raccoon | 64dc2b5958fe37dd9733928c156e0c75ab544e2e0169f9f796c3f3db809bcbe5

Target

toolspab2 (21).exe
Size

315KB
MD5

585c257e0b345b762e7cdc407d8f9da2
SHA1

ffee403d97b76c3460fc166b9d5ce1205cd216a5
SHA256

4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6
SHA512

14d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8

Score

10^/10

raccoon redline smokeloader backdoor discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral28/files/0x000200000001ab99-138.dat	family_redline
behavioral28/files/0x000200000001ab99-137.dat	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
2000	931E.exe
1524	9522.exe
3560	9AE0.exe
3140	A021.exe
1156	A562.exe
1920	NMN52vAqtg.exe
3956	NMN52vAqtg.exe
772	cutgdrc
196	sqlcmd.exe
3348	sqlcmd.exe
4040	cutgdrc
2388	sqlcmd.exe
3396	sqlcmd.exe
2264	sqlcmd.exe
1072	sqlcmd.exe
2220	sqlcmd.exe
3888	sqlcmd.exe
1492	sqlcmd.exe
68	sqlcmd.exe
2972	sqlcmd.exe
2588	sqlcmd.exe
3292	sqlcmd.exe
2876	sqlcmd.exe
2068	sqlcmd.exe
3112	sqlcmd.exe
3120	sqlcmd.exe
3716	sqlcmd.exe
3288	sqlcmd.exe
3632	sqlcmd.exe
1236	sqlcmd.exe
772	sqlcmd.exe
3276	cutgdrc
2736	cutgdrc
1520	sqlcmd.exe
1788	sqlcmd.exe
3160	sqlcmd.exe
2688	sqlcmd.exe
516	sqlcmd.exe
2724	sqlcmd.exe
3972	sqlcmd.exe
180	sqlcmd.exe
2816	sqlcmd.exe
944	sqlcmd.exe
3572	sqlcmd.exe
1676	sqlcmd.exe
2244	sqlcmd.exe
1684	sqlcmd.exe
672	sqlcmd.exe
1272	sqlcmd.exe
940	sqlcmd.exe
3444	sqlcmd.exe
2336	sqlcmd.exe
1004	sqlcmd.exe
1368	cutgdrc
1260	cutgdrc
1976	sqlcmd.exe
1996	sqlcmd.exe
3264	sqlcmd.exe
3052	sqlcmd.exe
3672	sqlcmd.exe
3640	sqlcmd.exe
3324	sqlcmd.exe
3328	sqlcmd.exe
2616	sqlcmd.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A562.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A562.exe

Deletes itself 1 IoCs

pid	Process
1700	Process not Found

Loads dropped DLL 8 IoCs

pid	Process
424	toolspab2 (21).exe
2000	931E.exe
2000	931E.exe
2000	931E.exe
2000	931E.exe
2000	931E.exe
2736	cutgdrc
1260	cutgdrc

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral28/files/0x000200000001ab99-138.dat	themida
behavioral28/files/0x000200000001ab99-137.dat	themida
behavioral28/memory/1156-140-0x0000000000FC0000-0x0000000000FC1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	A562.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1156	A562.exe

