Analysis
- max time kernel
148s - max time network
154s - platform
windows10_x64 - resource
win10v20210410 - submitted
04/05/2021, 23:26
General
- Target a6a62f2848be6b0d8cdb1372f5ed58d4.exe
- Size 7.0MB
- Sample210504-rs6yqee7b2
- SHA256 7c7cff0a48bcfe565fb02e3a39087ce2ad56d5b1c57b229f2d0142f41b7ab191
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
baskarservnew
C2
-
87.251.71.193:20119
Extracted
Family
-
fickerstealer
C2
-
truzen.site:80
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 5 IoCs
- fickerstealer
Ficker is an infostealer written in Rust and ASM.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner Payload 4 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 12 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Program Files directory 15 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 13 IoCs
- NSIS installer 2 IoCs
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 4 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6a62f2848be6b0d8cdb1372f5ed58d4.exe"C:\Users\Admin\AppData\Local\Temp\a6a62f2848be6b0d8cdb1372f5ed58d4.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Data\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\hjjgaa.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
-
-
-
C:\Program Files (x86)\Microsoft Data\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\jg7_7wjg.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft Data\Versium Research\RunWW.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\RunWW.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 13923⤵
- Program crash
-
-
-
C:\Program Files (x86)\Microsoft Data\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\guihuali-game.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install3⤵
-
-
-
C:\Program Files (x86)\Microsoft Data\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\LabPicV3.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-D2OF7.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-D2OF7.tmp\LabPicV3.tmp" /SL5="$1020C,506127,422400,C:\Program Files (x86)\Microsoft Data\Versium Research\LabPicV3.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-4B6T9.tmp\3316505.exe"C:\Users\Admin\AppData\Local\Temp\is-4B6T9.tmp\3316505.exe" /S /UID=lab2144⤵
-
C:\Program Files\Windows Mail\PWTVFWMNVX\prolab.exe"C:\Program Files\Windows Mail\PWTVFWMNVX\prolab.exe" /VERYSILENT5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MG8G7.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-MG8G7.tmp\prolab.tmp" /SL5="$901EA,575243,216576,C:\Program Files\Windows Mail\PWTVFWMNVX\prolab.exe" /VERYSILENT6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\77-6642b-854-8f4b3-b4f8b1ef37b7a\Vemugesheso.exe"C:\Users\Admin\AppData\Local\Temp\77-6642b-854-8f4b3-b4f8b1ef37b7a\Vemugesheso.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\41-59dba-b2d-6c486-88d6fd9ed8883\Puwolyvaezho.exe"C:\Users\Admin\AppData\Local\Temp\41-59dba-b2d-6c486-88d6fd9ed8883\Puwolyvaezho.exe"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pdpmy1bz.lge\sskiper.exe /s & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\pdpmy1bz.lge\sskiper.exeC:\Users\Admin\AppData\Local\Temp\pdpmy1bz.lge\sskiper.exe /s7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\33key2gf.k1h\KiffMainE1.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\33key2gf.k1h\KiffMainE1.exeC:\Users\Admin\AppData\Local\Temp\33key2gf.k1h\KiffMainE1.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tvbx2fwr.sbz\001.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\tvbx2fwr.sbz\001.exeC:\Users\Admin\AppData\Local\Temp\tvbx2fwr.sbz\001.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yjtzujgq.rml\setup.exe /eufour & exit6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5draw2jo.znq\installer.exe /qn CAMPAIGN="654" & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\5draw2jo.znq\installer.exeC:\Users\Admin\AppData\Local\Temp\5draw2jo.znq\installer.exe /qn CAMPAIGN="654"7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mqq0r5zd.ymz\gpooe.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\mqq0r5zd.ymz\gpooe.exeC:\Users\Admin\AppData\Local\Temp\mqq0r5zd.ymz\gpooe.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vg4c3fbb.1xv\setup.exe /mixfour & exit6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bcabma2r.s5d\sskiper.exe /s & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\bcabma2r.s5d\sskiper.exeC:\Users\Admin\AppData\Local\Temp\bcabma2r.s5d\sskiper.exe /s7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\t0v5dqwm.adc\google-game.