Overview
overview
10Static
static
setup_x86_...0).exe
windows7_x64
10setup_x86_...0).exe
windows10_x64
10setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows7_x64
setup_x86_...4).exe
windows10_x64
10setup_x86_...5).exe
windows7_x64
setup_x86_...5).exe
windows10_x64
10setup_x86_...6).exe
windows7_x64
10setup_x86_...6).exe
windows10_x64
10setup_x86_...7).exe
windows7_x64
setup_x86_...7).exe
windows10_x64
10setup_x86_...8).exe
windows7_x64
setup_x86_...8).exe
windows10_x64
10setup_x86_...9).exe
windows7_x64
10setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
10setup_x86_...2).exe
windows10_x64
10setup_x86_...0).exe
windows7_x64
10setup_x86_...0).exe
windows10_x64
10setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...3).exe
windows7_x64
10setup_x86_...3).exe
windows10_x64
Resubmissions
11-07-2024 05:43
240711-gej4lstgrf 1006-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
233s -
max time network
1808s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
02-07-2021 07:13
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win7v20210408
fickerstealerredlinevidar01_07_rservaniaspackv2discoveryevasioninfostealerpersistencespywarestealertrojanupx
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210408
redlinesmokeloadervidar706932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (11).exe
Resource
win7v20210410
fickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (12).exe
Resource
win7v20210410
cryptbotfickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoordiscordstealerdiscoveryevasioninfostealerpersistencespywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
redlinesmokeloadervidar706865903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealerthemidatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (13).exe
Resource
win7v20210408
cryptbotfickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210410
redlinesmokeloadervidar706932servaniaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (14).exe
Resource
win7v20210408
cryptbotfickerstealerredlinesmokeloadervidar01_07_rservaniaspackv2backdoorevasioninfostealerspywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210410
redlinesmokeloadervidar706932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (15).exe
Resource
win7v20210408
cryptbotfickerstealerredlinesmokeloadervidar73942eeshakal_teamaspackv2backdoorevasioninfostealerspywarestealerthemidatrojanvmprotect
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210410
redlinesmokeloadervidar706865903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (16).exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
redlinesmokeloadervidar706865servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (17).exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210408
redlinesmokeloadervidar706865932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (18).exe
Resource
win7v20210410
cryptbotfickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210408
redlinesmokeloadervidar706865903932servaniaspackv2backdoordiscordstealerdiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (19).exe
Resource
win7v20210410
cryptbotfickerstealerredlinesmokeloadervidar01_07_r706865903932servaniaspackv2backdoordiscoveryevasioninfostealerspywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210410
redlinesmokeloadervidar706903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (2).exe
Resource
win7v20210408
cryptbotfickerstealerredlinesmokeloadervidar01_07_r517706865903932servaniaspackv2backdoordiscordstealerdiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210410
redlinesmokeloadervidar706865932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия (20).exe
Resource
win7v20210408
cryptbotfickerstealerredlinevidar70673942865903932eeservaniaspackv2discoveryevasioninfostealerspywarestealertrojanupx
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral24
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210410
redlinesmokeloadervidar706865903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealerthemidatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral25
Sample
setup_x86_x64_install - копия (21).exe
Resource
win7v20210408
cryptbotfickerstealerredlinesmokeloadervidarservaniaspackv2backdoorevasioninfostealerspywarestealertrojanupx
