redline | b244fb7a7b39c836a9629262eaa80865cfbaf37aaea1b1d4b880d8a864f865a4

Resubmissions

11-07-2024 05:43

240711-gej4lstgrf 10

06-09-2021 14:13

08-07-2021 11:08

08-07-2021 08:02

07-07-2021 09:39

06-07-2021 17:51

06-07-2021 13:45

Analysis

max time kernel
1322s
max time network
1389s
platform
windows7_x64
resource
win7v20210410
submitted
27-06-2021 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_x86_x64_install - копия (13).exe

Score

10^/10

redline vidar 706 servani aspackv2 discovery infostealer spyware stealer upx

Malware Config

Extracted

Family

vidar

Version

39.4

Botnet

706

https://sergeevih43.tumblr.com

Attributes

profile_id
706

Extracted

Family

redline

Botnet

ServAni

87.251.71.195:82

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

resource	yara_rule
behavioral7/memory/784-161-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral7/memory/784-162-0x0000000000417F26-mapping.dmp	family_redline
behavioral7/memory/784-167-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral7/memory/1820-158-0x0000000000ED0000-0x0000000000F6D000-memory.dmp	family_vidar
behavioral7/memory/1820-159-0x0000000000400000-0x0000000000949000-memory.dmp	family_vidar

ASPack v2.12-2.42 14 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral7/files/0x000300000001313e-69.dat	aspack_v212_v242
behavioral7/files/0x000300000001313e-71.dat	aspack_v212_v242
behavioral7/files/0x000300000001313e-70.dat	aspack_v212_v242
behavioral7/files/0x000300000001313e-73.dat	aspack_v212_v242
behavioral7/files/0x0003000000013133-74.dat	aspack_v212_v242
behavioral7/files/0x0003000000013133-75.dat	aspack_v212_v242
behavioral7/files/0x0003000000013131-77.dat	aspack_v212_v242
behavioral7/files/0x0003000000013131-76.dat	aspack_v212_v242
behavioral7/files/0x000300000001313a-83.dat	aspack_v212_v242
behavioral7/files/0x000300000001313a-82.dat	aspack_v212_v242
behavioral7/files/0x000300000001313e-88.dat	aspack_v212_v242
behavioral7/files/0x000300000001313e-87.dat	aspack_v212_v242
behavioral7/files/0x000300000001313e-86.dat	aspack_v212_v242
behavioral7/files/0x000300000001313e-85.dat	aspack_v212_v242

Executes dropped EXE 11 IoCs

pid	Process
1144	setup_installer.exe
1736	setup_install.exe
1820	arnatic_1.exe
1396	arnatic_2.exe
1604	arnatic_7.exe
1752	arnatic_4.exe
1596	jfiag3g_gg.exe
784	arnatic_7.exe
1104	jfiag3g_gg.exe
1000	jfiag3g_gg.exe
920	jfiag3g_gg.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral7/files/0x0003000000013152-150.dat	upx
behavioral7/files/0x0003000000013152-149.dat	upx
behavioral7/files/0x0003000000013152-152.dat	upx
behavioral7/files/0x0003000000013152-157.dat	upx
behavioral7/files/0x0003000000013152-156.dat	upx
behavioral7/files/0x0003000000013152-155.dat	upx
behavioral7/files/0x0009000000013153-175.dat	upx
behavioral7/files/0x0009000000013153-173.dat	upx
behavioral7/files/0x0009000000013153-172.dat	upx

