cryptbot | aa38af0f16d1e18d0e9e3ce186b7b4505fce90d26dcb925108c1923df691bd38

Analysis

max time kernel
7s
max time network
181s
platform
windows7_x64
resource
win7v20210410
submitted
08/06/2021, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18be39daf69b6139f2e8c7e96cac0a5f.exe
Size 3.2MB
Sample210608-lt6d969tp6
SHA256 aa38af0f16d1e18d0e9e3ce186b7b4505fce90d26dcb925108c1923df691bd38
MD5 18be39daf69b6139f2e8c7e96cac0a5f
SHA1 f80d3598c1df89bad1bd8692162da5de4c1acd1d
SHA512 78b1cc667c9d02716077b9cc3b994f18163b0bd2d0bb6c6408a169840fa6aacfc581e57cf9db1dc1796f2df474cca37a02dfe9e7aa55d7e4d2ed552da7e3b937
MD5 SHA1 SHA512

Score

10^/10

cryptbot glupteba metasploit raccoon redline 28198d4512d0cf31c204eddceb4471d79950b588 aspackv2 backdoor dropper infostealer loader spyware stealer trojan upx

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

raccoon

Botnet

28198d4512d0cf31c204eddceb4471d79950b588

Attributes

url4cnc
https://tttttt.me/capibar

rc4.plain

Extracted

Family

cryptbot

olmjby22.top
mortyl02.top

Attributes

payload_url
http://vamzxy03.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1860-302-0x0000000001E90000-0x0000000001F71000-memory.dmp	family_cryptbot
behavioral1/memory/1860-304-0x0000000000400000-0x00000000004E5000-memory.dmp	family_cryptbot

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

resource	yara_rule
behavioral1/memory/2824-273-0x0000000002D00000-0x000000000360C000-memory.dmp	family_glupteba
behavioral1/memory/2824-274-0x0000000000400000-0x0000000000D26000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral1/memory/2680-278-0x0000000000417D7E-mapping.dmp	family_redline
behavioral1/memory/2032-283-0x0000000000417D92-mapping.dmp	family_redline

ASPack v2.12-2.42 14 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130f3-69.dat	aspack_v212_v242
behavioral1/files/0x00030000000130f3-70.dat	aspack_v212_v242
behavioral1/files/0x00030000000130f3-71.dat	aspack_v212_v242
behavioral1/files/0x00030000000130f3-73.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e9-74.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e9-75.dat	aspack_v212_v242
behavioral1/files/0x00050000000130e8-76.dat	aspack_v212_v242
behavioral1/files/0x00050000000130e8-77.dat	aspack_v212_v242
behavioral1/files/0x00030000000130eb-82.dat	aspack_v212_v242
behavioral1/files/0x00030000000130eb-83.dat	aspack_v212_v242
behavioral1/files/0x00030000000130f3-88.dat	aspack_v212_v242
behavioral1/files/0x00030000000130f3-87.dat	aspack_v212_v242
behavioral1/files/0x00030000000130f3-86.dat	aspack_v212_v242
behavioral1/files/0x00030000000130f3-85.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
1140	setup_installer.exe
1776	setup_install.exe
1532	metina_1.exe
2028	metina_2.exe
1948	metina_4.exe
1952	metina_3.exe
2020	metina_6.exe
1204	metina_5.exe
608	metina_3.tmp

