raccoon | 64dc2b5958fe37dd9733928c156e0c75ab544e2e0169f9f796c3f3db809bcbe5

Target

toolspab2 (12).exe
Size

315KB
MD5

1d20e1f65938e837ef1b88f10f1bd6c3
SHA1

703d7098dbfc476d2181b7fc041cc23e49c368f1
SHA256

05cd7440851f13dd8f489bb3c06eba385d85d7d9a77a612049c04c541a88593d
SHA512

f9d333abe1f721b8d45d7bc6b5f286af09a8d233bd1d41f0ad891840cf742364aeca2cb6ccd6543f56a8eaf32804f82f72f961d16d5ba663ad706d164915a196

Score

10^/10

raccoon redline smokeloader backdoor discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000200000001ab84-138.dat	family_redline
behavioral8/files/0x000200000001ab84-137.dat	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
2808	228C.exe
3352	24D0.exe
3856	2916.exe
2104	2DCA.exe
3748	3369.exe
3812	z8CciC01ck.exe
1668	z8CciC01ck.exe
4036	svgesfv
2676	svgesfv
2104	sqlcmd.exe
2076	sqlcmd.exe
1976	sqlcmd.exe
416	sqlcmd.exe
812	sqlcmd.exe
3404	sqlcmd.exe
3848	sqlcmd.exe
3916	sqlcmd.exe
3688	sqlcmd.exe
2360	sqlcmd.exe
4036	sqlcmd.exe
3640	sqlcmd.exe
3704	sqlcmd.exe
2900	sqlcmd.exe
4008	sqlcmd.exe
68	sqlcmd.exe
1116	sqlcmd.exe
1316	sqlcmd.exe
632	sqlcmd.exe
2088	sqlcmd.exe
4012	svgesfv
1952	svgesfv
1308	sqlcmd.exe
2772	sqlcmd.exe
896	sqlcmd.exe
848	sqlcmd.exe
1904	sqlcmd.exe
2504	sqlcmd.exe
3600	sqlcmd.exe
2684	sqlcmd.exe
1612	sqlcmd.exe
1900	sqlcmd.exe
812	sqlcmd.exe
3436	sqlcmd.exe
200	sqlcmd.exe
388	sqlcmd.exe
1132	sqlcmd.exe
700	sqlcmd.exe
1028	sqlcmd.exe
724	sqlcmd.exe
996	sqlcmd.exe
1268	sqlcmd.exe
1408	svgesfv
1748	svgesfv
2040	sqlcmd.exe
2352	sqlcmd.exe
3660	sqlcmd.exe
3232	sqlcmd.exe
2668	sqlcmd.exe
3776	sqlcmd.exe
3136	sqlcmd.exe
1336	sqlcmd.exe
2072	sqlcmd.exe
2732	sqlcmd.exe
2804	sqlcmd.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3369.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3369.exe

Deletes itself 1 IoCs

pid	Process
2824	Process not Found

Loads dropped DLL 8 IoCs

pid	Process
3760	toolspab2 (12).exe
2808	228C.exe
2808	228C.exe
2808	228C.exe
2808	228C.exe
2808	228C.exe
1952	svgesfv
1748	svgesfv

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral8/files/0x000200000001ab84-138.dat	themida
behavioral8/files/0x000200000001ab84-137.dat	themida
behavioral8/memory/3748-140-0x0000000000B50000-0x0000000000B51000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3369.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3748	3369.exe