Loads dropped DLL 51 IoCs

pid	Process
1092	setup_x86_x64_install - копия (13).exe
1144	setup_installer.exe
1144	setup_installer.exe
1144	setup_installer.exe
1144	setup_installer.exe
1144	setup_installer.exe
1144	setup_installer.exe
1736	setup_install.exe
1736	setup_install.exe
1736	setup_install.exe
1736	setup_install.exe
1736	setup_install.exe
1736	setup_install.exe
1736	setup_install.exe
1736	setup_install.exe
1460	cmd.exe
1460	cmd.exe
548	cmd.exe
548	cmd.exe
1348	cmd.exe
616	cmd.exe
616	cmd.exe
1820	arnatic_1.exe
1820	arnatic_1.exe
1604	arnatic_7.exe
1604	arnatic_7.exe
1752	arnatic_4.exe
1752	arnatic_4.exe
1752	arnatic_4.exe
1752	arnatic_4.exe
1604	arnatic_7.exe
1596	jfiag3g_gg.exe
1596	jfiag3g_gg.exe
784	arnatic_7.exe
784	arnatic_7.exe
1752	arnatic_4.exe
1752	arnatic_4.exe
1104	jfiag3g_gg.exe
1104	jfiag3g_gg.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe
1752	arnatic_4.exe
1752	arnatic_4.exe
1000	jfiag3g_gg.exe
1000	jfiag3g_gg.exe
1752	arnatic_4.exe
1752	arnatic_4.exe
920	jfiag3g_gg.exe
920	jfiag3g_gg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1604 set thread context of 784	1604	arnatic_7.exe	44

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	1820	WerFault.exe	42

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	arnatic_1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	arnatic_4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	arnatic_4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	arnatic_1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1104	jfiag3g_gg.exe
784	arnatic_7.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
268	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	784	arnatic_7.exe
Token: SeDebugPrivilege	268	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1144	1092	setup_x86_x64_install - копия (13).exe	26
PID 1092 wrote to memory of 1144	1092	setup_x86_x64_install - копия (13).exe	26
PID 1092 wrote to memory of 1144	1092	setup_x86_x64_install - копия (13).exe	26
PID 1092 wrote to memory of 1144	1092	setup_x86_x64_install - копия (13).exe	26
PID 1092 wrote to memory of 1144	1092	setup_x86_x64_install - копия (13).exe	26
PID 1092 wrote to memory of 1144	1092	setup_x86_x64_install - копия (13).exe	26
PID 1092 wrote to memory of 1144	1092	setup_x86_x64_install - копия (13).exe	26
PID 1144 wrote to memory of 1736	1144	setup_installer.exe	27
PID 1144 wrote to memory of 1736	1144	setup_installer.exe	27
PID 1144 wrote to memory of 1736	1144	setup_installer.exe	27
PID 1144 wrote to memory of 1736	1144	setup_installer.exe	27
PID 1144 wrote to memory of 1736	1144	setup_installer.exe	27
PID 1144 wrote to memory of 1736	1144	setup_installer.exe	27
PID 1144 wrote to memory of 1736	1144	setup_installer.exe	27
PID 1736 wrote to memory of 548	1736	setup_install.exe	30
PID 1736 wrote to memory of 548	1736	setup_install.exe	30
PID 1736 wrote to memory of 548	1736	setup_install.exe	30
PID 1736 wrote to memory of 548	1736	setup_install.exe	30
PID 1736 wrote to memory of 548	1736	setup_install.exe	30
PID 1736 wrote to memory of 548	1736	setup_install.exe	30
PID 1736 wrote to memory of 548	1736	setup_install.exe	30
PID 1736 wrote to memory of 1460	1736	setup_install.exe	31
PID 1736 wrote to memory of 1460	1736	setup_install.exe	31
PID 1736 wrote to memory of 1460	1736	setup_install.exe	31
PID 1736 wrote to memory of 1460	1736	setup_install.exe	31
PID 1736 wrote to memory of 1460	1736	setup_install.exe	31
PID 1736 wrote to memory of 1460	1736	setup_install.exe	31
PID 1736 wrote to memory of 1460	1736	setup_install.exe	31
PID 1736 wrote to memory of 1908	1736	setup_install.exe	33
PID 1736 wrote to memory of 1908	1736	setup_install.exe	33
PID 1736 wrote to memory of 1908	1736	setup_install.exe	33
PID 1736 wrote to memory of 1908	1736	setup_install.exe	33
PID 1736 wrote to memory of 1908	1736	setup_install.exe	33
PID 1736 wrote to memory of 1908	1736	setup_install.exe	33
PID 1736 wrote to memory of 1908	1736	setup_install.exe	33
PID 1736 wrote to memory of 1348	1736	setup_install.exe	38
PID 1736 wrote to memory of 1348	1736	setup_install.exe	38
PID 1736 wrote to memory of 1348	1736	setup_install.exe	38
PID 1736 wrote to memory of 1348	1736	setup_install.exe	38
PID 1736 wrote to memory of 1348	1736	setup_install.exe	38
PID 1736 wrote to memory of 1348	1736	setup_install.exe	38
PID 1736 wrote to memory of 1348	1736	setup_install.exe	38
PID 1736 wrote to memory of 1248	1736	setup_install.exe	37
PID 1736 wrote to memory of 1248	1736	setup_install.exe	37
PID 1736 wrote to memory of 1248	1736	setup_install.exe	37
PID 1736 wrote to memory of 1248	1736	setup_install.exe	37
PID 1736 wrote to memory of 1248	1736	setup_install.exe	37
PID 1736 wrote to memory of 1248	1736	setup_install.exe	37
PID 1736 wrote to memory of 1248	1736	setup_install.exe	37
PID 1736 wrote to memory of 1440	1736	setup_install.exe	34
PID 1736 wrote to memory of 1440	1736	setup_install.exe	34
PID 1736 wrote to memory of 1440	1736	setup_install.exe	34
PID 1736 wrote to memory of 1440	1736	setup_install.exe	34
PID 1736 wrote to memory of 1440	1736	setup_install.exe	34
PID 1736 wrote to memory of 1440	1736	setup_install.exe	34
PID 1736 wrote to memory of 1440	1736	setup_install.exe	34
PID 1736 wrote to memory of 616	1736	setup_install.exe	35
PID 1736 wrote to memory of 616	1736	setup_install.exe	35
PID 1736 wrote to memory of 616	1736	setup_install.exe	35
PID 1736 wrote to memory of 616	1736	setup_install.exe	35
PID 1736 wrote to memory of 616	1736	setup_install.exe	35
PID 1736 wrote to memory of 616	1736	setup_install.exe	35
PID 1736 wrote to memory of 616	1736	setup_install.exe	35
PID 1460 wrote to memory of 1396	1460	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (13).exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (13).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\7zS874E8C34\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS874E8C34\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_1.exe
      4⤵
      Loads dropped DLL
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\7zS874E8C34\arnatic_1.exe
        
