Overview

overview

10

Static

static

setup_x86_...0).exe

windows7_x64

setup_x86_...0).exe

windows10_x64

10

setup_x86_...1).exe

windows7_x64

10

setup_x86_...1).exe

windows10_x64

setup_x86_...2).exe

windows7_x64

setup_x86_...2).exe

windows10_x64

10

setup_x86_...3).exe

windows7_x64

setup_x86_...3).exe

windows10_x64

setup_x86_...4).exe

windows7_x64

setup_x86_...4).exe

windows10_x64

10

setup_x86_...5).exe

windows7_x64

setup_x86_...5).exe

windows10_x64

10

setup_x86_...6).exe

windows7_x64

setup_x86_...6).exe

windows10_x64

setup_x86_...7).exe

windows7_x64

setup_x86_...7).exe

windows10_x64

setup_x86_...8).exe

windows7_x64

setup_x86_...8).exe

windows10_x64

10

setup_x86_...9).exe

windows7_x64

10

setup_x86_...9).exe

windows10_x64

10

setup_x86_...2).exe

windows7_x64

setup_x86_...2).exe

windows10_x64

setup_x86_...0).exe

windows7_x64

setup_x86_...0).exe

windows10_x64

setup_x86_...1).exe

windows7_x64

setup_x86_...1).exe

windows10_x64

setup_x86_...2).exe

windows7_x64

setup_x86_...2).exe

windows10_x64

10

setup_x86_...3).exe

windows7_x64

8

setup_x86_...3).exe

windows10_x64

10

setup_x86_...3).exe

windows7_x64

setup_x86_...3).exe

windows10_x64

Resubmissions

11-07-2024 05:43

240711-gej4lstgrf 10

06-09-2021 14:13

210906-rjpvrsedbm 10

08-07-2021 11:08

210708-4gztl3mwl6 10

08-07-2021 08:02

210708-klfb4qeda6 10

07-07-2021 09:39

210707-nem57xyvf2 10

06-07-2021 17:51

210706-7pcrmjy3fa 10

06-07-2021 13:45

210706-eybelwcq86 10

Analysis

  • max time kernel
    132s
  • max time network
    209s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    06-07-2021 13:45

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Remote task has failed: Machine shutdown
Report Analysis Logs

