000000003931000-0x000000000395C000-memory.dmp

Filesize
172KB

Download
memory/5492-193-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/5492-196-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/5492-197-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/5492-181-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/5492-198-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/5492-209-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/5492-204-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/5492-206-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/5492-207-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/5492-208-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/5492-179-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/5504-182-0x0000020CAF0E0000-0x0000020CAF0F4000-memory.dmp

Filesize
80KB

Download
memory/5504-171-0x0000000140000000-0x000000014070A000-memory.dmp

Filesize
7.0MB

Download
memory/5504-183-0x0000000140000000-0x000000014070A000-memory.dmp

Filesize
7.0MB

Download
memory/5504-233-0x0000000140000000-0x000000014070A000-memory.dmp

Filesize
7.0MB

Download
memory/5504-243-0x0000020CB0AB0000-0x0000020CB0AD0000-memory.dmp

Filesize
128KB

Download
memory/5556-236-0x0000000004D30000-0x0000000004D36000-memory.dmp

Filesize
24KB

Download
memory/5584-180-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/5736-276-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/5828-278-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/5852-203-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/5900-221-0x0000000005511000-0x000000000551D000-memory.dmp

Filesize
48KB

Download
memory/5900-214-0x0000000003291000-0x0000000003476000-memory.dmp

Filesize
1.9MB

Download
memory/5900-220-0x0000000005281000-0x0000000005289000-memory.dmp

Filesize
32KB

Download
memory/5900-211-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/5900-228-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/5900-216-0x00000000037A0000-0x00000000037A1000-memory.dmp

Filesize
4KB

Download
memory/5944-271-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/5944-265-0x000000006F190000-0x000000006F87E000-memory.dmp

Filesize
6.9MB

Download
memory/5944-277-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/5976-217-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/6024-226-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/6052-227-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download