Suspicious use of SetThreadContext 34 IoCs

description	pid	Process	procid_target
PID 4092 set thread context of 424	4092	toolspab2 (21).exe	77
PID 1920 set thread context of 3956	1920	NMN52vAqtg.exe	91
PID 196 set thread context of 3348	196	sqlcmd.exe	103
PID 772 set thread context of 4040	772	cutgdrc	106
PID 2388 set thread context of 3396	2388	sqlcmd.exe	108
PID 2264 set thread context of 1072	2264	sqlcmd.exe	110
PID 2220 set thread context of 3888	2220	sqlcmd.exe	112
PID 1492 set thread context of 68	1492	sqlcmd.exe	114
PID 2972 set thread context of 2588	2972	sqlcmd.exe	116
PID 3292 set thread context of 2876	3292	sqlcmd.exe	118
PID 2068 set thread context of 3112	2068	sqlcmd.exe	120
PID 3120 set thread context of 3716	3120	sqlcmd.exe	122
PID 3288 set thread context of 3632	3288	sqlcmd.exe	124
PID 1236 set thread context of 772	1236	sqlcmd.exe	126
PID 3276 set thread context of 2736	3276	cutgdrc	128
PID 1520 set thread context of 1788	1520	sqlcmd.exe	130
PID 3160 set thread context of 2688	3160	sqlcmd.exe	132
PID 516 set thread context of 2724	516	sqlcmd.exe	134
PID 3972 set thread context of 180	3972	sqlcmd.exe	136
PID 2816 set thread context of 944	2816	sqlcmd.exe	138
PID 3572 set thread context of 1676	3572	sqlcmd.exe	140
PID 2244 set thread context of 1684	2244	sqlcmd.exe	142
PID 672 set thread context of 1272	672	sqlcmd.exe	144
PID 940 set thread context of 3444	940	sqlcmd.exe	146
PID 2336 set thread context of 1004	2336	sqlcmd.exe	148
PID 1368 set thread context of 1260	1368	cutgdrc	150
PID 1976 set thread context of 1996	1976	sqlcmd.exe	152
PID 3264 set thread context of 3052	3264	sqlcmd.exe	154
PID 3672 set thread context of 3640	3672	sqlcmd.exe	156
PID 3324 set thread context of 3328	3324	sqlcmd.exe	158
PID 2616 set thread context of 3028	2616	sqlcmd.exe	160
PID 2504 set thread context of 3936	2504	sqlcmd.exe	162
PID 656 set thread context of 2908	656	sqlcmd.exe	164
PID 792 set thread context of 2068	792	sqlcmd.exe	166

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cutgdrc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cutgdrc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cutgdrc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (21).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cutgdrc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cutgdrc
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (21).exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (21).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cutgdrc

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2180	schtasks.exe
3920	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3880	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
424	toolspab2 (21).exe
424	toolspab2 (21).exe
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1700	Process not Found

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
424	toolspab2 (21).exe
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
1700	Process not Found
2736	cutgdrc
1260	cutgdrc

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeDebugPrivilege	1156	A562.exe
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found
Token: SeShutdownPrivilege	1700	Process not Found
Token: SeCreatePagefilePrivilege	1700	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1700	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 424	4092	toolspab2 (21).exe	77
PID 4092 wrote to memory of 424	4092	toolspab2 (21).exe	77
PID 4092 wrote to memory of 424	4092	toolspab2 (21).exe	77
PID 4092 wrote to memory of 424	4092	toolspab2 (21).exe	77
PID 4092 wrote to memory of 424	4092	toolspab2 (21).exe	77
PID 4092 wrote to memory of 424	4092	toolspab2 (21).exe	77
PID 1700 wrote to memory of 2000	1700	Process not Found	79
PID 1700 wrote to memory of 2000	1700	Process not Found	79
PID 1700 wrote to memory of 2000	1700	Process not Found	79
PID 1700 wrote to memory of 1524	1700	Process not Found	80
PID 1700 wrote to memory of 1524	1700	Process not Found	80
PID 1700 wrote to memory of 1524	1700	Process not Found	80
PID 1700 wrote to memory of 3560	1700	Process not Found	81
PID 1700 wrote to memory of 3560	1700	Process not Found	81
PID 1700 wrote to memory of 3560	1700	Process not Found	81
PID 1700 wrote to memory of 3140	1700	Process not Found	82
PID 1700 wrote to memory of 3140	1700	Process not Found	82
PID 1700 wrote to memory of 3140	1700	Process not Found	82
PID 1700 wrote to memory of 1156	1700	Process not Found	83
PID 1700 wrote to memory of 1156	1700	Process not Found	83
PID 1700 wrote to memory of 1156	1700	Process not Found	83
PID 1700 wrote to memory of 4024	1700	Process not Found	84
PID 1700 wrote to memory of 4024	1700	Process not Found	84
PID 1700 wrote to memory of 4024	1700	Process not Found	84
PID 1700 wrote to memory of 4024	1700	Process not Found	84
PID 1700 wrote to memory of 3628	1700	Process not Found	85
PID 1700 wrote to memory of 3628	1700	Process not Found	85
PID 1700 wrote to memory of 3628	1700	Process not Found	85
PID 1700 wrote to memory of 2620	1700	Process not Found	86
PID 1700 wrote to memory of 2620	1700	Process not Found	86
PID 1700 wrote to memory of 2620	1700	Process not Found	86
PID 1700 wrote to memory of 2620	1700	Process not Found	86
PID 1700 wrote to memory of 208	1700	Process not Found	87
PID 1700 wrote to memory of 208	1700	Process not Found	87
PID 1700 wrote to memory of 208	1700	Process not Found	87
PID 1700 wrote to memory of 3192	1700	Process not Found	88
PID 1700 wrote to memory of 3192	1700	Process not Found	88
PID 1700 wrote to memory of 3192	1700	Process not Found	88
PID 1700 wrote to memory of 3192	1700	Process not Found	88
PID 2000 wrote to memory of 1920	2000	931E.exe	89
PID 2000 wrote to memory of 1920	2000	931E.exe	89
PID 2000 wrote to memory of 1920	2000	931E.exe	89
PID 2000 wrote to memory of 1952	2000	931E.exe	90
PID 2000 wrote to memory of 1952	2000	931E.exe	90
PID 2000 wrote to memory of 1952	2000	931E.exe	90
PID 1920 wrote to memory of 3956	1920	NMN52vAqtg.exe	91
PID 1920 wrote to memory of 3956	1920	NMN52vAqtg.exe	91
PID 1920 wrote to memory of 3956	1920	NMN52vAqtg.exe	91
PID 1920 wrote to memory of 3956	1920	NMN52vAqtg.exe	91
PID 1920 wrote to memory of 3956	1920	NMN52vAqtg.exe	91
PID 3956 wrote to memory of 2180	3956	NMN52vAqtg.exe	93
PID 3956 wrote to memory of 2180	3956	NMN52vAqtg.exe	93
PID 3956 wrote to memory of 2180	3956	NMN52vAqtg.exe	93
PID 1952 wrote to memory of 3880	1952	cmd.exe	95
PID 1952 wrote to memory of 3880	1952	cmd.exe	95
PID 1952 wrote to memory of 3880	1952	cmd.exe	95
PID 1700 wrote to memory of 1328	1700	Process not Found	96
PID 1700 wrote to memory of 1328	1700	Process not Found	96
PID 1700 wrote to memory of 1328	1700	Process not Found	96
PID 1700 wrote to memory of 3176	1700	Process not Found	97
PID 1700 wrote to memory of 3176	1700	Process not Found	97
PID 1700 wrote to memory of 3176	1700	Process not Found	97
PID 1700 wrote to memory of 3176	1700	Process not Found	97
PID 1700 wrote to memory of 3132	1700	Process not Found	98