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\t0v5dqwm.adc\google-game.exeC:\Users\Admin\AppData\Local\Temp\t0v5dqwm.adc\google-game.exe7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install8⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ospidufq.nr4\huesaa.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\ospidufq.nr4\huesaa.exeC:\Users\Admin\AppData\Local\Temp\ospidufq.nr4\huesaa.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ea4c0fz4.lhh\jvppp.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\ea4c0fz4.lhh\jvppp.exeC:\Users\Admin\AppData\Local\Temp\ea4c0fz4.lhh\jvppp.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2cy1k01l.xtv\askinstall39.exe & exit6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ha0spfdl.5ef\setup.exe & exit6⤵
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft Data\Versium Research\BarSetpFile.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\BarSetpFile.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\3786581.exe"C:\Users\Admin\AppData\Roaming\3786581.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\3970680.exe"C:\Users\Admin\AppData\Roaming\3970680.exe"3⤵
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\7791904.exe"C:\Users\Admin\AppData\Roaming\7791904.exe"3⤵
-
-
-
C:\Program Files (x86)\Microsoft Data\Versium Research\lylal220.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\lylal220.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8VSU8.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-8VSU8.tmp\lylal220.tmp" /SL5="$20208,237286,153600,C:\Program Files (x86)\Microsoft Data\Versium Research\lylal220.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-ABJMS.tmp\4_177039.exe"C:\Users\Admin\AppData\Local\Temp\is-ABJMS.tmp\4_177039.exe" /S /UID=lylal2204⤵
-
C:\Program Files\Windows Defender Advanced Threat Protection\OFVMGUJLWC\irecord.exe"C:\Program Files\Windows Defender Advanced Threat Protection\OFVMGUJLWC\irecord.exe" /VERYSILENT5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-23FRF.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-23FRF.tmp\irecord.tmp" /SL5="$20342,6139911,56832,C:\Program Files\Windows Defender Advanced Threat Protection\OFVMGUJLWC\irecord.exe" /VERYSILENT6⤵
-
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\81-4b8e2-d58-94995-6ac69a945704e\Kaekaejushuce.exe"C:\Users\Admin\AppData\Local\Temp\81-4b8e2-d58-94995-6ac69a945704e\Kaekaejushuce.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f1-3d4ad-972-effb9-b09a621e54d39\Dynuboxishy.exe"C:\Users\Admin\AppData\Local\Temp\f1-3d4ad-972-effb9-b09a621e54d39\Dynuboxishy.exe"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jwxcj0ts.wzh\sskiper.exe /s & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\jwxcj0ts.wzh\sskiper.exeC:\Users\Admin\AppData\Local\Temp\jwxcj0ts.wzh\sskiper.exe /s7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\trjgmzmz.kcs\KiffMainE1.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\trjgmzmz.kcs\KiffMainE1.exeC:\Users\Admin\AppData\Local\Temp\trjgmzmz.kcs\KiffMainE1.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ld2kirym.kfr\001.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\ld2kirym.kfr\001.exeC:\Users\Admin\AppData\Local\Temp\ld2kirym.kfr\001.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cww3snrr.isk\setup.exe /eufour & exit6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jvzzy3gj.qdy\installer.exe /qn CAMPAIGN="654" & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\jvzzy3gj.qdy\installer.exeC:\Users\Admin\AppData\Local\Temp\jvzzy3gj.qdy\installer.exe /qn CAMPAIGN="654"7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\urn0stij.wv4\gpooe.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\urn0stij.wv4\gpooe.exeC:\Users\Admin\AppData\Local\Temp\urn0stij.wv4\gpooe.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gtdn34o4.xlj\setup.exe /mixfour & exit6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zjs54jln.jlc\sskiper.exe /s & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\zjs54jln.jlc\sskiper.exeC:\Users\Admin\AppData\Local\Temp\zjs54jln.jlc\sskiper.exe /s7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dgl2kxwk.rh1\google-game.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\dgl2kxwk.rh1\google-game.exeC:\Users\Admin\AppData\Local\Temp\dgl2kxwk.rh1\google-game.exe7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install8⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dxv3od52.vcu\huesaa.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\dxv3od52.vcu\huesaa.exeC:\Users\Admin\AppData\Local\Temp\dxv3od52.vcu\huesaa.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gs5dxxtt.b51\jvppp.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\gs5dxxtt.b51\jvppp.exeC:\Users\Admin\AppData\Local\Temp\gs5dxxtt.b51\jvppp.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2g3f2gnc.uug\askinstall39.exe & exit6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\esmoeu2k.0o4\setup.exe & exit6⤵
