raccoon | 64dc2b5958fe37dd9733928c156e0c75ab544e2e0169f9f796c3f3db809bcbe5

Target

toolspab2 (15).exe
Size

315KB
MD5

1d20e1f65938e837ef1b88f10f1bd6c3
SHA1

703d7098dbfc476d2181b7fc041cc23e49c368f1
SHA256

05cd7440851f13dd8f489bb3c06eba385d85d7d9a77a612049c04c541a88593d
SHA512

f9d333abe1f721b8d45d7bc6b5f286af09a8d233bd1d41f0ad891840cf742364aeca2cb6ccd6543f56a8eaf32804f82f72f961d16d5ba663ad706d164915a196

Score

10^/10

raccoon redline smokeloader backdoor discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral14/files/0x000200000001ab61-137.dat	family_redline
behavioral14/files/0x000200000001ab61-136.dat	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
4040	DD46.exe
3424	DF5A.exe
4200	E372.exe
4160	E807.exe
4236	ED48.exe
1036	jNNve5NIKb.exe
1204	jNNve5NIKb.exe
3520	sqlcmd.exe
1148	sqlcmd.exe
4344	biguvwh
4872	biguvwh
3980	sqlcmd.exe
4836	sqlcmd.exe
5092	sqlcmd.exe
4436	sqlcmd.exe
4016	sqlcmd.exe
4988	sqlcmd.exe
4632	sqlcmd.exe
3640	sqlcmd.exe
2256	sqlcmd.exe
2136	sqlcmd.exe
4700	sqlcmd.exe
2152	sqlcmd.exe
1476	sqlcmd.exe
3976	sqlcmd.exe
3424	sqlcmd.exe
1720	sqlcmd.exe
4204	sqlcmd.exe
1456	sqlcmd.exe
2028	sqlcmd.exe
2892	sqlcmd.exe
4152	biguvwh
4404	biguvwh
592	sqlcmd.exe
516	sqlcmd.exe
2668	sqlcmd.exe
652	sqlcmd.exe
4728	sqlcmd.exe
864	sqlcmd.exe
692	sqlcmd.exe
1008	sqlcmd.exe
2828	sqlcmd.exe
2856	sqlcmd.exe
212	sqlcmd.exe
4128	sqlcmd.exe
1224	sqlcmd.exe
1852	sqlcmd.exe
1868	sqlcmd.exe
1232	sqlcmd.exe
2120	sqlcmd.exe
2272	sqlcmd.exe
2636	sqlcmd.exe
2732	sqlcmd.exe
1836	biguvwh
1160	biguvwh
4380	sqlcmd.exe
2696	sqlcmd.exe
2704	sqlcmd.exe
4236	sqlcmd.exe
1348	sqlcmd.exe
2100	sqlcmd.exe
4324	sqlcmd.exe
2500	sqlcmd.exe
3984	sqlcmd.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ED48.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ED48.exe

Deletes itself 1 IoCs

pid	Process
2416	Process not Found

Loads dropped DLL 8 IoCs

pid	Process
1832	toolspab2 (15).exe
4040	DD46.exe
4040	DD46.exe
4040	DD46.exe
4040	DD46.exe
4040	DD46.exe
4404	biguvwh
1160	biguvwh

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral14/files/0x000200000001ab61-137.dat	themida
behavioral14/files/0x000200000001ab61-136.dat	themida
behavioral14/memory/4236-142-0x0000000000CC0000-0x0000000000CC1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ED48.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4236	ED48.exe