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000130ea-198.dat	upx

Loads dropped DLL 32 IoCs

pid	Process
1012	18be39daf69b6139f2e8c7e96cac0a5f.exe
1140	setup_installer.exe
1140	setup_installer.exe
1140	setup_installer.exe
1140	setup_installer.exe
1140	setup_installer.exe
1140	setup_installer.exe
1776	setup_install.exe
1776	setup_install.exe
1776	setup_install.exe
1776	setup_install.exe
1776	setup_install.exe
1776	setup_install.exe
1776	setup_install.exe
1776	setup_install.exe
992	cmd.exe
992	cmd.exe
872	3499395.exe
924	cmd.exe
1104	cmd.exe
1504	cmd.exe
2028	metina_2.exe
2028	metina_2.exe
1028	cmd.exe
2020	metina_6.exe
2020	metina_6.exe
1952	metina_3.exe
1952	metina_3.exe
1952	metina_3.exe
608	metina_3.tmp
608	metina_3.tmp
608	metina_3.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
124	ip-api.com
135	ipinfo.io
142	ipinfo.io
11	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2348	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2584	taskkill.exe
1632	taskkill.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	138	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	165	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1140	1012	18be39daf69b6139f2e8c7e96cac0a5f.exe	26
PID 1012 wrote to memory of 1140	1012	18be39daf69b6139f2e8c7e96cac0a5f.exe	26
PID 1012 wrote to memory of 1140	1012	18be39daf69b6139f2e8c7e96cac0a5f.exe	26
PID 1012 wrote to memory of 1140	1012	18be39daf69b6139f2e8c7e96cac0a5f.exe	26
PID 1012 wrote to memory of 1140	1012	18be39daf69b6139f2e8c7e96cac0a5f.exe	26
PID 1012 wrote to memory of 1140	1012	18be39daf69b6139f2e8c7e96cac0a5f.exe	26
PID 1012 wrote to memory of 1140	1012	18be39daf69b6139f2e8c7e96cac0a5f.exe	26
PID 1140 wrote to memory of 1776	1140	setup_installer.exe	28
PID 1140 wrote to memory of 1776	1140	setup_installer.exe	28
PID 1140 wrote to memory of 1776	1140	setup_installer.exe	28
PID 1140 wrote to memory of 1776	1140	setup_installer.exe	28
PID 1140 wrote to memory of 1776	1140	setup_installer.exe	28
PID 1140 wrote to memory of 1776	1140	setup_installer.exe	28
PID 1140 wrote to memory of 1776	1140	setup_installer.exe	28
PID 1776 wrote to memory of 992	1776	setup_install.exe	32
PID 1776 wrote to memory of 992	1776	setup_install.exe	32
PID 1776 wrote to memory of 992	1776	setup_install.exe	32
PID 1776 wrote to memory of 992	1776	setup_install.exe	32
PID 1776 wrote to memory of 992	1776	setup_install.exe	32
PID 1776 wrote to memory of 992	1776	setup_install.exe	32
PID 1776 wrote to memory of 992	1776	setup_install.exe	32
PID 1776 wrote to memory of 872	1776	setup_install.exe	33
PID 1776 wrote to memory of 872	1776	setup_install.exe	33
PID 1776 wrote to memory of 872	1776	setup_install.exe	33
PID 1776 wrote to memory of 872	1776	setup_install.exe	33
PID 1776 wrote to memory of 872	1776	setup_install.exe	33
PID 1776 wrote to memory of 872	1776	setup_install.exe	33
PID 1776 wrote to memory of 872	1776	setup_install.exe	33
PID 1776 wrote to memory of 924	1776	setup_install.exe	34
PID 1776 wrote to memory of 924	1776	setup_install.exe	34
PID 1776 wrote to memory of 924	1776	setup_install.exe	34
PID 1776 wrote to memory of 924	1776	setup_install.exe	34
PID 1776 wrote to memory of 924	1776	setup_install.exe	34
PID 1776 wrote to memory of 924	1776	setup_install.exe	34
PID 1776 wrote to memory of 924	1776	setup_install.exe	34
PID 1776 wrote to memory of 1504	1776	setup_install.exe	35
PID 1776 wrote to memory of 1504	1776	setup_install.exe	35
PID 1776 wrote to memory of 1504	1776	setup_install.exe	35
PID 1776 wrote to memory of 1504	1776	setup_install.exe	35
PID 1776 wrote to memory of 1504	1776	setup_install.exe	35
PID 1776 wrote to memory of 1504	1776	setup_install.exe	35
PID 1776 wrote to memory of 1504	1776	setup_install.exe	35
PID 992 wrote to memory of 1532	992	cmd.exe	36
PID 992 wrote to memory of 1532	992	cmd.exe	36
PID 992 wrote to memory of 1532	992	cmd.exe	36
PID 992 wrote to memory of 1532	992	cmd.exe	36
PID 992 wrote to memory of 1532	992	cmd.exe	36
PID 992 wrote to memory of 1532	992	cmd.exe	36
PID 992 wrote to memory of 1532	992	cmd.exe	36
PID 1776 wrote to memory of 1028	1776	setup_install.exe	37
PID 1776 wrote to memory of 1028	1776	setup_install.exe	37
PID 1776 wrote to memory of 1028	1776	setup_install.exe	37
PID 1776 wrote to memory of 1028	1776	setup_install.exe	37
PID 1776 wrote to memory of 1028	1776	setup_install.exe	37
PID 1776 wrote to memory of 1028	1776	setup_install.exe	37
PID 1776 wrote to memory of 1028	1776	setup_install.exe	37
PID 1776 wrote to memory of 1104	1776	setup_install.exe	38
PID 1776 wrote to memory of 1104	1776	setup_install.exe	38
PID 1776 wrote to memory of 1104	1776	setup_install.exe	38
PID 1776 wrote to memory of 1104	1776	setup_install.exe	38
PID 1776 wrote to memory of 1104	1776	setup_install.exe	38
PID 1776 wrote to memory of 1104	1776	setup_install.exe	38
PID 1776 wrote to memory of 1104	1776	setup_install.exe	38
PID 1776 wrote to memory of 332	1776	setup_install.exe	50

