Analysis
-
max time kernel
42s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-06-2021 15:26
Errors
Reason
Machine shutdown
General
-
Target
B499D366F01242597E6386FCBBBACFB7.exe
-
Size
3.8MB
-
MD5
b499d366f01242597e6386fcbbbacfb7
-
SHA1
f4555ab40925523a3183adb353cde2d80aa5fad8
-
SHA256
b566e04e4dde55640065fa942fcfa35ec3cb5f0c8b6057bfd0039ac4ebbc65f7
-
SHA512
136fe6b35f1df85f5ea4121a1d3d64f54fbc6d5384ebfa9d69a4dd0c3e1073afd4592b62261080925513d4fa9b71a616d1c8e1e8cedb2a63e39d6b7b14a59401
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
PUB57-1
C2
pupdatastart.store:80
pupdata.online:80
Extracted
Family
smokeloader
Version
2020
C2
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
rc4.i32
rc4.i32
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Nirsoft 1 IoCs
-
Vidar Stealer 1 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 3 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 29 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 14 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 9 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 3 IoCs
-
Kills process with taskkill 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 13 IoCs
-
Modifies registry class 64 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\B499D366F01242597E6386FCBBBACFB7.exe"C:\Users\Admin\AppData\Local\Temp\B499D366F01242597E6386FCBBBACFB7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_1.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_1.exemetina_1.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im metina_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_1.exe" & del C:\ProgramData\*.dll & exit5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im metina_1.exe /f6⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 66⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_3.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_3.exemetina_3.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get5⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_4.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_4.exemetina_4.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2N8FV.tmp\metina_4.tmp"C:\Users\Admin\AppData\Local\Temp\is-2N8FV.tmp\metina_4.tmp" /SL5="$60030,189670,105984,C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_4.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-VQAFD.tmp\(_____(_(_________))235 Smeargle.exe"C:\Users\Admin\AppData\Local\Temp\is-VQAFD.tmp\(_____(_(_________))235 Smeargle.exe" /S /UID=burnerch16⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\VideoLAN\QFUOJHITEV\ultramediaburner.exe"C:\Program Files\VideoLAN\QFUOJHITEV\ultramediaburner.exe" /VERYSILENT7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-69RBS.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-69RBS.tmp\ultramediaburner.tmp" /SL5="$201E0,281924,62464,C:\Program Files\VideoLAN\QFUOJHITEV\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu9⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\59-7fddc-508-4428b-a31ddcdf7c435\Facujasaenu.exe"C:\Users\Admin\AppData\Local\Temp\59-7fddc-508-4428b-a31ddcdf7c435\Facujasaenu.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\52-fb8a5-060-b2caf-27a4ea27e0051\Maelataevyvae.exe"C:\Users\Admin\AppData\Local\Temp\52-fb8a5-060-b2caf-27a4ea27e0051\Maelataevyvae.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\srowmvas.cqk\0001.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\srowmvas.cqk\0001.exeC:\Users\Admin\AppData\Local\Temp\srowmvas.cqk\0001.exe9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Doni.accdr10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd11⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^CsRkgzgmRwVzsDotCVfchWJCceiYNrfnGaiEMyZGjSkhiTrqaqWOXRKFIgQkkfMOLvNZvEsvWIpxLcxCZiFNuAAPHBVbfOxWubCKyrDOIASfHfUhUgjtKYHlWXsVITiohhggTJvVERtGIkiaGI$" Piu.accdr12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Nel.exe.comNel.exe.com M12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Nel.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Nel.exe.com M13⤵
- Executes dropped EXE
- Drops startup file
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 3012⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "10⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\twgspc4f.lzw\001.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\twgspc4f.lzw\001.exeC:\Users\Admin\AppData\Local\Temp\twgspc4f.lzw\001.exe9⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ih3g5i2u.pxs\ebook.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\ih3g5i2u.pxs\ebook.exeC:\Users\Admin\AppData\Local\Temp\ih3g5i2u.pxs\ebook.exe9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ih3g5i2u.pxs\EBOOKE~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\ih3g5i2u.pxs\ebook.exe10⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\ih3g5i2u.pxs\EBOOKE~1.DLL,W0UWfI0=11⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp502.tmp.ps1"12⤵
- Blocklisted process makes network request
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp12A0.tmp.ps1"12⤵
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost13⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask12⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask12⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 74010⤵
- Program crash
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u35qjdmj.03k\GcleanerEU.exe /eufive & exit8⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ccvkdx3y.e1b\md1_1eaf.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\ccvkdx3y.e1b\md1_1eaf.exeC:\Users\Admin\AppData\Local\Temp\ccvkdx3y.e1b\md1_1eaf.exe9⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vel0naxt.oz5\installer.exe /qn CAMPAIGN="654" & exit8⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jwzurzip.1tl\gaoou.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\jwzurzip.1tl\gaoou.exeC:\Users\Admin\AppData\Local\Temp\jwzurzip.1tl\gaoou.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5510vav2.fdw\Setup3310.exe /Verysilent /subid=623 & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\5510vav2.fdw\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\5510vav2.fdw\Setup3310.exe /Verysilent /subid=6239⤵