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral26
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210410
redlinesmokeloadervidar706903servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral27
Sample
setup_x86_x64_install - копия (22).exe
Resource
win7v20210410
fickerstealerplugxredlinesmokeloadervidaraspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanupx
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral28
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210408
redlinesmokeloadervidar706servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral29
Sample
setup_x86_x64_install - копия (23).exe
Resource
win7v20210410
cryptbotfickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral30
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210408
redlinesmokeloadervidar706865932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral31
Sample
setup_x86_x64_install - копия (3).exe
Resource
win7v20210410
fickerstealerredlinesmokeloadervidar517706865903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral32
Sample
setup_x86_x64_install - копия (3).exe
Resource
win10v20210408
plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
windows10_x64
0 signatures
0 seconds
Malware Config
Signatures
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral13/memory/1520-147-0x0000000000E80000-0x0000000000F1D000-memory.dmp family_vidar -
resource yara_rule behavioral13/files/0x00030000000130e1-69.dat aspack_v212_v242 behavioral13/files/0x00030000000130e1-70.dat aspack_v212_v242 behavioral13/files/0x00030000000130e1-71.dat aspack_v212_v242 behavioral13/files/0x00030000000130e1-73.dat aspack_v212_v242 behavioral13/files/0x00030000000130dc-74.dat aspack_v212_v242 behavioral13/files/0x00030000000130db-76.dat aspack_v212_v242 behavioral13/files/0x00030000000130db-77.dat aspack_v212_v242 behavioral13/files/0x00030000000130dc-75.dat aspack_v212_v242 behavioral13/files/0x00030000000130de-82.dat aspack_v212_v242 behavioral13/files/0x00030000000130de-83.dat aspack_v212_v242 behavioral13/files/0x00030000000130e1-86.dat aspack_v212_v242 behavioral13/files/0x00030000000130e1-88.dat aspack_v212_v242 behavioral13/files/0x00030000000130e1-87.dat aspack_v212_v242 behavioral13/files/0x00030000000130e1-85.dat aspack_v212_v242 -
Executes dropped EXE 6 IoCs
pid Process 1096 setup_installer.exe 268 setup_install.exe 1520 arnatic_1.exe 1660 arnatic_4.exe 1840 arnatic_2.exe 956 arnatic_7.exe -
Loads dropped DLL 30 IoCs
pid Process 1668 setup_x86_x64_install - копия (16).exe 1096 setup_installer.exe 1096 setup_installer.exe 1096 setup_installer.exe 1096 setup_installer.exe 1096 setup_installer.exe 1096 setup_installer.exe 268 setup_install.exe 268 setup_install.exe 268 setup_install.exe 268 setup_install.exe 268 setup_install.exe 268 setup_install.exe 268 setup_install.exe 268 setup_install.exe 1592 cmd.exe 1592 cmd.exe 436 cmd.exe 1548 cmd.exe 1548 cmd.exe 1520 arnatic_1.exe 1520 arnatic_1.exe 744 cmd.exe 744 cmd.exe 956 arnatic_7.exe 956 arnatic_7.exe 608 WerFault.exe 608 WerFault.exe 608 WerFault.exe 608 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 608 1520 WerFault.exe 37 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 arnatic_1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e arnatic_1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e arnatic_1.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 608 WerFault.exe 608 WerFault.exe 608 WerFault.exe 608 WerFault.exe 608 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 608 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 608 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1096 1668 setup_x86_x64_install - копия (16).exe 26 PID 1668 wrote to memory of 1096 1668 setup_x86_x64_install - копия (16).exe 26 PID 1668 wrote to memory of 1096 1668 setup_x86_x64_install - копия (16).exe 26 PID 1668 wrote to memory of 1096 1668 setup_x86_x64_install - копия (16).exe 26 PID 1668 wrote to memory of 1096 1668 setup_x86_x64_install - копия (16).exe 26 PID 1668 wrote to memory of 1096 1668 setup_x86_x64_install - копия (16).exe 26 PID 1668 wrote to memory of 1096 1668 setup_x86_x64_install - копия (16).exe 26 PID 1096 wrote to memory of 268 1096 setup_installer.exe 27 PID 1096 wrote to memory of 268 1096 setup_installer.exe 27 PID 1096 wrote to memory of 