C:\Users\Admin\AppData\Local\Temp\18be39daf69b6139f2e8c7e96cac0a5f.exe
"C:\Users\Admin\AppData\Local\Temp\18be39daf69b6139f2e8c7e96cac0a5f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Users\Admin\AppData\Local\Temp\7zS47457D94\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS47457D94\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_1.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\7zS47457D94\metina_1.exe
        
        metina_1.exe
        5⤵
        Executes dropped EXE
        
        PID:1532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_2.exe
      4⤵
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\7zS47457D94\metina_2.exe
        
        metina_2.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_3.exe
      4⤵
      Loads dropped DLL
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\7zS47457D94\metina_3.exe
        
        metina_3.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_4.exe
      4⤵
      Loads dropped DLL
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\7zS47457D94\metina_4.exe
        
        metina_4.exe
        5⤵
        Executes dropped EXE
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:2416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_5.exe
      4⤵
      Loads dropped DLL
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\7zS47457D94\metina_5.exe
        
        metina_5.exe
        5⤵
        Executes dropped EXE
        
        PID:1204
      - C:\Users\Admin\AppData\Roaming\3499395.exe
        
        "C:\Users\Admin\AppData\Roaming\3499395.exe"
        6⤵
        Loads dropped DLL
        
        PID:872
      - C:\Users\Admin\AppData\Roaming\4064958.exe
        
        "C:\Users\Admin\AppData\Roaming\4064958.exe"
        6⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        
        PID:2180
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_6.exe
      4⤵
      Loads dropped DLL
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\7zS47457D94\metina_6.exe
        
        metina_6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2020
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C powershell Add-MpPreference -ExclusionExtension .exe -Force
        6⤵
        
        PID:1632
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\J2L4OPHCSROKAFQDW363LDK1.exe"
        6⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Roaming\J2L4OPHCSROKAFQDW363LDK1.exe
        
        "C:\Users\Admin\AppData\Roaming\J2L4OPHCSROKAFQDW363LDK1.exe"
        7⤵
        
        PID:2824
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\0SYMC72L5YLC5ZE5Z7C4F28I.exe"
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Roaming\0SYMC72L5YLC5ZE5Z7C4F28I.exe
        
        "C:\Users\Admin\AppData\Roaming\0SYMC72L5YLC5ZE5Z7C4F28I.exe"
        7⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\25723264143.exe"
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\25723264143.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\25723264143.exe"
        9⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\25723264143.exe"
        10⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        11⤵
        Delays execution with timeout.exe
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\64206819364.exe" /mix
        8⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\83087511834.exe" /mix
        8⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\83087511834.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\83087511834.exe" /mix
        9⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exe
        
        edspolishpp.exe
        10⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "0SYMC72L5YLC5ZE5Z7C4F28I.exe" /f & erase "C:\Users\Admin\AppData\Roaming\0SYMC72L5YLC5ZE5Z7C4F28I.exe" & exit
        8⤵
        
        PID:2788
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\ZW24DLRJRUPQ34XWDFSDA8WC.exe"
        6⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Roaming\ZW24DLRJRUPQ34XWDFSDA8WC.exe
        
        "C:\Users\Admin\AppData\Roaming\ZW24DLRJRUPQ34XWDFSDA8WC.exe"
        7⤵
        
        PID:2724
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\9RF99O46UGQDJKUP5P93IYVQ.exe"
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Roaming\9RF99O46UGQDJKUP5P93IYVQ.exe
        
        "C:\Users\Admin\AppData\Roaming\9RF99O46UGQDJKUP5P93IYVQ.exe"
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Roaming\9RF99O46UGQDJKUP5P93IYVQ.exe
        