-
C:\Users\Admin\AppData\Local\Temp\is-23JJ2.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-23JJ2.tmp\Setup3310.tmp" /SL5="$20382,138429,56832,C:\Users\Admin\AppData\Local\Temp\5510vav2.fdw\Setup3310.exe" /Verysilent /subid=62310⤵
-
C:\Users\Admin\AppData\Local\Temp\is-9NG51.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-9NG51.tmp\Setup.exe" /Verysilent11⤵
-
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LN1GU.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-LN1GU.tmp\LabPicV3.tmp" /SL5="$30470,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JHN8I.tmp\_____________.exe"C:\Users\Admin\AppData\Local\Temp\is-JHN8I.tmp\_____________.exe" /S /UID=lab21414⤵
-
C:\Program Files\Java\TPKFLJSXPE\prolab.exe"C:\Program Files\Java\TPKFLJSXPE\prolab.exe" /VERYSILENT15⤵
-
C:\Users\Admin\AppData\Local\Temp\is-839N4.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-839N4.tmp\prolab.tmp" /SL5="$6021A,575243,216576,C:\Program Files\Java\TPKFLJSXPE\prolab.exe" /VERYSILENT16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7f-49c19-e61-ad6b1-e9bcece8eb139\Tecaewahare.exe"C:\Users\Admin\AppData\Local\Temp\7f-49c19-e61-ad6b1-e9bcece8eb139\Tecaewahare.exe"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\21-edafb-fd4-06cb1-b21f4820ccc16\Vaewepigysha.exe"C:\Users\Admin\AppData\Local\Temp\21-edafb-fd4-06cb1-b21f4820ccc16\Vaewepigysha.exe"15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d4r3cbdf.wdd\001.exe & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\d4r3cbdf.wdd\001.exeC:\Users\Admin\AppData\Local\Temp\d4r3cbdf.wdd\001.exe17⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0ejvw0ke.1mm\GcleanerEU.exe /eufive & exit16⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fgif4epc.05v\installer.exe /qn CAMPAIGN="654" & exit16⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jbgnk4g1.ru4\gaoou.exe & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\jbgnk4g1.ru4\gaoou.exeC:\Users\Admin\AppData\Local\Temp\jbgnk4g1.ru4\gaoou.exe17⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt18⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rmkmtpng.jvl\Setup3310.exe /Verysilent /subid=623 & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\rmkmtpng.jvl\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\rmkmtpng.jvl\Setup3310.exe /Verysilent /subid=62317⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6BRAC.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-6BRAC.tmp\Setup3310.tmp" /SL5="$205C2,138429,56832,C:\Users\Admin\AppData\Local\Temp\rmkmtpng.jvl\Setup3310.exe" /Verysilent /subid=62318⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DVNSB.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-DVNSB.tmp\Setup.exe" /Verysilent19⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bdvwkicl.zdr\google-game.exe & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\bdvwkicl.zdr\google-game.exeC:\Users\Admin\AppData\Local\Temp\bdvwkicl.zdr\google-game.exe17⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init18⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\al4tbqlg.35v\005.exe & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\al4tbqlg.35v\005.exeC:\Users\Admin\AppData\Local\Temp\al4tbqlg.35v\005.exe17⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cv5rvtza.1el\GcleanerWW.exe /mixone & exit16⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0fkk2uch.hwn\toolspab1.exe & exit16⤵
-
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LN1GV.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-LN1GV.tmp\lylal220.tmp" /SL5="$2049A,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4BF4O.tmp\56FT____________________.exe"C:\Users\Admin\AppData\Local\Temp\is-4BF4O.tmp\56FT____________________.exe" /S /UID=lylal22014⤵
-
C:\Program Files\Windows Multimedia Platform\TUICDOOLHE\irecord.exe"C:\Program Files\Windows Multimedia Platform\TUICDOOLHE\irecord.exe" /VERYSILENT15⤵
-
C:\Users\Admin\AppData\Local\Temp\is-KID2I.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-KID2I.tmp\irecord.tmp" /SL5="$3047A,6139911,56832,C:\Program Files\Windows Multimedia Platform\TUICDOOLHE\irecord.exe" /VERYSILENT16⤵
-
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu17⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\21-ff273-568-720a9-0d750f8d55dfb\Ninyrycywe.exe"C:\Users\Admin\AppData\Local\Temp\21-ff273-568-720a9-0d750f8d55dfb\Ninyrycywe.exe"15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hyqjr5cm.5mj\001.exe & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\hyqjr5cm.5mj\001.exeC:\Users\Admin\AppData\Local\Temp\hyqjr5cm.5mj\001.exe17⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kb41kfs4.w1f\GcleanerEU.exe /eufive & exit16⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\by410axl.jx0\installer.exe /qn CAMPAIGN="654" & exit16⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3k2qqbyg.3jj\gaoou.exe & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\3k2qqbyg.3jj\gaoou.exeC:\Users\Admin\AppData\Local\Temp\3k2qqbyg.3jj\gaoou.exe17⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt18⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fvh2zr5x.0mj\Setup3310.exe /Verysilent /subid=623 & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\fvh2zr5x.0mj\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\fvh2zr5x.0mj\Setup3310.exe /Verysilent /subid=62317⤵
-