General

  • Target

    setup_x86_x64_install - копия (21).exe

  • Size

    3.2MB

  • MD5

    3ae1c212119919e5fce71247286f8e0e

  • SHA1

    97c1890ab73c539056f95eafede319df774e9d38

  • SHA256

    30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

  • SHA512

    5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

Score
10/10
redlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanupx

Malware Config

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 43 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 10 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2632
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2624
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2536
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2376
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2336
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1824
            • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (21).exe
              "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (21).exe"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:3400
              • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3084
                • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\setup_install.exe
                  "C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\setup_install.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:3984
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c arnatic_1.exe
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3092
                    • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_1.exe
                      arnatic_1.exe
                      5⤵
                      • Executes dropped EXE
                      PID:1676
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_1.exe" & del C:\ProgramData\*.dll & exit
                        6⤵
                          PID:5196
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /im arnatic_1.exe /f
                            7⤵
                            • Kills process with taskkill
                            PID:5492
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /t 6
                            7⤵
                            • Delays execution with timeout.exe
                            PID:2076
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c arnatic_2.exe
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3424
                      • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_2.exe
                        arnatic_2.exe
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        PID:3080
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c arnatic_3.exe
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3720
                      • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_3.exe
                        arnatic_3.exe
                        5⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:3876
                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                          6⤵
                          • Loads dropped DLL
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:956
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c arnatic_4.exe
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3464
                      • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_4.exe
                        arnatic_4.exe
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3364
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          6⤵
                          • Executes dropped EXE
                          PID:1984
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          6⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4740
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c arnatic_5.exe
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3740
                      • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_5.exe
                        arnatic_5.exe
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1708
                        • C:\Users\Admin\AppData\Roaming\4277721.exe
                          "C:\Users\Admin\AppData\Roaming\4277721.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2272
                        • C:\Users\Admin\AppData\Roaming\3667027.exe
                          "C:\Users\Admin\AppData\Roaming\3667027.exe"
                          6⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          PID:4016
                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                            7⤵
                            • Executes dropped EXE
                            PID:4560
                        • C:\Users\Admin\AppData\Roaming\1381492.exe
                          "C:\Users\Admin\AppData\Roaming\1381492.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1364
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c arnatic_7.exe
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3940
                      • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_7.exe
                        arnatic_7.exe
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:2604
                        • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_7.exe
                          C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_7.exe
                          6⤵
                            PID:1004
                          • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_7.exe
                            C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_7.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4024
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c arnatic_6.exe
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3428
                        • C:\Users\Admin\AppData\Local\Temp\7zSC0C0F654\arnatic_6.exe
                          arnatic_6.exe
                          5⤵
                          • Executes dropped EXE
                          PID:1752
                          • C:\Users\Admin\Documents\xNobs79LIKgWV6K8k44RjT25.exe
                            "C:\Users\Admin\Documents\xNobs79LIKgWV6K8k44RjT25.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:3168
                            • C:\Users\Admin\Documents\xNobs79LIKgWV6K8k44RjT25.exe
                              C:\Users\Admin\Documents\xNobs79LIKgWV6K8k44RjT25.exe
                              7⤵
                              • Executes dropped EXE
                              PID:3392
                          • C:\Users\Admin\Documents\_frcSjY7XdxATXYclQtSfeH_.exe
                            "C:\Users\Admin\Documents\_frcSjY7XdxATXYclQtSfeH_.exe"
                            6⤵
                            • Executes dropped EXE
                            • Checks BIOS information in registry
                            • Checks whether UAC is enabled
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            PID:2200
                          • C:\Users\Admin\Documents\Di8DXp2nsrWqCcGWy8cWgqI3.exe
                            "C:\Users\Admin\Documents\Di8DXp2nsrWqCcGWy8cWgqI3.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:2692
                            • C:\Users\Admin\Documents\Di8DXp2nsrWqCcGWy8cWgqI3.exe
                              C:\Users\Admin\Documents\Di8DXp2nsrWqCcGWy8cWgqI3.exe
                              7⤵
                              • Executes dropped EXE
                              PID:5000
                          • C:\Users\Admin\Documents\VWcmRHwolE8FYEDqM2eVY6tB.exe
                            "C:\Users\Admin\Documents\VWcmRHwolE8FYEDqM2eVY6tB.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:216
                          • C:\Users\Admin\Documents\aHgAY_DJRNmDYBVQphatGSp3.exe
                            "C:\Users\Admin\Documents\aHgAY_DJRNmDYBVQphatGSp3.exe"
                            6⤵