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft Data\Versium Research\askinstall38.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\askinstall38.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
-
-
-
C:\Program Files (x86)\Microsoft Data\Versium Research\1_4924807894722937236.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\1_4924807894722937236.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\PloAe6NCnc1Pr0VUt0qsXBJ0.exe"C:\Users\Admin\AppData\Roaming\PloAe6NCnc1Pr0VUt0qsXBJ0.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\xmrig.exe"C:\Users\Admin\AppData\Roaming\xmrig.exe" -p trinity-miner --donate-level 5 -o pool.supportxmr.com:443 -u 89UyhNJWGyP6xoycGBA3A6HjdNEs7g3jr34EXVtqGYzg5wLEbmZY2AcGy5Kw5NRfjaYTUyW1dKCHGinv7fGMg45zVCRQwNM -k --tls4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\fexoDgO74To0aozS7TZcLaan.exe"C:\Users\Admin\AppData\Roaming\fexoDgO74To0aozS7TZcLaan.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 6564⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 6684⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 6724⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 7284⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 8524⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 11924⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 12364⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 11484⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\luCdy4yY4gEvH0DDqTIHNTW2.exe"C:\Users\Admin\AppData\Roaming\luCdy4yY4gEvH0DDqTIHNTW2.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\L8f5LPEF8RbueUROsfx5hOEM.exe"C:\Users\Admin\AppData\Roaming\L8f5LPEF8RbueUROsfx5hOEM.exe"3⤵
-
C:\Program Files (x86)\Company\NewProduct\KiffApp2.exe"C:\Program Files (x86)\Company\NewProduct\KiffApp2.exe"4⤵
-
-
C:\Program Files (x86)\Company\NewProduct\toolspab2.exe"C:\Program Files (x86)\Company\NewProduct\toolspab2.exe"4⤵
-
C:\Program Files (x86)\Company\NewProduct\toolspab2.exe"C:\Program Files (x86)\Company\NewProduct\toolspab2.exe"5⤵
-
-
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"4⤵
-
-
C:\Program Files (x86)\Company\NewProduct\pub02.exe"C:\Program Files (x86)\Company\NewProduct\pub02.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\1620170604276.exe"C:\Users\Admin\AppData\Roaming\1620170604276.exe" /sjson "C:\Users\Admin\AppData\Roaming\1620170604276.txt"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Program Files (x86)\Company\NewProduct\pub02.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "1_4924807894722937236.exe" /f & erase "C:\Program Files (x86)\Microsoft Data\Versium Research\1_4924807894722937236.exe" & exit3⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "1_4924807894722937236.exe" /f4⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Roaming\brwNKw7fDaAlvBgRIY8R7a7y.exe"C:\Users\Admin\AppData\Roaming\brwNKw7fDaAlvBgRIY8R7a7y.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\brwNKw7fDaAlvBgRIY8R7a7y.exe"{path}"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\brwNKw7fDaAlvBgRIY8R7a7y.exe"5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK6⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\DKvagToHhs10D20geshTM8Ld.exe"C:\Users\Admin\AppData\Roaming\DKvagToHhs10D20geshTM8Ld.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\45611402756.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\45611402756.exe"C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\45611402756.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\45611402756.exe"C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\45611402756.exe"6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\50058508324.exe" /mix4⤵
-
