Analysis
- max time kernel
35s - max time network
144s - platform
windows10_x64 - resource
win10v20210410 - submitted
08/06/2021, 07:10
Errors
Reason
Machine shutdown
General
- Target 512b22a76932a80652eb16dfadd690344582d4d9.exe
- Size 749KB
- Sample210608-346dhc29ka
- SHA256 11fde3c052cc436dae10fa4c0b1821406d091cebb227a832a4f4c4101f21ffb4
Score
10/10
Malware Config
Signatures
- ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
- PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 31 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 23 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 33 IoCs
- Drops file in Windows directory 22 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Script User-Agent 11 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
C:\Users\Admin\AppData\Local\Temp\512b22a76932a80652eb16dfadd690344582d4d9.exe"C:\Users\Admin\AppData\Local\Temp\512b22a76932a80652eb16dfadd690344582d4d9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KM3L1.tmp\512b22a76932a80652eb16dfadd690344582d4d9.tmp"C:\Users\Admin\AppData\Local\Temp\is-KM3L1.tmp\512b22a76932a80652eb16dfadd690344582d4d9.tmp" /SL5="$8005A,506086,422400,C:\Users\Admin\AppData\Local\Temp\512b22a76932a80652eb16dfadd690344582d4d9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GPE45.tmp\è8__________________67.exe"C:\Users\Admin\AppData\Local\Temp\is-GPE45.tmp\è8__________________67.exe" /S /UID=1243⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\BNGFDQDWMM\IDownload.exe"C:\Program Files\Common Files\BNGFDQDWMM\IDownload.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5EHAE.tmp\IDownload.tmp"C:\Users\Admin\AppData\Local\Temp\is-5EHAE.tmp\IDownload.tmp" /SL5="$90046,994212,425984,C:\Program Files\Common Files\BNGFDQDWMM\IDownload.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\IDownload\IDownload.App.exe"C:\Program Files (x86)\IDownload\IDownload.App.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0u4reojb.cmdline"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES813D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC813C.tmp"8⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\d1-e3c5c-c68-dda8e-287d67013b3e6\SHemaehaesesho.exe"C:\Users\Admin\AppData\Local\Temp\d1-e3c5c-c68-dda8e-287d67013b3e6\SHemaehaesesho.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\41-11f5b-dd2-4a9b0-89fb89ddb8d3b\Vycujosheba.exe"C:\Users\Admin\AppData\Local\Temp\41-11f5b-dd2-4a9b0-89fb89ddb8d3b\Vycujosheba.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\42jp2gth.fnu\001.exe & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\42jp2gth.fnu\001.exeC:\Users\Admin\AppData\Local\Temp\42jp2gth.fnu\001.exe6⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bseutame.hni\installer.exe /qn CAMPAIGN="654" & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bseutame.hni\installer.exeC:\Users\Admin\AppData\Local\Temp\bseutame.hni\installer.exe /qn CAMPAIGN="654"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\bseutame.hni\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\bseutame.hni\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1622877475 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\czmbqnnr.sh5\gaoou.exe & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\czmbqnnr.sh5\gaoou.exeC:\Users\Admin\AppData\Local\Temp\czmbqnnr.sh5\gaoou.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w3ypdq4f.0md\Setup3310.exe /Verysilent /subid=623 & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\w3ypdq4f.0md\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\w3ypdq4f.0md\Setup3310.exe /Verysilent /subid=6236⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-R41HR.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-R41HR.tmp\Setup3310.tmp" /SL5="$1033A,138429,56832,C:\Users\Admin\AppData\Local\Temp\w3ypdq4f.0md\Setup3310.exe" /Verysilent /subid=6237⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-4FM48.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-4FM48.tmp\Setup.exe" /Verysilent8⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"9⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Data Finder\Versium Research\003.exe"C:\Program Files (x86)\Data Finder\Versium Research\003.exe"9⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-2UNL6.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-2UNL6.tmp\lylal220.tmp" /SL5="$303DE,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-H5J12.tmp\56FT____________________.exe"C:\Users\Admin\AppData\Local\Temp\is-H5J12.tmp\56FT____________________.exe" /S /UID=lylal22011⤵
- Executes dropped EXE
-
C:\Program Files\Uninstall Information\UJKPUUKZJK\irecord.exe"C:\Program Files\Uninstall Information\UJKPUUKZJK\irecord.exe" /VERYSILENT12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HMMRH.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-HMMRH.tmp\irecord.tmp" /SL5="$40464,6139911,56832,C:\Program Files\Uninstall Information\UJKPUUKZJK\irecord.exe" /VERYSILENT13⤵