                            • Executes dropped EXE
                            • Checks BIOS information in registry
                            • Checks whether UAC is enabled
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            PID:2612
                          • C:\Users\Admin\Documents\Vz9uW_FpAYD3l5BF2TPznsvX.exe
                            "C:\Users\Admin\Documents\Vz9uW_FpAYD3l5BF2TPznsvX.exe"
                            6⤵
                            • Executes dropped EXE
                            • Checks BIOS information in registry
                            • Checks whether UAC is enabled
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            PID:2148
                          • C:\Users\Admin\Documents\_c1X8H04XHLYMQqwWlWyIV3n.exe
                            "C:\Users\Admin\Documents\_c1X8H04XHLYMQqwWlWyIV3n.exe"
                            6⤵
                            • Executes dropped EXE
                            • Checks BIOS information in registry
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4336
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /im _c1X8H04XHLYMQqwWlWyIV3n.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\_c1X8H04XHLYMQqwWlWyIV3n.exe" & del C:\ProgramData\*.dll & exit
                              7⤵
                                PID:5860
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /im _c1X8H04XHLYMQqwWlWyIV3n.exe /f
                                  8⤵
                                  • Kills process with taskkill
                                  PID:6040
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout /t 6
                                  8⤵
                                  • Delays execution with timeout.exe
                                  PID:5380
                            • C:\Users\Admin\Documents\oRweOAKPIWdcLjQG3aCcndHH.exe
                              "C:\Users\Admin\Documents\oRweOAKPIWdcLjQG3aCcndHH.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4312
                              • C:\Users\Admin\Documents\oRweOAKPIWdcLjQG3aCcndHH.exe
                                C:\Users\Admin\Documents\oRweOAKPIWdcLjQG3aCcndHH.exe
                                7⤵
                                • Executes dropped EXE
                                PID:4964
                            • C:\Users\Admin\Documents\P5a5SQ6A8aafwuRaXQEM9NK7.exe
                              "C:\Users\Admin\Documents\P5a5SQ6A8aafwuRaXQEM9NK7.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:4328
                              • C:\Users\Admin\Documents\P5a5SQ6A8aafwuRaXQEM9NK7.exe
                                "C:\Users\Admin\Documents\P5a5SQ6A8aafwuRaXQEM9NK7.exe"
                                7⤵
                                  PID:4512
                              • C:\Users\Admin\Documents\_mKQEAbx7UFMMOq2QrddSlhu.exe
                                "C:\Users\Admin\Documents\_mKQEAbx7UFMMOq2QrddSlhu.exe"
                                6⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:4216
                              • C:\Users\Admin\Documents\UHb5pTYDRkA4HJ18eXKzLLoL.exe
                                "C:\Users\Admin\Documents\UHb5pTYDRkA4HJ18eXKzLLoL.exe"
                                6⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:4224
                              • C:\Users\Admin\Documents\jnKmKmFjp4BeYDmG2JcM9vFe.exe
                                "C:\Users\Admin\Documents\jnKmKmFjp4BeYDmG2JcM9vFe.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:3300
                                • C:\Users\Admin\Documents\jnKmKmFjp4BeYDmG2JcM9vFe.exe
                                  C:\Users\Admin\Documents\jnKmKmFjp4BeYDmG2JcM9vFe.exe
                                  7⤵
                                    PID:1480
                                • C:\Users\Admin\Documents\xhetp7ER04sMArDAbn6cSWnj.exe
                                  "C:\Users\Admin\Documents\xhetp7ER04sMArDAbn6cSWnj.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:2196
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 660
                                    7⤵
                                    • Program crash
                                    PID:660
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 712
                                    7⤵
                                    • Program crash
                                    PID:4668
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 660
                                    7⤵
                                    • Program crash
                                    PID:5320
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 704
                                    7⤵
                                    • Program crash
                                    PID:5444
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 1028
                                    7⤵
                                    • Program crash
                                    PID:5288
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 1084
                                    7⤵
                                    • Program crash
                                    PID:5052
                                • C:\Users\Admin\Documents\FYiSJhl6NXAOEJ4gtC9AEDfT.exe
                                  "C:\Users\Admin\Documents\FYiSJhl6NXAOEJ4gtC9AEDfT.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:3664
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im FYiSJhl6NXAOEJ4gtC9AEDfT.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\FYiSJhl6NXAOEJ4gtC9AEDfT.exe" & del C:\ProgramData\*.dll & exit
                                    7⤵
                                      PID:5144
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im FYiSJhl6NXAOEJ4gtC9AEDfT.exe /f
                                        8⤵
                                        • Kills process with taskkill
                                        PID:5148
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        8⤵
                                        • Delays execution with timeout.exe
                                        PID:5424
                                  • C:\Users\Admin\Documents\PpaecxyS4_wwjVmd6q5M6r5W.exe
                                    "C:\Users\Admin\Documents\PpaecxyS4_wwjVmd6q5M6r5W.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2056
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru
                                      7⤵
                                      • Loads dropped DLL
                                      PID:3100
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ff842214f50,0x7ff842214f60,0x7ff842214f70
                                        8⤵
                                          PID:4012
                                    • C:\Users\Admin\Documents\QRdcbffOIxkeWRqxKevxVgDP.exe
                                      "C:\Users\Admin\Documents\QRdcbffOIxkeWRqxKevxVgDP.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      PID:2960
                                      • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                        "C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:1888
                                        • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                          "C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"
                                          8⤵
                                            PID:5552
                                        • C:\Program Files (x86)\Browzar\Browzar.exe
                                          "C:\Program Files (x86)\Browzar\Browzar.exe"
                                          7⤵
                                            PID:4124
                                        • C:\Users\Admin\Documents\tPuEX4DfoB2pHqnjyYm2mh4Z.exe