C:\Users\Admin\AppData\Local\Temp\toolspab2 (21).exe
"C:\Users\Admin\AppData\Local\Temp\toolspab2 (21).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\toolspab2 (21).exe
  "C:\Users\Admin\AppData\Local\Temp\toolspab2 (21).exe"
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:424

C:\Users\Admin\AppData\Local\Temp\931E.exe
C:\Users\Admin\AppData\Local\Temp\931E.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\NMN52vAqtg.exe
  "C:\Users\Admin\AppData\Local\Temp\NMN52vAqtg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\NMN52vAqtg.exe
    "C:\Users\Admin\AppData\Local\Temp\NMN52vAqtg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
      4⤵
      Creates scheduled task(s)
      PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\931E.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3880

C:\Users\Admin\AppData\Local\Temp\9522.exe
C:\Users\Admin\AppData\Local\Temp\9522.exe
1⤵
- Executes dropped EXE
PID:1524

C:\Users\Admin\AppData\Local\Temp\9AE0.exe
C:\Users\Admin\AppData\Local\Temp\9AE0.exe
1⤵
- Executes dropped EXE
PID:3560

C:\Users\Admin\AppData\Local\Temp\A021.exe
C:\Users\Admin\AppData\Local\Temp\A021.exe
1⤵
- Executes dropped EXE
PID:3140

C:\Users\Admin\AppData\Local\Temp\A562.exe
C:\Users\Admin\AppData\Local\Temp\A562.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4024

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3628

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2620

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:208

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3192

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1328

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3176

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3132

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1572

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:196
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3920

C:\Users\Admin\AppData\Roaming\cutgdrc
C:\Users\Admin\AppData\Roaming\cutgdrc
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:772
- C:\Users\Admin\AppData\Roaming\cutgdrc
  C:\Users\Admin\AppData\Roaming\cutgdrc
  2⤵
  - Executes dropped EXE
  PID:4040

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2388
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3396

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2264
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1072

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2220
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3888

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1492
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:68

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2972
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2588

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3292
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2876

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2068
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3112

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3120
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3716

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3288
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3632

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1236
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:772