Suspicious use of SetThreadContext 34 IoCs

description	pid	Process	procid_target
PID 4432 set thread context of 1832	4432	toolspab2 (15).exe	78
PID 1036 set thread context of 1204	1036	jNNve5NIKb.exe	90
PID 3520 set thread context of 1148	3520	sqlcmd.exe	103
PID 4344 set thread context of 4872	4344	biguvwh	107
PID 3980 set thread context of 4836	3980	sqlcmd.exe	109
PID 5092 set thread context of 4436	5092	sqlcmd.exe	111
PID 4016 set thread context of 4988	4016	sqlcmd.exe	113
PID 4632 set thread context of 3640	4632	sqlcmd.exe	115
PID 2256 set thread context of 2136	2256	sqlcmd.exe	117
PID 4700 set thread context of 2152	4700	sqlcmd.exe	119
PID 1476 set thread context of 3976	1476	sqlcmd.exe	121
PID 3424 set thread context of 1720	3424	sqlcmd.exe	123
PID 4204 set thread context of 1456	4204	sqlcmd.exe	125
PID 2028 set thread context of 2892	2028	sqlcmd.exe	127
PID 4152 set thread context of 4404	4152	biguvwh	129
PID 592 set thread context of 516	592	sqlcmd.exe	131
PID 2668 set thread context of 652	2668	sqlcmd.exe	133
PID 4728 set thread context of 864	4728	sqlcmd.exe	135
PID 692 set thread context of 1008	692	sqlcmd.exe	137
PID 2828 set thread context of 2856	2828	sqlcmd.exe	139
PID 212 set thread context of 4128	212	sqlcmd.exe	141
PID 1224 set thread context of 1852	1224	sqlcmd.exe	143
PID 1868 set thread context of 1232	1868	sqlcmd.exe	145
PID 2120 set thread context of 2272	2120	sqlcmd.exe	147
PID 2636 set thread context of 2732	2636	sqlcmd.exe	149
PID 1836 set thread context of 1160	1836	biguvwh	151
PID 4380 set thread context of 2696	4380	sqlcmd.exe	153
PID 2704 set thread context of 4236	2704	sqlcmd.exe	155
PID 1348 set thread context of 2100	1348	sqlcmd.exe	157
PID 4324 set thread context of 2500	4324	sqlcmd.exe	159
PID 3984 set thread context of 624	3984	sqlcmd.exe	161
PID 2676 set thread context of 2204	2676	sqlcmd.exe	163
PID 2880 set thread context of 3556	2880	sqlcmd.exe	165
PID 3480 set thread context of 3688	3480	sqlcmd.exe	167

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (15).exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (15).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	biguvwh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	biguvwh
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	biguvwh
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	biguvwh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (15).exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	biguvwh
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	biguvwh

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1540	schtasks.exe
4324	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1700	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1832	toolspab2 (15).exe
1832	toolspab2 (15).exe
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	Process not Found

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
1832	toolspab2 (15).exe
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
4404	biguvwh
1160	biguvwh

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeDebugPrivilege	4236	ED48.exe
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	Process not Found

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 1832	4432	toolspab2 (15).exe	78
PID 4432 wrote to memory of 1832	4432	toolspab2 (15).exe	78
PID 4432 wrote to memory of 1832	4432	toolspab2 (15).exe	78
PID 4432 wrote to memory of 1832	4432	toolspab2 (15).exe	78
PID 4432 wrote to memory of 1832	4432	toolspab2 (15).exe	78
PID 4432 wrote to memory of 1832	4432	toolspab2 (15).exe	78
PID 2416 wrote to memory of 4040	2416	Process not Found	80
PID 2416 wrote to memory of 4040	2416	Process not Found	80
PID 2416 wrote to memory of 4040	2416	Process not Found	80
PID 2416 wrote to memory of 3424	2416	Process not Found	81
PID 2416 wrote to memory of 3424	2416	Process not Found	81
PID 2416 wrote to memory of 3424	2416	Process not Found	81
PID 2416 wrote to memory of 4200	2416	Process not Found	82
PID 2416 wrote to memory of 4200	2416	Process not Found	82
PID 2416 wrote to memory of 4200	2416	Process not Found	82
PID 2416 wrote to memory of 4160	2416	Process not Found	83
PID 2416 wrote to memory of 4160	2416	Process not Found	83
PID 2416 wrote to memory of 4160	2416	Process not Found	83
PID 2416 wrote to memory of 4236	2416	Process not Found	84
PID 2416 wrote to memory of 4236	2416	Process not Found	84
PID 2416 wrote to memory of 4236	2416	Process not Found	84
PID 2416 wrote to memory of 4280	2416	Process not Found	85
PID 2416 wrote to memory of 4280	2416	Process not Found	85
PID 2416 wrote to memory of 4280	2416	Process not Found	85
PID 2416 wrote to memory of 4280	2416	Process not Found	85
PID 2416 wrote to memory of 596	2416	Process not Found	86
PID 2416 wrote to memory of 596	2416	Process not Found	86
PID 2416 wrote to memory of 596	2416	Process not Found	86
PID 2416 wrote to memory of 4304	2416	Process not Found	87
PID 2416 wrote to memory of 4304	2416	Process not Found	87
PID 2416 wrote to memory of 4304	2416	Process not Found	87
PID 2416 wrote to memory of 4304	2416	Process not Found	87
PID 2416 wrote to memory of 904	2416	Process not Found	88
PID 2416 wrote to memory of 904	2416	Process not Found	88
PID 2416 wrote to memory of 904	2416	Process not Found	88
PID 4040 wrote to memory of 1036	4040	DD46.exe	89
PID 4040 wrote to memory of 1036	4040	DD46.exe	89
PID 4040 wrote to memory of 1036	4040	DD46.exe	89
PID 4040 wrote to memory of 1136	4040	DD46.exe	91
PID 4040 wrote to memory of 1136	4040	DD46.exe	91
PID 4040 wrote to memory of 1136	4040	DD46.exe	91
PID 1036 wrote to memory of 1204	1036	jNNve5NIKb.exe	90
PID 1036 wrote to memory of 1204	1036	jNNve5NIKb.exe	90
PID 1036 wrote to memory of 1204	1036	jNNve5NIKb.exe	90
PID 1036 wrote to memory of 1204	1036	jNNve5NIKb.exe	90
PID 1036 wrote to memory of 1204	1036	jNNve5NIKb.exe	90
PID 1204 wrote to memory of 1540	1204	jNNve5NIKb.exe	93
PID 1204 wrote to memory of 1540	1204	jNNve5NIKb.exe	93
PID 1204 wrote to memory of 1540	1204	jNNve5NIKb.exe	93
PID 1136 wrote to memory of 1700	1136	cmd.exe	94
PID 1136 wrote to memory of 1700	1136	cmd.exe	94
PID 1136 wrote to memory of 1700	1136	cmd.exe	94
PID 2416 wrote to memory of 1976	2416	Process not Found	96
PID 2416 wrote to memory of 1976	2416	Process not Found	96
PID 2416 wrote to memory of 1976	2416	Process not Found	96
PID 2416 wrote to memory of 1976	2416	Process not Found	96
PID 2416 wrote to memory of 2128	2416	Process not Found	97
PID 2416 wrote to memory of 2128	2416	Process not Found	97
PID 2416 wrote to memory of 2128	2416	Process not Found	97
PID 2416 wrote to memory of 2432	2416	Process not Found	98
PID 2416 wrote to memory of 2432	2416	Process not Found	98
PID 2416 wrote to memory of 2432	2416	Process not Found	98
PID 2416 wrote to memory of 2432	2416	Process not Found	98
PID 2416 wrote to memory of 2656	2416	Process not Found	99