        C:\Users\Admin\AppData\Roaming\9RF99O46UGQDJKUP5P93IYVQ.exe
        8⤵
        
        PID:2032
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\Y6SF2ZRSAOE1RWGGRNJFJVOB.exe"
        6⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Roaming\Y6SF2ZRSAOE1RWGGRNJFJVOB.exe
        
        "C:\Users\Admin\AppData\Roaming\Y6SF2ZRSAOE1RWGGRNJFJVOB.exe"
        7⤵
        
        PID:2708
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\JNQLTU57UQCJV76PRIUOL35U.exe"
        6⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Roaming\JNQLTU57UQCJV76PRIUOL35U.exe
        
        "C:\Users\Admin\AppData\Roaming\JNQLTU57UQCJV76PRIUOL35U.exe"
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
        
        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o gulf.moneroocean.stream:10128 -u 499DUXTsgeNCiUBBZxPZaYj1uiSCAcCF8jDmNXkX8nTUTuZ9xQrR8kLhk8sNCeU5VMKZtoeNpQncYfLLWt3zRxGy3uMQSMV -p x -k -v=0 --donate-level=1 -t 1
        8⤵
        
        PID:3052
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\U1PEJXWFUMK4M0ZYLK8T2B0B.exe"
        6⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Roaming\U1PEJXWFUMK4M0ZYLK8T2B0B.exe
        
        "C:\Users\Admin\AppData\Roaming\U1PEJXWFUMK4M0ZYLK8T2B0B.exe"
        7⤵
        
        PID:2748
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
        8⤵
        
        PID:2680
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\R8IM6F6GSUVA95T7VQ0UCHRY.exe"
        6⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Roaming\R8IM6F6GSUVA95T7VQ0UCHRY.exe
        
        "C:\Users\Admin\AppData\Roaming\R8IM6F6GSUVA95T7VQ0UCHRY.exe"
        7⤵
        
        PID:2768
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "metina_6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS47457D94\metina_6.exe" & exit
        6⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "metina_6.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:2584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_7.exe
      4⤵
      PID:332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_9.exe
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_10.exe
      4⤵
      PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c metina_8.exe
      4⤵
      PID:1512

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension .exe -Force
1⤵
PID:1872

C:\Users\Admin\AppData\Local\Temp\is-QJ8Q9.tmp\metina_3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-QJ8Q9.tmp\metina_3.tmp" /SL5="$5012C,176358,92672,C:\Users\Admin\AppData\Local\Temp\7zS47457D94\metina_3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608
- C:\Users\Admin\AppData\Local\Temp\is-JHU8K.tmp\67________F.exe
  "C:\Users\Admin\AppData\Local\Temp\is-JHU8K.tmp\67________F.exe" /S /UID=burnerch1
  2⤵
  PID:2124
- - C:\Users\Admin\AppData\Local\Temp\29-f33a7-214-96989-bd757a979f396\Ficezhokiqu.exe
    "C:\Users\Admin\AppData\Local\Temp\29-f33a7-214-96989-bd757a979f396\Ficezhokiqu.exe"
    3⤵
    PID:1288
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
      4⤵
      PID:1752
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
        5⤵
        
        PID:2496
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\259430193.exe"
        6⤵
        
        PID:3380
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:1127442 /prefetch:2
        5⤵
        
        PID:3668
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:340994 /prefetch:2
        5⤵
        
        PID:3660
- - C:\Users\Admin\AppData\Local\Temp\33-97c46-bb1-279a5-60d4e6f02c022\Dofeqidaeshae.exe
    "C:\Users\Admin\AppData\Local\Temp\33-97c46-bb1-279a5-60d4e6f02c022\Dofeqidaeshae.exe"
    3⤵
    PID:1928
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vfzhbb4q.vbb\001.exe & exit
      4⤵
      PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\vfzhbb4q.vbb\001.exe
        
        C:\Users\Admin\AppData\Local\Temp\vfzhbb4q.vbb\001.exe
        5⤵
        
        PID:968
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j2xhmtdq.ebb\installer.exe /qn CAMPAIGN="654" & exit
      4⤵
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\j2xhmtdq.ebb\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\j2xhmtdq.ebb\installer.exe /qn CAMPAIGN="654"
        5⤵
        
        PID:2068
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4e5pdprj.13p\gaoou.exe & exit
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\4e5pdprj.13p\gaoou.exe
        