C:\Users\Admin\AppData\Roaming\cutgdrc
C:\Users\Admin\AppData\Roaming\cutgdrc
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3276
- C:\Users\Admin\AppData\Roaming\cutgdrc
  C:\Users\Admin\AppData\Roaming\cutgdrc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2736

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1520
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1788

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3160
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2688

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:516
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2724

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3972
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:180

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2816
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:944

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3572
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1676

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2244
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1684

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:672
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1272

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:940
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3444

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2336
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1004

C:\Users\Admin\AppData\Roaming\cutgdrc
C:\Users\Admin\AppData\Roaming\cutgdrc
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1368
- C:\Users\Admin\AppData\Roaming\cutgdrc
  C:\Users\Admin\AppData\Roaming\cutgdrc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1260

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1976
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1996

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3264
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3052

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3672
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3640

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3324
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3328

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2616
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3028

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:2504
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3936

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:656
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:2908

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:792
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:2068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-165-0x0000000000590000-0x000000000059F000-memory.dmp

Filesize
60KB

Download
memory/208-164-0x00000000005A0000-0x00000000005A9000-memory.dmp

Filesize
36KB

Download
memory/424-114-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1156-189-0x0000000008070000-0x0000000008071000-memory.dmp

Filesize
4KB

Download
memory/1156-160-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/1156-190-0x0000000008770000-0x0000000008771000-memory.dmp

Filesize
4KB

Download
memory/1156-154-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/1156-142-0x00000000059A0000-0x00000000059A1000-memory.dmp

Filesize
4KB

Download
memory/1156-153-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/1156-143-0x00000000064B0000-0x00000000064B1000-memory.dmp

Filesize
4KB

Download
memory/1156-146-0x0000000001560000-0x0000000001561000-memory.dmp

Filesize
4KB

Download
memory/1156-148-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/1156-144-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/1156-140-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/1156-191-0x0000000008240000-0x0000000008241000-memory.dmp

Filesize
4KB

Download
memory/1156-151-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1328-180-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/1328-181-0x00000000005D0000-0x00000000005DC000-memory.dmp

Filesize
48KB

Download
memory/1368-290-0x0000000000460000-0x000000000050E000-memory.dmp

Filesize
696KB

Download
memory/1524-131-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1524-130-0x0000000000750000-0x00000000007E1000-memory.dmp

Filesize
580KB

Download
memory/1572-192-0x0000000000600000-0x0000000000605000-memory.dmp

Filesize
20KB

Download
memory/1572-193-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/1700-291-0x0000000000FD0000-0x0000000000FE7000-memory.dmp

Filesize
92KB

Download
memory/1700-252-0x0000000000F70000-0x0000000000F87000-memory.dmp

Filesize
92KB

Download
memory/1700-118-0x0000000000F30000-0x0000000000F47000-memory.dmp

Filesize
92KB

Download
memory/2000-129-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2000-128-0x00000000021D0000-0x0000000002261000-memory.dmp

Filesize
580KB

Download
memory/2620-162-0x0000000000E20000-0x0000000000E2B000-memory.dmp

Filesize
44KB

Download
memory/2620-161-0x0000000000E30000-0x0000000000E37000-memory.dmp

Filesize
28KB

Download
memory/3132-187-0x0000000000BE0000-0x0000000000BE9000-memory.dmp

Filesize
36KB

Download
memory/3132-186-0x0000000000BF0000-0x0000000000BF5000-memory.dmp

Filesize
20KB

Download
memory/3176-184-0x00000000010E0000-0x00000000010E9000-memory.dmp

Filesize
36KB

Download
memory/3176-183-0x00000000010F0000-0x00000000010F4000-memory.dmp

Filesize
16KB

Download
memory/3192-167-0x0000000000B10000-0x0000000000B15000-memory.dmp

Filesize
20KB

Download
memory/3192-168-0x0000000000B00000-0x0000000000B09000-memory.dmp

Filesize
36KB

Download
memory/3276-251-0x0000000000460000-0x000000000050E000-memory.dmp

Filesize
696KB

Download
memory/3628-149-0x0000000000D90000-0x0000000000D97000-memory.dmp

Filesize
28KB

Download
memory/3628-152-0x0000000000D80000-0x0000000000D8C000-memory.dmp

Filesize
48KB

Download
memory/3956-179-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3956-173-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4024-147-0x00000000010A0000-0x0000000001114000-memory.dmp

Filesize
464KB

Download
memory/4024-150-0x0000000001030000-0x000000000109B000-memory.dmp

Filesize
428KB

Download
memory/4092-117-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download