-
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e7-bd347-2c3-0829d-9a304861fe3a3\Bemufuzharo.exe"C:\Users\Admin\AppData\Local\Temp\e7-bd347-2c3-0829d-9a304861fe3a3\Bemufuzharo.exe"12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\74-3f7b0-97e-de696-969308297364c\Ficyhevama.exe"C:\Users\Admin\AppData\Local\Temp\74-3f7b0-97e-de696-969308297364c\Ficyhevama.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vcwpudga.jif\001.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\vcwpudga.jif\001.exeC:\Users\Admin\AppData\Local\Temp\vcwpudga.jif\001.exe14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nql2vcni.ud2\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\nql2vcni.ud2\installer.exeC:\Users\Admin\AppData\Local\Temp\nql2vcni.ud2\installer.exe /qn CAMPAIGN="654"14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hxolp4oq.lmn\gaoou.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\hxolp4oq.lmn\gaoou.exeC:\Users\Admin\AppData\Local\Temp\hxolp4oq.lmn\gaoou.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dfnoi2m0.4md\Setup3310.exe /Verysilent /subid=623 & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\dfnoi2m0.4md\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\dfnoi2m0.4md\Setup3310.exe /Verysilent /subid=62314⤵
-
C:\Users\Admin\AppData\Local\Temp\is-P1QVB.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-P1QVB.tmp\Setup3310.tmp" /SL5="$50260,138429,56832,C:\Users\Admin\AppData\Local\Temp\dfnoi2m0.4md\Setup3310.exe" /Verysilent /subid=62315⤵
-
C:\Users\Admin\AppData\Local\Temp\is-457I5.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-457I5.tmp\Setup.exe" /Verysilent16⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zrzd4fu5.cwv\google-game.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\zrzd4fu5.cwv\google-game.exeC:\Users\Admin\AppData\Local\Temp\zrzd4fu5.cwv\google-game.exe14⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o15tufi2.skq\005.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\o15tufi2.skq\005.exeC:\Users\Admin\AppData\Local\Temp\o15tufi2.skq\005.exe14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3jyg11yx.sfn\toolspab1.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\3jyg11yx.sfn\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\3jyg11yx.sfn\toolspab1.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\3jyg11yx.sfn\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\3jyg11yx.sfn\toolspab1.exe15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0qa14uji.vrj\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\0qa14uji.vrj\installer.exeC:\Users\Admin\AppData\Local\Temp\0qa14uji.vrj\installer.exe /qn CAMPAIGN="654"14⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\0qa14uji.vrj\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\0qa14uji.vrj\ EXE_CMD_LINE="/forcecleanup /wintime 1622877475 /qn CAMPAIGN=""654"" " CAMPAIGN="654"15⤵
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-44L5K.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-44L5K.tmp\LabPicV3.tmp" /SL5="$203FE,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-83VUS.tmp\_____________.exe"C:\Users\Admin\AppData\Local\Temp\is-83VUS.tmp\_____________.exe" /S /UID=lab21411⤵
- Executes dropped EXE
-
C:\Program Files\Windows Sidebar\ATPMOZMTHE\prolab.exe"C:\Program Files\Windows Sidebar\ATPMOZMTHE\prolab.exe" /VERYSILENT12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-J7U3E.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-J7U3E.tmp\prolab.tmp" /SL5="$5011C,575243,216576,C:\Program Files\Windows Sidebar\ATPMOZMTHE\prolab.exe" /VERYSILENT13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\f7-b8a68-d2b-ccc9d-4ff7f59e47112\Furumapoga.exe"C:\Users\Admin\AppData\Local\Temp\f7-b8a68-d2b-ccc9d-4ff7f59e47112\Furumapoga.exe"12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\af-509b5-a5b-b2caa-db7ef0baead06\Nywununazha.exe"C:\Users\Admin\AppData\Local\Temp\af-509b5-a5b-b2caa-db7ef0baead06\Nywununazha.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\epdhmfad.g12\001.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\epdhmfad.g12\001.exeC:\Users\Admin\AppData\Local\Temp\epdhmfad.g12\001.exe14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jn5q03ri.4i4\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\jn5q03ri.4i4\installer.exeC:\Users\Admin\AppData\Local\Temp\jn5q03ri.4i4\installer.exe /qn CAMPAIGN="654"14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1pg2oo4m.yis\gaoou.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\1pg2oo4m.yis\gaoou.exeC:\Users\Admin\AppData\Local\Temp\1pg2oo4m.yis\gaoou.