                                          "C:\Users\Admin\Documents\tPuEX4DfoB2pHqnjyYm2mh4Z.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          PID:4152
                                          • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                            "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:4268
                                          • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                            "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:4956
                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              8⤵
                                                PID:4716
                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                8⤵
                                                  PID:5776
                                              • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4040
                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                  8⤵
                                                    PID:3904
                                                • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                  "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:4208
                                              • C:\Users\Admin\Documents\ufGV_q06mVhgLS649ug5lQ_x.exe
                                                "C:\Users\Admin\Documents\ufGV_q06mVhgLS649ug5lQ_x.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:4752
                                                • C:\Users\Admin\Documents\ufGV_q06mVhgLS649ug5lQ_x.exe
                                                  "C:\Users\Admin\Documents\ufGV_q06mVhgLS649ug5lQ_x.exe"
                                                  7⤵
                                                    PID:4364
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1240
                                                      8⤵
                                                      • Program crash
                                                      PID:5648
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 680
                                                    7⤵
                                                    • Program crash
                                                    PID:3424
                                      • c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                        1⤵
                                          PID:1368
                                        • c:\windows\system32\svchost.exe
                                          c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                          1⤵
                                            PID:1260
                                          • c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                            1⤵
                                              PID:1236
                                            • \??\c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                              1⤵
                                              • Suspicious use of SetThreadContext
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:1792
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                2⤵
                                                • Drops file in System32 directory
                                                • Checks processor information in registry
                                                • Modifies data under HKEY_USERS
                                                • Modifies registry class
                                                PID:3276
                                            • c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                              1⤵
                                                PID:1064
                                              • c:\windows\system32\svchost.exe
                                                c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                1⤵
                                                  PID:964
                                                • c:\windows\system32\svchost.exe
                                                  c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                  1⤵
                                                    PID:1008
                                                  • C:\Windows\system32\DllHost.exe
                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:1004
                                                  • \??\c:\windows\system32\svchost.exe
                                                    c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                    1⤵
                                                      PID:6124
                                                    • C:\Users\Admin\AppData\Local\Temp\1C3A.exe
                                                      C:\Users\Admin\AppData\Local\Temp\1C3A.exe
                                                      1⤵
                                                        PID:5724
                                                        • C:\Users\Admin\AppData\Local\Temp\1C3A.exe
                                                          C:\Users\Admin\AppData\Local\Temp\1C3A.exe
                                                          2⤵
                                                            PID:5288
                                                            • C:\Windows\SysWOW64\icacls.exe
                                                              icacls "C:\Users\Admin\AppData\Local\324f8d75-1dd0-4f03-ab5d-47f26d73f82f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                              3⤵
                                                              • Modifies file permissions
                                                              PID:5464
                                                            • C:\Users\Admin\AppData\Local\Temp\1C3A.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1C3A.exe" --Admin IsNotAutoStart IsNotTask
                                                              3⤵
                                                                PID:5804
                                                                • C:\Users\Admin\AppData\Local\Temp\1C3A.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\1C3A.exe" --Admin IsNotAutoStart IsNotTask
                                                                  4⤵
                                                                    PID:5832
                                                                    • C:\Users\Admin\AppData\Local\41fce072-cc54-4ea8-8341-a00d4f800fc0\build2.exe
                                                                      "C:\Users\Admin\AppData\Local\41fce072-cc54-4ea8-8341-a00d4f800fc0\build2.exe"
                                                                      5⤵
                                                                        PID:4320
                                                              • C:\Users\Admin\AppData\Local\Temp\2284.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2284.exe
                                                                1⤵
                                                                  PID:3864
                                                                • C:\Users\Admin\AppData\Local\Temp\4186.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\4186.exe
                                                                  1⤵
                                                                    PID:6016
                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                    1⤵
                                                                      PID:6036