268 1096 setup_installer.exe 27 PID 1096 wrote to memory of 268 1096 setup_installer.exe 27 PID 1096 wrote to memory of 268 1096 setup_installer.exe 27 PID 1096 wrote to memory of 268 1096 setup_installer.exe 27 PID 1096 wrote to memory of 268 1096 setup_installer.exe 27 PID 268 wrote to memory of 1592 268 setup_install.exe 29 PID 268 wrote to memory of 1592 268 setup_install.exe 29 PID 268 wrote to memory of 1592 268 setup_install.exe 29 PID 268 wrote to memory of 1592 268 setup_install.exe 29 PID 268 wrote to memory of 1592 268 setup_install.exe 29 PID 268 wrote to memory of 1592 268 setup_install.exe 29 PID 268 wrote to memory of 1592 268 setup_install.exe 29 PID 268 wrote to memory of 1548 268 setup_install.exe 40 PID 268 wrote to memory of 1548 268 setup_install.exe 40 PID 268 wrote to memory of 1548 268 setup_install.exe 40 PID 268 wrote to memory of 1548 268 setup_install.exe 40 PID 268 wrote to memory of 1548 268 setup_install.exe 40 PID 268 wrote to memory of 1548 268 setup_install.exe 40 PID 268 wrote to memory of 1548 268 setup_install.exe 40 PID 268 wrote to memory of 1244 268 setup_install.exe 39 PID 268 wrote to memory of 1244 268 setup_install.exe 39 PID 268 wrote to memory of 1244 268 setup_install.exe 39 PID 268 wrote to memory of 1244 268 setup_install.exe 39 PID 268 wrote to memory of 1244 268 setup_install.exe 39 PID 268 wrote to memory of 1244 268 setup_install.exe 39 PID 268 wrote to memory of 1244 268 setup_install.exe 39 PID 268 wrote to memory of 436 268 setup_install.exe 38 PID 268 wrote to memory of 436 268 setup_install.exe 38 PID 268 wrote to memory of 436 268 setup_install.exe 38 PID 268 wrote to memory of 436 268 setup_install.exe 38 PID 268 wrote to memory of 436 268 setup_install.exe 38 PID 268 wrote to memory of 436 268 setup_install.exe 38 PID 268 wrote to memory of 436 268 setup_install.exe 38 PID 268 wrote to memory of 1184 268 setup_install.exe 30 PID 268 wrote to memory of 1184 268 setup_install.exe 30 PID 268 wrote to memory of 1184 268 setup_install.exe 30 PID 268 wrote to memory of 1184 268 setup_install.exe 30 PID 268 wrote to memory of 1184 268 setup_install.exe 30 PID 268 wrote to memory of 1184 268 setup_install.exe 30 PID 268 wrote to memory of 1184 268 setup_install.exe 30 PID 1592 wrote to memory of 1520 1592 cmd.exe 37 PID 1592 wrote to memory of 1520 1592 cmd.exe 37 PID 1592 wrote to memory of 1520 1592 cmd.exe 37 PID 1592 wrote to memory of 1520 1592 cmd.exe 37 PID 1592 wrote to memory of 1520 1592 cmd.exe 37 PID 1592 wrote to memory of 1520 1592 cmd.exe 37 PID 1592 wrote to memory of 1520 1592 cmd.exe 37 PID 268 wrote to memory of 1012 268 setup_install.exe 36 PID 268 wrote to memory of 1012 268 setup_install.exe 36 PID 268 wrote to memory of 1012 268 setup_install.exe 36 PID 268 wrote to memory of 1012 268 setup_install.exe 36 PID 268 wrote to memory of 1012 268 setup_install.exe 36 PID 268 wrote to memory of 1012 268 setup_install.exe 36 PID 268 wrote to memory of 1012 268 setup_install.exe 36 PID 436 wrote to memory of 1660 436 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (16).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (16).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\7zS84416AB4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS84416AB4\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\7zS84416AB4\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1520 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 9846⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:608
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵PID:1184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Loads dropped DLL
PID:744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵PID:1012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:436
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵PID:1244
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Loads dropped DLL
PID:1548
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS84416AB4\arnatic_2.exearnatic_2.exe1⤵
- Executes dropped EXE
PID:1840
-
C:\Users\Admin\AppData\Local\Temp\7zS84416AB4\arnatic_7.exearnatic_7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956
-
C:\Users\Admin\AppData\Local\Temp\7zS84416AB4\arnatic_4.exearnatic_4.exe1⤵
- Executes dropped EXE
PID:1660