C:\Users\Admin\AppData\Local\Temp\toolspab2 (15).exe
"C:\Users\Admin\AppData\Local\Temp\toolspab2 (15).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\toolspab2 (15).exe
  "C:\Users\Admin\AppData\Local\Temp\toolspab2 (15).exe"
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1832

C:\Users\Admin\AppData\Local\Temp\DD46.exe
C:\Users\Admin\AppData\Local\Temp\DD46.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Local\Temp\jNNve5NIKb.exe
  "C:\Users\Admin\AppData\Local\Temp\jNNve5NIKb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\jNNve5NIKb.exe
    "C:\Users\Admin\AppData\Local\Temp\jNNve5NIKb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
      4⤵
      Creates scheduled task(s)
      PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\DD46.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1700

C:\Users\Admin\AppData\Local\Temp\DF5A.exe
C:\Users\Admin\AppData\Local\Temp\DF5A.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Users\Admin\AppData\Local\Temp\E372.exe
C:\Users\Admin\AppData\Local\Temp\E372.exe
1⤵
- Executes dropped EXE
PID:4200

C:\Users\Admin\AppData\Local\Temp\E807.exe
C:\Users\Admin\AppData\Local\Temp\E807.exe
1⤵
- Executes dropped EXE
PID:4160

C:\Users\Admin\AppData\Local\Temp\ED48.exe
C:\Users\Admin\AppData\Local\Temp\ED48.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4280

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:596

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4304

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:904

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1976

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2128

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2432

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2656

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3676

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3520
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4324

C:\Users\Admin\AppData\Roaming\biguvwh
C:\Users\Admin\AppData\Roaming\biguvwh
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4344
- C:\Users\Admin\AppData\Roaming\biguvwh
  C:\Users\Admin\AppData\Roaming\biguvwh
  2⤵
  - Executes dropped EXE
  PID:4872

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3980
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:4836

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5092
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:4436

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4016
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:4988

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4632
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3640

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2256
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2136

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4700
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2152

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1476
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3976

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3424
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1720

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4204
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1456

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2028
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2892