        arnatic_1.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:1820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 964
        6⤵
        Loads dropped DLL
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_2.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\7zS874E8C34\arnatic_2.exe
        
        arnatic_2.exe
        5⤵
        Executes dropped EXE
        
        PID:1396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_3.exe
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_6.exe
      4⤵
      PID:1440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_7.exe
      4⤵
      Loads dropped DLL
      PID:616
    - - C:\Users\Admin\AppData\Local\Temp\7zS874E8C34\arnatic_7.exe
        
        arnatic_7.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\7zS874E8C34\arnatic_7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS874E8C34\arnatic_7.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_5.exe
      4⤵
      PID:1248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_4.exe
      4⤵
      Loads dropped DLL
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\7zS874E8C34\arnatic_4.exe
        
        arnatic_4.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-179-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/784-161-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/784-169-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/784-167-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1092-60-0x00000000757D1000-0x00000000757D3000-memory.dmp

Filesize
8KB

Download
memory/1604-147-0x0000000001010000-0x0000000001011000-memory.dmp

Filesize
4KB

Download
memory/1736-92-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1736-105-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1736-114-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1736-115-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1736-116-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1736-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1736-112-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1736-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1736-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1736-110-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1736-109-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1736-107-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1820-158-0x0000000000ED0000-0x0000000000F6D000-memory.dmp

Filesize
628KB

Download
memory/1820-159-0x0000000000400000-0x0000000000949000-memory.dmp

Filesize
5.3MB

Download