        C:\Users\Admin\AppData\Local\Temp\4e5pdprj.13p\gaoou.exe
        5⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1140
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m5ap3ug4.agz\Setup3310.exe /Verysilent /subid=623 & exit
      4⤵
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\m5ap3ug4.agz\Setup3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\m5ap3ug4.agz\Setup3310.exe /Verysilent /subid=623
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\is-D9014.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-D9014.tmp\Setup3310.tmp" /SL5="$102F2,138429,56832,C:\Users\Admin\AppData\Local\Temp\m5ap3ug4.agz\Setup3310.exe" /Verysilent /subid=623
        6⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\is-DEP9A.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-DEP9A.tmp\Setup.exe" /Verysilent
        7⤵
        
        PID:2452
        
        C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
        8⤵
        
        PID:2332
        
        C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
        8⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        9⤵
        
        PID:3492
        
        C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
        8⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
        9⤵
        
        PID:3432
        
        C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
        8⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\is-CQPTU.tmp\lylal220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CQPTU.tmp\lylal220.tmp" /SL5="$303EC,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
        9⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\is-0C1AT.tmp\56FT____________________.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-0C1AT.tmp\56FT____________________.exe" /S /UID=lylal220
        10⤵
        
        PID:3640
        
        C:\Program Files (x86)\Data Finder\Versium Research\003.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\003.exe"
        8⤵
        
        PID:3200
        
        C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"
        8⤵
        
        PID:3220
        
        C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
        8⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\is-FQD6S.tmp\LabPicV3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FQD6S.tmp\LabPicV3.tmp" /SL5="$20388,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
        9⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\is-B9VDU.tmp\_____________.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-B9VDU.tmp\_____________.exe" /S /UID=lab214
        10⤵
        
        PID:3740
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g1b0koa3.aei\google-game.exe & exit
      4⤵
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\g1b0koa3.aei\google-game.exe
        
        C:\Users\Admin\AppData\Local\Temp\g1b0koa3.aei\google-game.exe
        5⤵
        
        PID:2620
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kn5gajg3.igt\005.exe & exit
      4⤵
      PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\kn5gajg3.igt\005.exe
        
        C:\Users\Admin\AppData\Local\Temp\kn5gajg3.igt\005.exe
        5⤵
        
        PID:3132
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bsdmhfkf.vlt\toolspab1.exe & exit
      4⤵
      PID:3160
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2lgh2uic.kol\installer.exe /qn CAMPAIGN="654" & exit
      4⤵
      PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\2lgh2uic.kol\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\2lgh2uic.kol\installer.exe /qn CAMPAIGN="654"
        5⤵
        
        PID:3584
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xylphlpx.32k\702564a0.exe & exit
      4⤵
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\xylphlpx.32k\702564a0.exe
        
        C:\Users\Admin\AppData\Local\Temp\xylphlpx.32k\702564a0.exe
        5⤵
        
        PID:3796
- - C:\Program Files\Mozilla Firefox\XMMKRBACPD\ultramediaburner.exe
    "C:\Program Files\Mozilla Firefox\XMMKRBACPD\ultramediaburner.exe" /VERYSILENT
    3⤵
    PID:2388

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
1⤵
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2836

C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\64206819364.exe
"C:\Users\Admin\AppData\Local\Temp\{ToRG-j0aRL-uJvl-F5Ecv}\64206819364.exe" /mix
1⤵
PID:1860

C:\Users\Admin\AppData\Local\Temp\is-5D00T.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5D00T.tmp\ultramediaburner.tmp" /SL5="$70156,281924,62464,C:\Program Files\Mozilla Firefox\XMMKRBACPD\ultramediaburner.exe" /VERYSILENT
1⤵
PID:1872
- C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
  "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
  2⤵
  PID:3068

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "0SYMC72L5YLC5ZE5Z7C4F28I.exe" /f
1⤵
- Kills process with taskkill
PID:1632

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16808050171053655016355768516-16299190-14967990588687759577669046-1611033256"
1⤵
PID:1632

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1140
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 858EB6DC99C424D4852A4DD03CAA8954 C
  2⤵
  PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-195-0x0000000002120000-0x000000000217C000-memory.dmp

Download

memory/332-193-0x0000000001FB0000-0x00000000020B1000-memory.dmp

Download

memory/608-179-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/872-207-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/872-214-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/872-205-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/872-216-0x0000000000240000-0x0000000000260000-memory.dmp

Download

memory/872-218-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/876-197-0x0000000001700000-0x0000000001770000-memory.dmp