Suspicious use of SetThreadContext 33 IoCs

description	pid	Process	procid_target
PID 3484 set thread context of 3760	3484	toolspab2 (12).exe	78
PID 3812 set thread context of 1668	3812	z8CciC01ck.exe	90
PID 4036 set thread context of 2676	4036	svgesfv	103
PID 2104 set thread context of 2076	2104	sqlcmd.exe	105
PID 1976 set thread context of 416	1976	sqlcmd.exe	109
PID 812 set thread context of 3404	812	sqlcmd.exe	111
PID 3848 set thread context of 3916	3848	sqlcmd.exe	113
PID 3688 set thread context of 2360	3688	sqlcmd.exe	115
PID 4036 set thread context of 3640	4036	sqlcmd.exe	117
PID 3704 set thread context of 2900	3704	sqlcmd.exe	119
PID 4008 set thread context of 68	4008	sqlcmd.exe	121
PID 1116 set thread context of 1316	1116	sqlcmd.exe	123
PID 632 set thread context of 2088	632	sqlcmd.exe	125
PID 4012 set thread context of 1952	4012	svgesfv	127
PID 1308 set thread context of 2772	1308	sqlcmd.exe	129
PID 896 set thread context of 848	896	sqlcmd.exe	131
PID 1904 set thread context of 2504	1904	sqlcmd.exe	133
PID 3600 set thread context of 2684	3600	sqlcmd.exe	135
PID 1612 set thread context of 1900	1612	sqlcmd.exe	137
PID 812 set thread context of 3436	812	sqlcmd.exe	139
PID 200 set thread context of 388	200	sqlcmd.exe	141
PID 1132 set thread context of 700	1132	sqlcmd.exe	143
PID 1028 set thread context of 724	1028	sqlcmd.exe	145
PID 996 set thread context of 1268	996	sqlcmd.exe	147
PID 1408 set thread context of 1748	1408	svgesfv	149
PID 2040 set thread context of 2352	2040	sqlcmd.exe	151
PID 3660 set thread context of 3232	3660	sqlcmd.exe	153
PID 2668 set thread context of 3776	2668	sqlcmd.exe	155
PID 3136 set thread context of 1336	3136	sqlcmd.exe	157
PID 2072 set thread context of 2732	2072	sqlcmd.exe	159
PID 2804 set thread context of 2208	2804	sqlcmd.exe	161
PID 4008 set thread context of 3868	4008	sqlcmd.exe	163
PID 1828 set thread context of 2332	1828	sqlcmd.exe	165

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svgesfv
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (12).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svgesfv
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svgesfv
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svgesfv
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svgesfv
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (12).exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (12).exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svgesfv

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2224	schtasks.exe
2176	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3360	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3760	toolspab2 (12).exe
3760	toolspab2 (12).exe
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	Process not Found

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
3760	toolspab2 (12).exe
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
1952	svgesfv
1748	svgesfv

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeDebugPrivilege	3748	3369.exe
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2824	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3760	3484	toolspab2 (12).exe	78
PID 3484 wrote to memory of 3760	3484	toolspab2 (12).exe	78
PID 3484 wrote to memory of 3760	3484	toolspab2 (12).exe	78
PID 3484 wrote to memory of 3760	3484	toolspab2 (12).exe	78
PID 3484 wrote to memory of 3760	3484	toolspab2 (12).exe	78
PID 3484 wrote to memory of 3760	3484	toolspab2 (12).exe	78
PID 2824 wrote to memory of 2808	2824	Process not Found	80
PID 2824 wrote to memory of 2808	2824	Process not Found	80
PID 2824 wrote to memory of 2808	2824	Process not Found	80
PID 2824 wrote to memory of 3352	2824	Process not Found	81
PID 2824 wrote to memory of 3352	2824	Process not Found	81
PID 2824 wrote to memory of 3352	2824	Process not Found	81
PID 2824 wrote to memory of 3856	2824	Process not Found	82
PID 2824 wrote to memory of 3856	2824	Process not Found	82
PID 2824 wrote to memory of 3856	2824	Process not Found	82
PID 2824 wrote to memory of 2104	2824	Process not Found	83
PID 2824 wrote to memory of 2104	2824	Process not Found	83
PID 2824 wrote to memory of 2104	2824	Process not Found	83
PID 2824 wrote to memory of 3748	2824	Process not Found	84
PID 2824 wrote to memory of 3748	2824	Process not Found	84
PID 2824 wrote to memory of 3748	2824	Process not Found	84
PID 2824 wrote to memory of 2468	2824	Process not Found	85
PID 2824 wrote to memory of 2468	2824	Process not Found	85
PID 2824 wrote to memory of 2468	2824	Process not Found	85
PID 2824 wrote to memory of 2468	2824	Process not Found	85
PID 2824 wrote to memory of 1952	2824	Process not Found	86
PID 2824 wrote to memory of 1952	2824	Process not Found	86
PID 2824 wrote to memory of 1952	2824	Process not Found	86
PID 2824 wrote to memory of 2244	2824	Process not Found	87
PID 2824 wrote to memory of 2244	2824	Process not Found	87
PID 2824 wrote to memory of 2244	2824	Process not Found	87
PID 2824 wrote to memory of 2244	2824	Process not Found	87
PID 2824 wrote to memory of 1420	2824	Process not Found	88
PID 2824 wrote to memory of 1420	2824	Process not Found	88
PID 2824 wrote to memory of 1420	2824	Process not Found	88
PID 2808 wrote to memory of 3812	2808	228C.exe	89
PID 2808 wrote to memory of 3812	2808	228C.exe	89
PID 2808 wrote to memory of 3812	2808	228C.exe	89
PID 2808 wrote to memory of 3980	2808	228C.exe	91
PID 2808 wrote to memory of 3980	2808	228C.exe	91
PID 2808 wrote to memory of 3980	2808	228C.exe	91
PID 3812 wrote to memory of 1668	3812	z8CciC01ck.exe	90
PID 3812 wrote to memory of 1668	3812	z8CciC01ck.exe	90
PID 3812 wrote to memory of 1668	3812	z8CciC01ck.exe	90
PID 3812 wrote to memory of 1668	3812	z8CciC01ck.exe	90
PID 3812 wrote to memory of 1668	3812	z8CciC01ck.exe	90
PID 1668 wrote to memory of 2224	1668	z8CciC01ck.exe	93
PID 1668 wrote to memory of 2224	1668	z8CciC01ck.exe	93
PID 1668 wrote to memory of 2224	1668	z8CciC01ck.exe	93
PID 3980 wrote to memory of 3360	3980	cmd.exe	95
PID 3980 wrote to memory of 3360	3980	cmd.exe	95
PID 3980 wrote to memory of 3360	3980	cmd.exe	95
PID 2824 wrote to memory of 3756	2824	Process not Found	97
PID 2824 wrote to memory of 3756	2824	Process not Found	97
PID 2824 wrote to memory of 3756	2824	Process not Found	97
PID 2824 wrote to memory of 3756	2824	Process not Found	97
PID 2824 wrote to memory of 3696	2824	Process not Found	98
PID 2824 wrote to memory of 3696	2824	Process not Found	98
PID 2824 wrote to memory of 3696	2824	Process not Found	98
PID 2824 wrote to memory of 2748	2824	Process not Found	99
PID 2824 wrote to memory of 2748	2824	Process not Found	99
PID 2824 wrote to memory of 2748	2824	Process not Found	99
PID 2824 wrote to memory of 2748	2824	Process not Found	99
PID 2824 wrote to memory of 2800	2824	Process not Found	100