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\picebp3l.tuy\Setup3310.exe /Verysilent /subid=623 & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\picebp3l.tuy\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\picebp3l.tuy\Setup3310.exe /Verysilent /subid=62314⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8I4JC.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-8I4JC.tmp\Setup3310.tmp" /SL5="$10590,138429,56832,C:\Users\Admin\AppData\Local\Temp\picebp3l.tuy\Setup3310.exe" /Verysilent /subid=62315⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JH8U5.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-JH8U5.tmp\Setup.exe" /Verysilent16⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gnbq4h31.ebw\google-game.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\gnbq4h31.ebw\google-game.exeC:\Users\Admin\AppData\Local\Temp\gnbq4h31.ebw\google-game.exe14⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get15⤵
- Modifies Internet Explorer settings
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ba2dqxoo.js4\005.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\ba2dqxoo.js4\005.exeC:\Users\Admin\AppData\Local\Temp\ba2dqxoo.js4\005.exe14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mlpymxyj.54j\toolspab1.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\mlpymxyj.54j\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\mlpymxyj.54j\toolspab1.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\mlpymxyj.54j\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\mlpymxyj.54j\toolspab1.exe15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4j2a00re.twv\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\4j2a00re.twv\installer.exeC:\Users\Admin\AppData\Local\Temp\4j2a00re.twv\installer.exe /qn CAMPAIGN="654"14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kbl11o2z.tj0\702564a0.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\kbl11o2z.tj0\702564a0.exeC:\Users\Admin\AppData\Local\Temp\kbl11o2z.tj0\702564a0.exe14⤵
-
-
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\4244674.exe"C:\Users\Admin\AppData\Roaming\4244674.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 200011⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\4331621.exe"C:\Users\Admin\AppData\Roaming\4331621.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"11⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im RunWW.exe /f11⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 611⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vt51huny.52g\google-game.exe & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vt51huny.52g\google-game.exeC:\Users\Admin\AppData\Local\Temp\vt51huny.52g\google-game.exe6⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get7⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eursas3d.md5\005.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\eursas3d.md5\005.exeC:\Users\Admin\AppData\Local\Temp\eursas3d.md5\005.exe6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mmkltab5.on0\toolspab1.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\mmkltab5.on0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\mmkltab5.on0\toolspab1.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\mmkltab5.on0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\mmkltab5.on0\toolspab1.exe7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\clu1lxh5.ryv\installer.exe /qn CAMPAIGN="654" & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\clu1lxh5.ryv\installer.exeC:\Users\Admin\AppData\Local\Temp\clu1lxh5.ryv\installer.exe /qn CAMPAIGN="654"6⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\clu1lxh5.ryv\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\clu1lxh5.ryv\ EXE_CMD_LINE="/forcecleanup /wintime 1622877475 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1h0cyswi.cz2\702564a0.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\1h0cyswi.cz2\702564a0.exeC:\Users\Admin\AppData\Local\Temp\1h0cyswi.cz2\702564a0.exe6⤵
-
-
-
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0DB7920FAFD77CD17403519FCE2FAE77 C2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9E506F6530DFCF4E13FD0D74FCBFA9252⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0B6F58F054E05D9124BBE3BD5392B005 E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B0E730C7FB295771AA00506C4B8A88D6 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3A375154F7902D7F416406CBBA1982D02⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8EE91F4E7F9C2FCDB6C4707A6708A523 E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 70D0101AE769BAAFF6FA28E3D21B9C16 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 940B093DBC1894F20C9E6BEF80CC0CCF2⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 607B9FBBCF82DF797CF2B33059842899 E Global\MSI00002⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\CEC.exeC:\Users\Admin\AppData\Local\Temp\CEC.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1913.exeC:\Users\Admin\AppData\Local\Temp\1913.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4E1E.exeC:\Users\Admin\AppData\Local\Temp\4E1E.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/944-311-0x000001F190F50000-0x000001F190FC1000-memory.dmp