Download

memory/968-312-0x0000000000280000-0x0000000000290000-memory.dmp

Download

memory/968-313-0x0000000000440000-0x0000000000452000-memory.dmp

Download

memory/1012-60-0x00000000757E1000-0x00000000757E3000-memory.dmp

Download

memory/1204-157-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/1204-176-0x0000000000B00000-0x0000000000B02000-memory.dmp

Download

memory/1204-168-0x0000000000250000-0x000000000026B000-memory.dmp

Download

memory/1288-303-0x0000000000BF0000-0x0000000000BF2000-memory.dmp

Download

memory/1696-200-0x0000000000310000-0x0000000000380000-memory.dmp

Download

memory/1696-194-0x0000000000060000-0x00000000000AB000-memory.dmp

Download

memory/1776-100-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/1776-97-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1776-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1776-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1776-92-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/1776-93-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1776-99-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1776-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1776-94-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1776-95-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1776-98-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1776-96-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1824-210-0x0000000000030000-0x0000000000031000-memory.dmp

Download

memory/1824-215-0x00000000004D0000-0x00000000004D1000-memory.dmp

Download

memory/1824-213-0x00000000004C0000-0x00000000004CE000-memory.dmp

Download

memory/1824-212-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/1860-302-0x0000000001E90000-0x0000000001F71000-memory.dmp

Download

memory/1860-304-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

memory/1872-185-0x0000000001F70000-0x0000000002BBA000-memory.dmp

Download

memory/1872-234-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/1872-180-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/1872-184-0x0000000001F70000-0x0000000002BBA000-memory.dmp

Download

memory/1872-276-0x000000007EF30000-0x000000007EF31000-memory.dmp

Download

memory/1872-299-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/1872-182-0x00000000048A0000-0x00000000048A1000-memory.dmp

Download

memory/1928-306-0x0000000002170000-0x0000000002172000-memory.dmp

Download

memory/1928-307-0x0000000002176000-0x0000000002195000-memory.dmp

Download

memory/1952-161-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2020-158-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

memory/2020-202-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/2032-284-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/2068-314-0x0000000000380000-0x000000000041D000-memory.dmp

Download

memory/2124-226-0x0000000000B00000-0x0000000000B02000-memory.dmp

Download

memory/2180-227-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download

memory/2180-221-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/2388-295-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2492-287-0x00000000002D0000-0x0000000000362000-memory.dmp

Download

memory/2492-288-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/2596-309-0x0000000000730000-0x00000000007FE000-memory.dmp

Download

memory/2596-311-0x0000000000400000-0x00000000004D5000-memory.dmp

Download

memory/2624-258-0x0000000000540000-0x0000000000541000-memory.dmp

Download

memory/2664-267-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/2664-266-0x0000000000270000-0x000000000029F000-memory.dmp

Download

memory/2680-280-0x0000000000970000-0x0000000000971000-memory.dmp

Download

memory/2696-264-0x0000000005030000-0x0000000005031000-memory.dmp

Download

memory/2708-271-0x0000000004A03000-0x0000000004A04000-memory.dmp

Download

memory/2708-265-0x0000000000250000-0x000000000027F000-memory.dmp

Download

memory/2708-269-0x0000000004A01000-0x0000000004A02000-memory.dmp

Download

memory/2708-268-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2708-270-0x0000000004A02000-0x0000000004A03000-memory.dmp

Download

memory/2708-272-0x0000000004A04000-0x0000000004A06000-memory.dmp

Download

memory/2724-261-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/2748-257-0x0000000004E40000-0x0000000004E41000-memory.dmp

Download

memory/2768-262-0x00000000050B0000-0x00000000050B1000-memory.dmp

Download

memory/2824-274-0x0000000000400000-0x0000000000D26000-memory.dmp

Download

memory/2824-273-0x0000000002D00000-0x000000000360C000-memory.dmp

Download

memory/2836-260-0x0000000000460000-0x00000000004D1000-memory.dmp

Download

memory/2836-282-0x0000000001FE0000-0x0000000001FFB000-memory.dmp

Download

memory/2836-281-0x0000000002F10000-0x0000000003016000-memory.dmp

Download

memory/2836-259-0x00000000000E0000-0x000000000012B000-memory.dmp

Download

memory/3032-315-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3052-279-0x0000000001160000-0x0000000001180000-memory.dmp

Download

memory/3068-301-0x0000000001E80000-0x0000000001E82000-memory.dmp

Download

memory/3068-308-0x0000000001E86000-0x0000000001EA5000-memory.dmp

Download

memory/3068-310-0x0000000001EA5000-0x0000000001EA6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads