Overview
overview
10Static
static
setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows7_x64
10setup_x86_...4).exe
windows10_x64
setup_x86_...5).exe
windows7_x64
setup_x86_...5).exe
windows10_x64
10setup_x86_...6).exe
windows7_x64
setup_x86_...6).exe
windows10_x64
10setup_x86_...7).exe
windows7_x64
10setup_x86_...7).exe
windows10_x64
10setup_x86_...8).exe
windows7_x64
setup_x86_...8).exe
windows10_x64
setup_x86_...9).exe
windows7_x64
setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
10setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
Resubmissions
11-07-2024 05:43
240711-gej4lstgrf 1006-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
12s -
max time network
262s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-07-2021 17:51
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (11).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (12).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (13).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (14).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (15).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (16).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (17).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (18).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (19).exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (2).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия (20).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
setup_x86_x64_install - копия (21).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
setup_x86_x64_install - копия (22).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
setup_x86_x64_install - копия (23).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
setup_x86_x64_install - копия (3).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
setup_x86_x64_install - копия (3).exe
Resource
win10v20210410
Errors
General
-
Target
setup_x86_x64_install - копия (2).exe
-
Size
3.2MB
-
MD5
3ae1c212119919e5fce71247286f8e0e
-
SHA1
97c1890ab73c539056f95eafede319df774e9d38
-
SHA256
30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
-
SHA512
5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558
Malware Config
Extracted
redline
ServAni
87.251.71.195:82
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral21/memory/2256-308-0x0000000000400000-0x0000000000DE1000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
resource yara_rule behavioral21/memory/2336-206-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral21/memory/2336-207-0x0000000000417F26-mapping.dmp family_redline behavioral21/memory/2392-210-0x0000000000500000-0x0000000000538000-memory.dmp family_redline behavioral21/memory/2336-215-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral21/memory/2236-269-0x0000000000417E8E-mapping.dmp family_redline behavioral21/memory/1456-270-0x0000000000418392-mapping.dmp family_redline behavioral21/memory/2956-271-0x0000000000417E96-mapping.dmp family_redline behavioral21/memory/2976-268-0x0000000000417E4A-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 5 IoCs
resource yara_rule behavioral21/memory/1484-214-0x0000000000400000-0x0000000000949000-memory.dmp Vidar behavioral21/memory/1484-211-0x00000000021A0000-0x000000000223D000-memory.dmp Vidar behavioral21/memory/2164-275-0x00000000009C0000-0x00000000009EF000-memory.dmp Vidar behavioral21/memory/2164-276-0x0000000000400000-0x00000000009C0000-memory.dmp Vidar behavioral21/memory/2372-290-0x0000000000400000-0x000000000077A000-memory.dmp Vidar -
resource yara_rule behavioral21/files/0x000300000001317a-69.dat aspack_v212_v242 behavioral21/files/0x000300000001317a-71.dat aspack_v212_v242 behavioral21/files/0x000300000001317a-70.dat aspack_v212_v242 behavioral21/files/0x000300000001317a-73.dat aspack_v212_v242 behavioral21/files/0x0003000000013171-75.dat aspack_v212_v242 behavioral21/files/0x0003000000013171-74.dat aspack_v212_v242 behavioral21/files/0x0003000000013162-76.dat aspack_v212_v242 behavioral21/files/0x0003000000013162-77.dat aspack_v212_v242 behavioral21/files/0x0003000000013174-82.dat aspack_v212_v242 behavioral21/files/0x0003000000013174-83.dat aspack_v212_v242 behavioral21/files/0x000300000001317a-88.dat aspack_v212_v242 behavioral21/files/0x000300000001317a-87.dat aspack_v212_v242 behavioral21/files/0x000300000001317a-86.dat aspack_v212_v242 behavioral21/files/0x000300000001317a-85.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