C:\Users\Admin\AppData\Local\Temp\is-IUFDH.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-IUFDH.tmp\Setup3310.tmp" /SL5="$105CA,138429,56832,C:\Users\Admin\AppData\Local\Temp\fvh2zr5x.0mj\Setup3310.exe" /Verysilent /subid=62318⤵
-
C:\Users\Admin\AppData\Local\Temp\is-T6005.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-T6005.tmp\Setup.exe" /Verysilent19⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3ntlq0nj.trd\google-game.exe & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\3ntlq0nj.trd\google-game.exeC:\Users\Admin\AppData\Local\Temp\3ntlq0nj.trd\google-game.exe17⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init18⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i2c41wqd.ll2\005.exe & exit16⤵
-
C:\Users\Admin\AppData\Local\Temp\i2c41wqd.ll2\005.exeC:\Users\Admin\AppData\Local\Temp\i2c41wqd.ll2\005.exe17⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\d6-07514-409-ebeb8-a00484af77b69\Cujibikyfo.exe"C:\Users\Admin\AppData\Local\Temp\d6-07514-409-ebeb8-a00484af77b69\Cujibikyfo.exe"15⤵
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"12⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install13⤵
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit13⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im RunWW.exe /f14⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 614⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lknxxku3.ddl\google-game.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\lknxxku3.ddl\google-game.exeC:\Users\Admin\AppData\Local\Temp\lknxxku3.ddl\google-game.exe9⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init10⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ud4yndyy.4yj\005.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\ud4yndyy.4yj\005.exeC:\Users\Admin\AppData\Local\Temp\ud4yndyy.4yj\005.exe9⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5qxjx34b.rhz\GcleanerWW.exe /mixone & exit8⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5gujtial.lp0\toolspab1.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\5gujtial.lp0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\5gujtial.lp0\toolspab1.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\5gujtial.lp0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\5gujtial.lp0\toolspab1.exe10⤵
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_5.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_5.exemetina_5.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_6.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_6.exemetina_6.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\7924424.exe"C:\Users\Admin\AppData\Roaming\7924424.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\8482913.exe"C:\Users\Admin\AppData\Roaming\8482913.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\6589672.exe"C:\Users\Admin\AppData\Roaming\6589672.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6589672.exe"{path}"6⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_2.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_2.exemetina_2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_7.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_7.exemetina_7.exe4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_9.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_9.exemetina_9.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_9.exeC:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_9.exe5⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_8.exe3⤵
- Suspicious use of WriteProcessMemory
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F93F54\metina_8.exemetina_8.exe1⤵
- Executes dropped EXE
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\4FA7.exeC:\Users\Admin\AppData\Local\Temp\4FA7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4FA7.exeC:\Users\Admin\AppData\Local\Temp\4FA7.exe2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\48ab3dd6-4b43-4020-887d-bd9272883be6" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\4FA7.exe"C:\Users\Admin\AppData\Local\Temp\4FA7.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\4FA7.exe"C:\Users\Admin\AppData\Local\Temp\4FA7.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\79fa4412-2636-4973-8635-6a5edd063c94\updatewin1.exe"C:\Users\Admin\AppData\Local\79fa4412-2636-4973-8635-6a5edd063c94\updatewin1.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\79fa4412-2636-4973-8635-6a5edd063c94\updatewin2.exe"C:\Users\Admin\AppData\Local\79fa4412-2636-4973-8635-6a5edd063c94\updatewin2.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\79fa4412-2636-4973-8635-6a5edd063c94\5.exe"C:\Users\Admin\AppData\Local\79fa4412-2636-4973-8635-6a5edd063c94\5.exe"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5F19.exeC:\Users\Admin\AppData\Local\Temp\5F19.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9165.exeC:\Users\Admin\AppData\Local\Temp\9165.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\9165.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\ABE4.exeC:\Users\Admin\AppData\Local\Temp\ABE4.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\DFB6.exeC:\Users\Admin\AppData\Local\Temp\DFB6.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Disabling Security Tools
1File and Directory Permissions Modification
1Modify Registry
3Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
368KB
-
Filesize
1.0MB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
68KB
-
Filesize
452KB
-
Filesize
4KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
452KB
-
Filesize
300KB
-
Filesize
452KB
-
Filesize
128KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
88KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
8KB
-
Filesize
700KB
-
Filesize
1.3MB
-
Filesize
36KB
-
Filesize
344KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
440KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
5.0MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
8KB