C:\Users\Admin\AppData\Roaming\biguvwh
C:\Users\Admin\AppData\Roaming\biguvwh
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4152
- C:\Users\Admin\AppData\Roaming\biguvwh
  C:\Users\Admin\AppData\Roaming\biguvwh
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:4404

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:592
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:516

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2668
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:652

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4728
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:864

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:692
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1008

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2828
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2856

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:212
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:4128

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1224
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1852

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1868
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1232

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2120
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2272

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2636
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2732

C:\Users\Admin\AppData\Roaming\biguvwh
C:\Users\Admin\AppData\Roaming\biguvwh
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1836
- C:\Users\Admin\AppData\Roaming\biguvwh
  C:\Users\Admin\AppData\Roaming\biguvwh
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1160

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4380
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2696

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2704
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:4236

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1348
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2100

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4324
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2500

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3984
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:624

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:2676
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:2204

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:2880
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3556

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:3480
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/596-153-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/596-152-0x0000000000510000-0x0000000000517000-memory.dmp

Filesize
28KB

Download
memory/904-164-0x0000000000B50000-0x0000000000B59000-memory.dmp

Filesize
36KB

Download
memory/904-165-0x0000000000B40000-0x0000000000B4F000-memory.dmp

Filesize
60KB

Download
memory/1204-176-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1204-170-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1832-114-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1836-289-0x0000000000460000-0x00000000005AA000-memory.dmp

Filesize
1.3MB

Download
memory/1976-178-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/1976-177-0x0000000000600000-0x0000000000605000-memory.dmp

Filesize
20KB

Download
memory/2128-181-0x0000000000B00000-0x0000000000B0C000-memory.dmp

Filesize
48KB

Download
memory/2128-180-0x0000000000B10000-0x0000000000B16000-memory.dmp

Filesize
24KB

Download
memory/2416-118-0x0000000000FA0000-0x0000000000FB7000-memory.dmp

Filesize
92KB

Download
memory/2416-251-0x0000000001470000-0x0000000001487000-memory.dmp

Filesize
92KB

Download
memory/2416-290-0x0000000001490000-0x00000000014A7000-memory.dmp

Filesize
92KB

Download
memory/2432-183-0x00000000030B0000-0x00000000030B4000-memory.dmp

Filesize
16KB

Download
memory/2432-184-0x00000000030A0000-0x00000000030A9000-memory.dmp

Filesize
36KB

Download
memory/2656-186-0x0000000000890000-0x0000000000895000-memory.dmp

Filesize
20KB

Download
memory/2656-187-0x0000000000880000-0x0000000000889000-memory.dmp

Filesize
36KB

Download
memory/3424-130-0x0000000002120000-0x00000000021B1000-memory.dmp

Filesize
580KB

Download
memory/3424-132-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/3676-193-0x0000000000710000-0x0000000000719000-memory.dmp

Filesize
36KB

Download
memory/3676-192-0x0000000000720000-0x0000000000725000-memory.dmp

Filesize
20KB

Download
memory/4040-129-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4040-128-0x0000000002100000-0x0000000002191000-memory.dmp

Filesize
580KB

Download
memory/4236-151-0x0000000006380000-0x0000000006381000-memory.dmp

Filesize
4KB

Download
memory/4236-154-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/4236-150-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/4236-142-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/4236-141-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/4236-149-0x0000000006020000-0x0000000006021000-memory.dmp

Filesize
4KB

Download
memory/4236-146-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/4236-147-0x0000000006630000-0x0000000006631000-memory.dmp

Filesize
4KB

Download
memory/4236-155-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/4236-188-0x00000000084A0000-0x00000000084A1000-memory.dmp

Filesize
4KB

Download
memory/4236-189-0x0000000008BA0000-0x0000000008BA1000-memory.dmp

Filesize
4KB

Download
memory/4236-190-0x0000000008670000-0x0000000008671000-memory.dmp

Filesize
4KB

Download
memory/4236-145-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/4280-139-0x00000000030B0000-0x0000000003124000-memory.dmp

Filesize
464KB

Download
memory/4280-140-0x0000000003040000-0x00000000030AB000-memory.dmp

Filesize
428KB

Download
memory/4304-162-0x0000000002CF0000-0x0000000002CFB000-memory.dmp

Filesize
44KB

Download
memory/4304-161-0x0000000002D00000-0x0000000002D07000-memory.dmp

Filesize
28KB

Download
memory/4432-117-0x00000000006D0000-0x00000000006DC000-memory.dmp

Filesize
48KB

Download