pid Process 1824 setup_installer.exe 1608 setup_install.exe 1484 arnatic_1.exe 696 arnatic_2.exe 280 arnatic_3.exe 2016 arnatic_4.exe 1364 arnatic_6.exe 1800 arnatic_5.exe 568 arnatic_7.exe 2184 jfiag3g_gg.exe -
resource yara_rule behavioral21/files/0x000300000001317e-171.dat upx behavioral21/files/0x000300000001317e-170.dat upx behavioral21/files/0x000300000001317e-173.dat upx behavioral21/files/0x000300000001317e-175.dat upx -
Loads dropped DLL 39 IoCs
pid Process 1100 setup_x86_x64_install - копия (2).exe 1824 setup_installer.exe 1824 setup_installer.exe 1824 setup_installer.exe 1824 setup_installer.exe 1824 setup_installer.exe 1824 setup_installer.exe 1608 setup_install.exe 1608 setup_install.exe 1608 setup_install.exe 1608 setup_install.exe 1608 setup_install.exe 1608 setup_install.exe 1608 setup_install.exe 1608 setup_install.exe 1468 cmd.exe 1468 cmd.exe 1612 cmd.exe 1612 cmd.exe 632 cmd.exe 1484 arnatic_1.exe 1484 arnatic_1.exe 968 cmd.exe 1668 cmd.exe 1928 cmd.exe 696 Browzar.exe 696 Browzar.exe 280 arnatic_3.exe 280 arnatic_3.exe 1616 cmd.exe 1616 cmd.exe 1364 arnatic_6.exe 1364 arnatic_6.exe 2016 arnatic_4.exe 2016 arnatic_4.exe 568 arnatic_7.exe 568 arnatic_7.exe 2016 arnatic_4.exe 2016 arnatic_4.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3064 icacls.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 34 ipinfo.io 211 checkip.amazonaws.com 266 api.2ip.ua 267 api.2ip.ua 7 ip-api.com 33 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3280 3004 WerFault.exe 98 -
Delays execution with timeout.exe 3 IoCs
pid Process 3196 timeout.exe 2856 timeout.exe 1896 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 2588 taskkill.exe 3068 taskkill.exe 3040 taskkill.exe 3760 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3764 PING.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 142 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1800 arnatic_5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1824 1100 setup_x86_x64_install - копия (2).exe 29 PID 1100 wrote to memory of 1824 1100 setup_x86_x64_install - копия (2).exe 29 PID 1100 wrote to memory of 1824 1100 setup_x86_x64_install - копия (2).exe 29 PID 1100 wrote to memory of 1824 1100 setup_x86_x64_install - копия (2).exe 29 PID 1100 wrote to memory of 1824 1100 setup_x86_x64_install - копия (2).exe 29 PID 1100 wrote to memory of 1824 1100 setup_x86_x64_install - копия (2).exe 29 PID 1100 wrote to memory of 1824 1100 setup_x86_x64_install - копия (2).exe 29 PID 1824 wrote to memory of 1608 1824 setup_installer.exe 30 PID 1824 wrote to memory of 1608 1824 setup_installer.exe 30 PID 1824 wrote to memory of 1608 1824 setup_installer.exe 30 PID 1824 wrote to memory of 1608 1824 setup_installer.exe 30 PID 1824 wrote to memory of 1608 1824 setup_installer.exe 30 PID 1824 wrote to memory of 1608 1824 setup_installer.exe 30 PID 1824 wrote to memory of 1608 1824 setup_installer.exe 30 PID 1608 wrote to memory of 1468 1608 setup_install.exe 32 PID 1608 wrote to memory of 1468 1608 setup_install.exe 32 PID 1608 wrote to memory of 1468 1608 setup_install.exe 32 PID 1608 wrote to memory of 1468 1608 setup_install.exe 32 PID 1608 wrote to memory of 1468 1608 setup_install.exe 32 PID 1608 wrote to memory of 1468 1608 setup_install.exe 32 PID 1608 wrote to memory of 1468 1608 setup_install.exe 32 PID 1608 wrote to memory of 1612 1608 setup_install.exe 33 PID 1608 wrote to memory of 1612 1608 setup_install.exe 33 PID 1608 wrote to memory of 1612 1608 setup_install.exe 33 PID 1608 wrote to memory of 1612 1608 setup_install.exe 33 PID 1608 wrote to