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v6

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • memory/956-189-0x00000000047D0000-0x000000000482D000-memory.dmp

                                                                      Filesize

                                                                      372KB

                                                                      Download

                                                                    • memory/956-183-0x0000000004633000-0x0000000004734000-memory.dmp

                                                                      Filesize

                                                                      1.0MB

                                                                      Download

                                                                    • memory/964-231-0x0000028D5D180000-0x0000028D5D1F1000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/1008-199-0x00000133CC560000-0x00000133CC5D1000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/1064-241-0x0000021D7A270000-0x0000021D7A2E1000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/1236-259-0x00000145B3CA0000-0x00000145B3D11000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/1260-275-0x00000261A8860000-0x00000261A88D1000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/1364-281-0x0000000007680000-0x00000000076BF000-memory.dmp

                                                                      Filesize

                                                                      252KB

                                                                      Download

                                                                    • memory/1364-237-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1364-225-0x0000000000780000-0x0000000000781000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1368-243-0x00000235F9560000-0x00000235F95D1000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/1676-291-0x00000000025C0000-0x000000000265D000-memory.dmp

                                                                      Filesize

                                                                      628KB

                                                                      Download

                                                                    • memory/1676-295-0x0000000000400000-0x0000000000949000-memory.dmp

                                                                      Filesize

                                                                      5.3MB

                                                                      Download

                                                                    • memory/1708-170-0x0000000000570000-0x0000000000571000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1708-171-0x0000000000580000-0x000000000059F000-memory.dmp

                                                                      Filesize

                                                                      124KB

                                                                      Download

                                                                    • memory/1708-166-0x0000000000110000-0x0000000000111000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1708-176-0x000000001AF40000-0x000000001AF42000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/1708-172-0x00000000007E0000-0x00000000007E1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1792-209-0x000001B8CDA20000-0x000001B8CDA91000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/1824-250-0x0000018F53040000-0x0000018F530B1000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/2148-326-0x0000000077C00000-0x0000000077D8E000-memory.dmp

                                                                      Filesize

                                                                      1.6MB

                                                                      Download

                                                                    • memory/2148-333-0x0000000005310000-0x0000000005311000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2200-334-0x0000000077C00000-0x0000000077D8E000-memory.dmp

                                                                      Filesize

                                                                      1.6MB

                                                                      Download

                                                                    • memory/2200-358-0x0000000005C10000-0x0000000005C11000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2272-233-0x0000000002900000-0x0000000002901000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2272-273-0x0000000000C40000-0x0000000000C41000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2272-213-0x00000000005A0000-0x00000000005A1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2272-228-0x0000000002890000-0x0000000002891000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2272-265-0x0000000000BD0000-0x0000000000C01000-memory.dmp

                                                                      Filesize

                                                                      196KB

                                                                      Download

                                                                    • memory/2336-214-0x0000023ABF850000-0x0000023ABF8C1000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/2376-204-0x000001565C440000-0x000001565C4B1000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/2536-187-0x0000018121510000-0x000001812155C000-memory.dmp

                                                                      Filesize

                                                                      304KB

                                                                      Download

                                                                    • memory/2536-193-0x0000018121CD0000-0x0000018121D41000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/2604-168-0x0000000000050000-0x0000000000051000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2612-329-0x0000000077C00000-0x0000000077D8E000-memory.dmp