C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\50058508324.exe"C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\50058508324.exe" /mix5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 6046⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 6166⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 6286⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\02401471222.exe" /mix4⤵
-
C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\02401471222.exe"C:\Users\Admin\AppData\Local\Temp\{CqhX-vW7yn-FB1R-M6Gar}\02401471222.exe" /mix5⤵
-
C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exeedspolishpp.exe6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "DKvagToHhs10D20geshTM8Ld.exe" /f & erase "C:\Users\Admin\AppData\Roaming\DKvagToHhs10D20geshTM8Ld.exe" & exit4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "DKvagToHhs10D20geshTM8Ld.exe" /f5⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Roaming\nAflmI5XgBbQWms3XTAkJjgi.exe"C:\Users\Admin\AppData\Roaming\nAflmI5XgBbQWms3XTAkJjgi.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\aUMgQQ7EEJSDo6X96CPttEaR.exe"C:\Users\Admin\AppData\Roaming\aUMgQQ7EEJSDo6X96CPttEaR.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\IrTwL7QAu8lZueqIllrO7vKR.exe"C:\Users\Admin\AppData\Roaming\IrTwL7QAu8lZueqIllrO7vKR.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\9vyUzTAVCIUmbRaNdwsfK1bw.exe"C:\Users\Admin\AppData\Roaming\9vyUzTAVCIUmbRaNdwsfK1bw.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\x6hXEnpV45Rom6kH6QZMEHSG.exe"C:\Users\Admin\AppData\Roaming\x6hXEnpV45Rom6kH6QZMEHSG.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\RUzaPpTIUCI0xEKxDPnK0qsJ.exe"C:\Users\Admin\AppData\Roaming\RUzaPpTIUCI0xEKxDPnK0qsJ.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\DmZYxNs7gI3QNBrepCfAnsjR.exe"C:\Users\Admin\AppData\Roaming\DmZYxNs7gI3QNBrepCfAnsjR.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\RGmsobcNSI0Hn0dpqs5gRxKC.exe"C:\Users\Admin\AppData\Roaming\RGmsobcNSI0Hn0dpqs5gRxKC.exe"4⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5980 -s 8725⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\tRu64juttKQ8smz3E7w2aZ0i.exe"C:\Users\Admin\AppData\Roaming\tRu64juttKQ8smz3E7w2aZ0i.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\99692702435.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\99692702435.exe"C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\99692702435.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\99692702435.exe"C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\99692702435.exe"7⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\25896546375.exe" /mix5⤵
-
C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\25896546375.exe"C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\25896546375.exe" /mix6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\22897170105.exe" /mix5⤵
-
C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\22897170105.exe"C:\Users\Admin\AppData\Local\Temp\{P9VC-FZsQF-U2dW-A4MhW}\22897170105.exe" /mix6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "tRu64juttKQ8smz3E7w2aZ0i.exe" /f & erase "C:\Users\Admin\AppData\Roaming\tRu64juttKQ8smz3E7w2aZ0i.exe" & exit5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "tRu64juttKQ8smz3E7w2aZ0i.exe" /f6⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft Data\Versium Research\dp81GdX0OrCQ.exe"C:\Program Files (x86)\Microsoft Data\Versium Research\dp81GdX0OrCQ.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Program Files (x86)\Company\NewProduct\ifhvvyy.exe"C:\Program Files (x86)\Company\NewProduct\ifhvvyy.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SunLabsPlayer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\SunLabsPlayer.exe" /S1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsl6E33.tmp\tempfile.ps1"2⤵
-
-
C:\Program Files (x86)\Company\NewProduct\pwang.exe"C:\Program Files (x86)\Company\NewProduct\pwang.exe"1⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install2⤵
-
-
C:\Program Files (x86)\Company\NewProduct\setup.exe"C:\Program Files (x86)\Company\NewProduct\setup.exe"1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Program Files (x86)\Company\NewProduct\setup.exe"2⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/188-165-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/188-163-0x00000000008A0000-0x00000000008BD000-memory.dmp
memory/188-158-0x0000000000890000-0x0000000000891000-memory.dmp
memory/188-172-0x000000001AFC0000-0x000000001AFC2000-memory.dmp
memory/188-142-0x0000000000380000-0x0000000000381000-memory.dmp