memory of 1612 1608 setup_install.exe 33 PID 1608 wrote to memory of 1612 1608 setup_install.exe 33 PID 1608 wrote to memory of 1612 1608 setup_install.exe 33 PID 1608 wrote to memory of 632 1608 setup_install.exe 34 PID 1608 wrote to memory of 632 1608 setup_install.exe 34 PID 1608 wrote to memory of 632 1608 setup_install.exe 34 PID 1608 wrote to memory of 632 1608 setup_install.exe 34 PID 1608 wrote to memory of 632 1608 setup_install.exe 34 PID 1608 wrote to memory of 632 1608 setup_install.exe 34 PID 1608 wrote to memory of 632 1608 setup_install.exe 34 PID 1608 wrote to memory of 968 1608 setup_install.exe 35 PID 1608 wrote to memory of 968 1608 setup_install.exe 35 PID 1608 wrote to memory of 968 1608 setup_install.exe 35 PID 1608 wrote to memory of 968 1608 setup_install.exe 35 PID 1608 wrote to memory of 968 1608 setup_install.exe 35 PID 1608 wrote to memory of 968 1608 setup_install.exe 35 PID 1608 wrote to memory of 968 1608 setup_install.exe 35 PID 1608 wrote to memory of 1668 1608 setup_install.exe 45 PID 1608 wrote to memory of 1668 1608 setup_install.exe 45 PID 1608 wrote to memory of 1668 1608 setup_install.exe 45 PID 1608 wrote to memory of 1668 1608 setup_install.exe 45 PID 1608 wrote to memory of 1668 1608 setup_install.exe 45 PID 1608 wrote to memory of 1668 1608 setup_install.exe 45 PID 1608 wrote to memory of 1668 1608 setup_install.exe 45 PID 1468 wrote to memory of 1484 1468 cmd.exe 44 PID 1468 wrote to memory of 1484 1468 cmd.exe 44 PID 1468 wrote to memory of 1484 1468 cmd.exe 44 PID 1468 wrote to memory of 1484 1468 cmd.exe 44 PID 1468 wrote to memory of 1484 1468 cmd.exe 44 PID 1468 wrote to memory of 1484 1468 cmd.exe 44 PID 1468 wrote to memory of 1484 1468 cmd.exe 44 PID 1612 wrote to memory of 696 1612 cmd.exe 43 PID 1612 wrote to memory of 696 1612 cmd.exe 43 PID 1612 wrote to memory of 696 1612 cmd.exe 43 PID 1612 wrote to memory of 696 1612 cmd.exe 43 PID 1612 wrote to memory of 696 1612 cmd.exe 43 PID 1612 wrote to memory of 696 1612 cmd.exe 43 PID 1612 wrote to memory of 696 1612 cmd.exe 43 PID 1608 wrote to memory of 1928 1608 setup_install.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (2).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (2).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\7zS0276B524\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0276B524\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_1.exe" & del C:\ProgramData\*.dll & exit6⤵PID:2916
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im arnatic_1.exe /f7⤵
- Kills process with taskkill
PID:3040
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
PID:3196
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
PID:696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_3.exearnatic_3.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub6⤵PID:2212
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_4.exearnatic_4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:3004
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Loads dropped DLL
PID:1616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Loads dropped DLL
PID:1928
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Loads dropped DLL
PID:1668
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_7.exearnatic_7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_7.exe2⤵PID:2336
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_6.exearnatic_6.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\Documents\DG7Q91vmnFIrn2jTekST8wcm.exe"C:\Users\Admin\Documents\DG7Q91vmnFIrn2jTekST8wcm.exe"2⤵PID:2240
-
C:\Users\Admin\Documents\DG7Q91vmnFIrn2jTekST8wcm.exeC:\Users\Admin\Documents\DG7Q91vmnFIrn2jTekST8wcm.exe3⤵PID:3560
-
-
C:\Users\Admin\Documents\DG7Q91vmnFIrn2jTekST8wcm.exeC:\Users\Admin\Documents\DG7Q91vmnFIrn2jTekST8wcm.exe3⤵PID:3548
-
-
-
C:\Users\Admin\Documents\Y8JGdvHKpbHGhBXMghXn3wVD.exe"C:\Users\Admin\Documents\Y8JGdvHKpbHGhBXMghXn3wVD.exe"2⤵PID:1952
-
-
C:\Users\Admin\Documents\kXT7SPey713aoTkhzHCsYn6m.exe"C:\Users\Admin\Documents\kXT7SPey713aoTkhzHCsYn6m.exe"2⤵PID:2224