                                                                      Filesize

                                                                      1.6MB

                                                                      Download

                                                                    • memory/2612-348-0x0000000005570000-0x0000000005571000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2624-270-0x0000024DE6610000-0x0000024DE6681000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/2632-277-0x0000022E04A00000-0x0000022E04A71000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/2692-330-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2764-324-0x00000000004F0000-0x0000000000506000-memory.dmp

                                                                      Filesize

                                                                      88KB

                                                                      Download

                                                                    • memory/3080-294-0x00000000001D0000-0x00000000001D9000-memory.dmp

                                                                      Filesize

                                                                      36KB

                                                                      Download

                                                                    • memory/3080-292-0x0000000000400000-0x00000000008F4000-memory.dmp

                                                                      Filesize

                                                                      5.0MB

                                                                      Download

                                                                    • memory/3168-328-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/3276-290-0x0000025AD4D00000-0x0000025AD4E06000-memory.dmp

                                                                      Filesize

                                                                      1.0MB

                                                                      Download

                                                                    • memory/3276-289-0x0000025AD3E00000-0x0000025AD3E1B000-memory.dmp

                                                                      Filesize

                                                                      108KB

                                                                      Download

                                                                    • memory/3276-198-0x0000025AD2500000-0x0000025AD2571000-memory.dmp

                                                                      Filesize

                                                                      452KB

                                                                      Download

                                                                    • memory/3300-345-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/3392-351-0x00000000052F0000-0x00000000058F6000-memory.dmp

                                                                      Filesize

                                                                      6.0MB

                                                                      Download

                                                                    • memory/3984-148-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                      Filesize

                                                                      100KB

                                                                      Download

                                                                    • memory/3984-146-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                      Filesize

                                                                      100KB

                                                                      Download

                                                                    • memory/3984-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                      Filesize

                                                                      572KB

                                                                      Download

                                                                    • memory/3984-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                      Filesize

                                                                      1.5MB

                                                                      Download

                                                                    • memory/3984-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                      Filesize

                                                                      152KB

                                                                      Download

                                                                    • memory/3984-133-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/3984-142-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                      Filesize

                                                                      100KB

                                                                      Download

                                                                    • memory/3984-144-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                      Filesize

                                                                      100KB

                                                                      Download

                                                                    • memory/4016-248-0x000000000A870000-0x000000000A871000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4016-223-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4016-260-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4016-236-0x0000000002670000-0x0000000002671000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4016-254-0x000000000A410000-0x000000000A411000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4016-244-0x0000000002680000-0x000000000268E000-memory.dmp

                                                                      Filesize

                                                                      56KB

                                                                      Download

                                                                    • memory/4024-258-0x00000000055D0000-0x00000000055D1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4024-261-0x0000000005640000-0x0000000005641000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4024-255-0x0000000005C50000-0x0000000005C51000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4024-232-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                      Filesize

                                                                      120KB

                                                                      Download

                                                                    • memory/4024-264-0x0000000005680000-0x0000000005681000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4024-253-0x0000000005630000-0x0000000005631000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4216-335-0x0000000005600000-0x0000000005C06000-memory.dmp

                                                                      Filesize

                                                                      6.0MB

                                                                      Download

                                                                    • memory/4216-331-0x0000000077C00000-0x0000000077D8E000-memory.dmp

                                                                      Filesize

                                                                      1.6MB

                                                                      Download

                                                                    • memory/4224-325-0x0000000077C00000-0x0000000077D8E000-memory.dmp

                                                                      Filesize

                                                                      1.6MB

                                                                      Download

                                                                    • memory/4224-332-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4312-327-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4336-352-0x0000000077C00000-0x0000000077D8E000-memory.dmp

                                                                      Filesize

                                                                      1.6MB

                                                                      Download

                                                                    • memory/4560-284-0x00000000051C0000-0x00000000051C1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4964-349-0x0000000003050000-0x000000000308E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                      Download

                                                                    • memory/5000-350-0x0000000005760000-0x0000000005D66000-memory.dmp

                                                                      Filesize

                                                                      6.0MB

                                                                      Download