memory/1004-270-0x000001D452170000-0x000001D4521E1000-memory.dmp
memory/1104-298-0x00000196D2110000-0x00000196D2181000-memory.dmp
memory/1208-319-0x000001BC5D960000-0x000001BC5D9D1000-memory.dmp
memory/1508-192-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1536-159-0x0000000000A60000-0x0000000000A62000-memory.dmp
memory/1872-313-0x000002202BF80000-0x000002202BFF1000-memory.dmp
memory/2404-283-0x0000020584F40000-0x0000020584FB1000-memory.dmp
memory/2444-276-0x00000227F1B10000-0x00000227F1B81000-memory.dmp
memory/2792-281-0x00000269E1F00000-0x00000269E1F71000-memory.dmp
memory/3724-123-0x0000000002910000-0x0000000002912000-memory.dmp
memory/4012-126-0x0000000000400000-0x000000000046E000-memory.dmp
memory/4048-136-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/4204-137-0x00000000026E0000-0x00000000026E2000-memory.dmp
memory/4216-171-0x00000000005B0000-0x00000000005C2000-memory.dmp
memory/4216-170-0x00000000001F0000-0x0000000000200000-memory.dmp
memory/4228-228-0x0000000005110000-0x0000000005111000-memory.dmp
memory/4228-212-0x0000000005010000-0x0000000005011000-memory.dmp
memory/4228-223-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/4228-224-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/4228-225-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/4228-226-0x00000000050F0000-0x00000000050F1000-memory.dmp
memory/4228-227-0x0000000005100000-0x0000000005101000-memory.dmp
memory/4228-216-0x0000000005050000-0x0000000005051000-memory.dmp
memory/4228-215-0x0000000005040000-0x0000000005041000-memory.dmp
memory/4228-214-0x0000000005030000-0x0000000005031000-memory.dmp
memory/4228-213-0x0000000005020000-0x0000000005021000-memory.dmp
memory/4228-221-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/4228-209-0x0000000005000000-0x0000000005001000-memory.dmp
memory/4228-208-0x0000000001F70000-0x0000000001F71000-memory.dmp
memory/4228-222-0x00000000050B0000-0x00000000050B1000-memory.dmp
memory/4228-220-0x0000000005090000-0x0000000005091000-memory.dmp
memory/4228-201-0x0000000003930000-0x000000000396C000-memory.dmp
memory/4228-219-0x0000000005080000-0x0000000005081000-memory.dmp
memory/4228-218-0x0000000005070000-0x0000000005071000-memory.dmp
memory/4228-217-0x0000000005060000-0x0000000005061000-memory.dmp
memory/4240-164-0x0000000002152000-0x0000000002154000-memory.dmp
memory/4240-180-0x0000000002156000-0x0000000002158000-memory.dmp
memory/4240-178-0x0000000002155000-0x0000000002156000-memory.dmp
memory/4240-172-0x0000000002154000-0x0000000002155000-memory.dmp
memory/4240-148-0x0000000002150000-0x0000000002152000-memory.dmp
memory/4248-149-0x0000000002960000-0x0000000002962000-memory.dmp
memory/4248-150-0x0000000002962000-0x0000000002964000-memory.dmp
memory/4248-160-0x0000000002965000-0x0000000002966000-memory.dmp
memory/4456-114-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4624-275-0x000001BEE3B00000-0x000001BEE3B71000-memory.dmp
memory/4740-119-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/5184-261-0x00000000031E0000-0x00000000032E1000-memory.dmp
memory/5184-265-0x0000000004BF0000-0x0000000004C4C000-memory.dmp
memory/5256-343-0x0000000005360000-0x0000000005361000-memory.dmp
memory/5256-339-0x000000000AE00000-0x000000000AE01000-memory.dmp
memory/5256-338-0x0000000002DA0000-0x0000000002DAE000-memory.dmp
memory/5256-341-0x000000000A9A0000-0x000000000A9A1000-memory.dmp
memory/5256-335-0x0000000000C20000-0x0000000000C21000-memory.dmp
memory/5256-337-0x0000000002D80000-0x0000000002D81000-memory.dmp
memory/5332-263-0x00000264488B0000-0x00000264488FB000-memory.dmp
memory/5332-267-0x0000026448B70000-0x0000026448BE1000-memory.dmp
memory/5548-342-0x0000000002120000-0x0000000002121000-memory.dmp
memory/5548-331-0x0000000000040000-0x0000000000041000-memory.dmp
memory/5548-340-0x0000000002100000-0x0000000002120000-memory.dmp
memory/5548-334-0x0000000002270000-0x0000000002271000-memory.dmp
memory/5684-305-0x00000000009C0000-0x000000000101F000-memory.dmp
memory/5780-293-0x0000000000400000-0x000000000046A000-memory.dmp
memory/5864-300-0x0000000000A80000-0x0000000000A81000-memory.dmp
memory/5864-312-0x000000001B970000-0x000000001B972000-memory.dmp
memory/5864-315-0x00000000011A0000-0x00000000011BB000-memory.dmp
memory/5904-299-0x0000000000400000-0x000000000046D000-memory.dmp
memory/5988-316-0x00000000001F0000-0x00000000001F1000-memory.dmp