-
C:\Users\Admin\Documents\kXT7SPey713aoTkhzHCsYn6m.exeC:\Users\Admin\Documents\kXT7SPey713aoTkhzHCsYn6m.exe3⤵PID:2956
-
-
-
C:\Users\Admin\Documents\mOrCfaiMHLgCENW8CKDxK1e_.exe"C:\Users\Admin\Documents\mOrCfaiMHLgCENW8CKDxK1e_.exe"2⤵PID:2060
-
C:\Users\Admin\Documents\mOrCfaiMHLgCENW8CKDxK1e_.exeC:\Users\Admin\Documents\mOrCfaiMHLgCENW8CKDxK1e_.exe3⤵PID:2976
-
-
-
C:\Users\Admin\Documents\qIO25WZmLaw_CFkD1TQGtkji.exe"C:\Users\Admin\Documents\qIO25WZmLaw_CFkD1TQGtkji.exe"2⤵PID:320
-
-
C:\Users\Admin\Documents\kyhefxYDIRttngSaBA449Ng_.exe"C:\Users\Admin\Documents\kyhefxYDIRttngSaBA449Ng_.exe"2⤵PID:1540
-
C:\Users\Admin\Documents\kyhefxYDIRttngSaBA449Ng_.exeC:\Users\Admin\Documents\kyhefxYDIRttngSaBA449Ng_.exe3⤵PID:2236
-
-
-
C:\Users\Admin\Documents\RrJS6azyjh9slcouIXyqwQ7S.exe"C:\Users\Admin\Documents\RrJS6azyjh9slcouIXyqwQ7S.exe"2⤵PID:1992
-
C:\Users\Admin\Documents\RrJS6azyjh9slcouIXyqwQ7S.exeC:\Users\Admin\Documents\RrJS6azyjh9slcouIXyqwQ7S.exe3⤵PID:1456
-
-
-
C:\Users\Admin\Documents\6BynxhUdmv9c2MfSBmkAwQwc.exe"C:\Users\Admin\Documents\6BynxhUdmv9c2MfSBmkAwQwc.exe"2⤵PID:1720
-
-
C:\Users\Admin\Documents\Wc5N_n0sPwRhHlaxB6D50vyk.exe"C:\Users\Admin\Documents\Wc5N_n0sPwRhHlaxB6D50vyk.exe"2⤵PID:2372
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Wc5N_n0sPwRhHlaxB6D50vyk.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Wc5N_n0sPwRhHlaxB6D50vyk.exe" & del C:\ProgramData\*.dll & exit3⤵PID:3296
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Wc5N_n0sPwRhHlaxB6D50vyk.exe /f4⤵
- Kills process with taskkill
PID:2588
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:2856
-
-
-
-
C:\Users\Admin\Documents\zzW7na0pETPQ1GAkRpCUcsni.exe"C:\Users\Admin\Documents\zzW7na0pETPQ1GAkRpCUcsni.exe"2⤵PID:2364
-
-
C:\Users\Admin\Documents\zKNYNbvOc5FTFkvGtH8Sfptz.exe"C:\Users\Admin\Documents\zKNYNbvOc5FTFkvGtH8Sfptz.exe"2⤵PID:2768
-
-
C:\Users\Admin\Documents\eftdHFKQ2xa9I6IXFV74ebdu.exe"C:\Users\Admin\Documents\eftdHFKQ2xa9I6IXFV74ebdu.exe"2⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\is-J3HAJ.tmp\eftdHFKQ2xa9I6IXFV74ebdu.tmp"C:\Users\Admin\AppData\Local\Temp\is-J3HAJ.tmp\eftdHFKQ2xa9I6IXFV74ebdu.tmp" /SL5="$1017E,1158062,843264,C:\Users\Admin\Documents\eftdHFKQ2xa9I6IXFV74ebdu.exe"3⤵PID:2324
-
-
-
C:\Users\Admin\Documents\_VPVMeBp9ODmAk4K1n3b_wN6.exe"C:\Users\Admin\Documents\_VPVMeBp9ODmAk4K1n3b_wN6.exe"2⤵PID:2772
-
-
C:\Users\Admin\Documents\hmQ19sfKaqvTfQhsyd4DjRQl.exe"C:\Users\Admin\Documents\hmQ19sfKaqvTfQhsyd4DjRQl.exe"2⤵PID:1164
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:3212
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:3104
-
-
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"3⤵PID:2820
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl4⤵PID:3296
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵PID:3004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 2924⤵
- Program crash
PID:3280
-
-
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"3⤵PID:1992
-
-
-
C:\Users\Admin\Documents\IMtg9xZ5YDvRUwI7a3na9fsN.exe"C:\Users\Admin\Documents\IMtg9xZ5YDvRUwI7a3na9fsN.exe"2⤵PID:2164
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{nCtZ-0girL-lN3z-l9uQO}\66913227798.exe"3⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\{nCtZ-0girL-lN3z-l9uQO}\66913227798.exe"C:\Users\Admin\AppData\Local\Temp\{nCtZ-0girL-lN3z-l9uQO}\66913227798.exe"4⤵PID:3848
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Via.pst5⤵PID:2820
-
C:\Windows\SysWOW64\cmd.execmd6⤵PID:2416
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^tlSemPfKKHtYeILMlybXZRBSYbGlJvqJVEjBXzlIAbUyXeesdcOhdyxhJqrwptqgHxrnclOQUPvBXvUWcfUgHMzPlZSXdomcbFbDZDVyGX$" Uso.pst7⤵PID:3732
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 307⤵
- Runs ping.exe
PID:3764
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.comTuoi.exe.com T7⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.com T8⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.com T9⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.com T10⤵PID:1552