memory/748-168-0x0000000005980000-0x0000000005981000-memory.dmp
memory/748-161-0x0000000005EA0000-0x0000000005EA1000-memory.dmp
memory/748-153-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/748-162-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/748-177-0x00000000068D0000-0x00000000068D1000-memory.dmp
memory/748-175-0x0000000005B90000-0x0000000005BA7000-memory.dmp
memory/748-171-0x00000000059A0000-0x0000000005E9E000-memory.dmp
memory/1000-198-0x000001EE5E830000-0x000001EE5E8A0000-memory.dmp
memory/1040-236-0x000001AB154B0000-0x000001AB15520000-memory.dmp
memory/1164-226-0x000001EAD71D0000-0x000001EAD7240000-memory.dmp
memory/1204-286-0x0000011CC17B0000-0x0000011CC1820000-memory.dmp
memory/1348-196-0x0000000004C9A000-0x0000000004D9B000-memory.dmp
memory/1348-205-0x0000000004F40000-0x0000000004F9C000-memory.dmp
memory/1396-304-0x000001E83A8D0000-0x000001E83A940000-memory.dmp
memory/1416-249-0x000002ED05010000-0x000002ED05080000-memory.dmp
memory/1852-258-0x000002B355330000-0x000002B3553A0000-memory.dmp
memory/2364-318-0x0000013FA6640000-0x0000013FA66B0000-memory.dmp
memory/2380-201-0x000001E1BB450000-0x000001E1BB49B000-memory.dmp
memory/2380-206-0x000001E1BB560000-0x000001E1BB5D0000-memory.dmp
memory/2596-247-0x0000016AA1910000-0x0000016AA1980000-memory.dmp
memory/2672-314-0x000001DFC2A90000-0x000001DFC2B00000-memory.dmp
memory/2692-315-0x0000024ADA440000-0x0000024ADA4B0000-memory.dmp
memory/2700-154-0x00000000012F0000-0x000000000193A000-memory.dmp
memory/2708-321-0x00000000025E0000-0x0000000002677000-memory.dmp
memory/2708-323-0x0000000000400000-0x0000000000887000-memory.dmp
memory/2848-133-0x0000000000400000-0x000000000042C000-memory.dmp
memory/3560-166-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3564-336-0x0000000004B62000-0x0000000004B63000-memory.dmp
memory/3564-333-0x0000000001FB0000-0x0000000001FE0000-memory.dmp
memory/3564-335-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3564-337-0x0000000004B63000-0x0000000004B64000-memory.dmp
memory/3564-328-0x0000000004B60000-0x0000000004B61000-memory.dmp
memory/3564-334-0x0000000004B64000-0x0000000004B66000-memory.dmp
memory/3612-169-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3632-155-0x0000000000160000-0x0000000000161000-memory.dmp
memory/3632-167-0x000000001B8C0000-0x000000001B8C2000-memory.dmp
memory/3764-228-0x0000023E998C0000-0x0000023E99930000-memory.dmp
memory/4088-129-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4148-237-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/4148-181-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4148-192-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/4148-210-0x0000000004BC0000-0x00000000051C6000-memory.dmp
memory/4148-208-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
memory/4148-195-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/4148-197-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
memory/4172-262-0x0000022432080000-0x00000224320F0000-memory.dmp
memory/4180-299-0x00000000004B0000-0x00000000004C2000-memory.dmp
memory/4180-276-0x00000000001F0000-0x0000000000200000-memory.dmp
memory/4288-294-0x00000000052D0000-0x00000000052D2000-memory.dmp
memory/4288-290-0x0000000005340000-0x0000000005341000-memory.dmp
memory/4288-273-0x0000000000B70000-0x0000000000B71000-memory.dmp
memory/4368-283-0x00000000000A0000-0x00000000000A1000-memory.dmp
memory/4368-310-0x0000000004A20000-0x0000000004A21000-memory.dmp
memory/4380-215-0x0000000002AD0000-0x0000000002AD2000-memory.dmp
memory/4484-214-0x0000000002F90000-0x0000000002F92000-memory.dmp
memory/4536-331-0x0000000000400000-0x0000000000459000-memory.dmp
memory/4536-329-0x0000000002080000-0x00000000020AE000-memory.dmp
memory/4652-225-0x0000000000130000-0x0000000000131000-memory.dmp
memory/4652-344-0x000000001BBD0000-0x000000001BBD2000-memory.dmp
memory/4740-309-0x0000000004AB0000-0x0000000004FAE000-memory.dmp
memory/4740-300-0x0000000000110000-0x0000000000111000-memory.dmp
memory/4848-240-0x0000000000230000-0x0000000000231000-memory.dmp
memory/4940-351-0x0000000002470000-0x000000000249F000-memory.dmp
memory/4940-353-0x0000000000400000-0x0000000000855000-memory.dmp
memory/5192-326-0x0000000004900000-0x0000000004901000-memory.dmp
memory/5400-341-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
memory/5852-342-0x0000000002E20000-0x0000000002E22000-memory.dmp
memory/6008-349-0x0000000000430000-0x000000000057A000-memory.dmp
memory/6048-350-0x0000017FDCDD0000-0x0000017FDCE1B000-memory.dmp