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{nCtZ-0girL-lN3z-l9uQO}\79997131830.exe" /mix3⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\{nCtZ-0girL-lN3z-l9uQO}\79997131830.exe"C:\Users\Admin\AppData\Local\Temp\{nCtZ-0girL-lN3z-l9uQO}\79997131830.exe" /mix4⤵PID:2400
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{nCtZ-0girL-lN3z-l9uQO}\24121259819.exe" /mix3⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\{nCtZ-0girL-lN3z-l9uQO}\24121259819.exe"C:\Users\Admin\AppData\Local\Temp\{nCtZ-0girL-lN3z-l9uQO}\24121259819.exe" /mix4⤵PID:3424
-
C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exeedspolishpp.exe5⤵PID:2356
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "IMtg9xZ5YDvRUwI7a3na9fsN.exe" /f & erase "C:\Users\Admin\Documents\IMtg9xZ5YDvRUwI7a3na9fsN.exe" & exit3⤵PID:2952
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "IMtg9xZ5YDvRUwI7a3na9fsN.exe" /f4⤵
- Kills process with taskkill
PID:3760
-
-
-
-
C:\Users\Admin\Documents\1fWvwkFeyNdD_KDXljDJG6Xu.exe"C:\Users\Admin\Documents\1fWvwkFeyNdD_KDXljDJG6Xu.exe"2⤵PID:2156
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 1fWvwkFeyNdD_KDXljDJG6Xu.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\1fWvwkFeyNdD_KDXljDJG6Xu.exe" & del C:\ProgramData\*.dll & exit3⤵PID:2916
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 1fWvwkFeyNdD_KDXljDJG6Xu.exe /f4⤵
- Kills process with taskkill
PID:3068
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:1896
-
-
-
-
C:\Users\Admin\Documents\sQRFUUEy_f7Z3VuSc4rYh9t6.exe"C:\Users\Admin\Documents\sQRFUUEy_f7Z3VuSc4rYh9t6.exe"2⤵PID:2876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru3⤵PID:2984
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66b4f50,0x7fef66b4f60,0x7fef66b4f704⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,2042558218971781675,4563431184837216472,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:24⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1108,2042558218971781675,4563431184837216472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1800 /prefetch:84⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1108,2042558218971781675,4563431184837216472,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1756 /prefetch:84⤵PID:3600
-
-
-
-
C:\Users\Admin\Documents\rDviui7Ubi5HvBZsa1dhPmif.exe"C:\Users\Admin\Documents\rDviui7Ubi5HvBZsa1dhPmif.exe"2⤵PID:2256
-
C:\Users\Admin\Documents\rDviui7Ubi5HvBZsa1dhPmif.exe"C:\Users\Admin\Documents\rDviui7Ubi5HvBZsa1dhPmif.exe"3⤵PID:3320
-
-
-
C:\Users\Admin\Documents\2gJGKFTRnYuJJV5WWnGXcytS.exe"C:\Users\Admin\Documents\2gJGKFTRnYuJJV5WWnGXcytS.exe"2⤵PID:928
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"3⤵PID:2260
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"4⤵PID:2872
-
-
-
C:\Program Files (x86)\Browzar\Browzar.exe"C:\Program Files (x86)\Browzar\Browzar.exe"3⤵
- Loads dropped DLL
PID:696
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0276B524\arnatic_5.exearnatic_5.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800 -
C:\Users\Admin\AppData\Roaming\2345981.exe"C:\Users\Admin\AppData\Roaming\2345981.exe"2⤵PID:2348
-
-
C:\Users\Admin\AppData\Roaming\5163590.exe"C:\Users\Admin\AppData\Roaming\5163590.exe"2⤵PID:2360
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵PID:2672
-
-
-
C:\Users\Admin\AppData\Roaming\5834815.exe"C:\Users\Admin\AppData\Roaming\5834815.exe"2⤵PID:2392
-
-
C:\Users\Admin\AppData\Roaming\1123966.exe"C:\Users\Admin\AppData\Roaming\1123966.exe"2⤵PID:2424
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\5032.exeC:\Users\Admin\AppData\Local\Temp\5032.exe1⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\5032.exeC:\Users\Admin\AppData\Local\Temp\5032.exe2⤵PID:3888
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\f7888f89-5e46-4ed4-a812-61b830c06914" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:3064
-
-
-
C:\Users\Admin\AppData\Local\Temp\7560.exeC:\Users\Admin\AppData\Local\Temp\7560.exe1⤵PID:4068