C:\Users\Admin\AppData\Local\Temp\toolspab2 (12).exe
"C:\Users\Admin\AppData\Local\Temp\toolspab2 (12).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Local\Temp\toolspab2 (12).exe
  "C:\Users\Admin\AppData\Local\Temp\toolspab2 (12).exe"
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3760

C:\Users\Admin\AppData\Local\Temp\228C.exe
C:\Users\Admin\AppData\Local\Temp\228C.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\z8CciC01ck.exe
  "C:\Users\Admin\AppData\Local\Temp\z8CciC01ck.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Users\Admin\AppData\Local\Temp\z8CciC01ck.exe
    "C:\Users\Admin\AppData\Local\Temp\z8CciC01ck.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
      4⤵
      Creates scheduled task(s)
      PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\228C.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3360

C:\Users\Admin\AppData\Local\Temp\24D0.exe
C:\Users\Admin\AppData\Local\Temp\24D0.exe
1⤵
- Executes dropped EXE
PID:3352

C:\Users\Admin\AppData\Local\Temp\2916.exe
C:\Users\Admin\AppData\Local\Temp\2916.exe
1⤵
- Executes dropped EXE
PID:3856

C:\Users\Admin\AppData\Local\Temp\2DCA.exe
C:\Users\Admin\AppData\Local\Temp\2DCA.exe
1⤵
- Executes dropped EXE
PID:2104

C:\Users\Admin\AppData\Local\Temp\3369.exe
C:\Users\Admin\AppData\Local\Temp\3369.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2468

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1952

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2244

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1420

C:\Users\Admin\AppData\Roaming\svgesfv
C:\Users\Admin\AppData\Roaming\svgesfv
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4036
- C:\Users\Admin\AppData\Roaming\svgesfv
  C:\Users\Admin\AppData\Roaming\svgesfv
  2⤵
  - Executes dropped EXE
  PID:2676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3756

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3696

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2748

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2800

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:344

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2104
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2176

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1976
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:416

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:812
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3404

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3848
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3916

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3688
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2360

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4036
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3640

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3704
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2900

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4008
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:68

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1116
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1316

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:632
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2088

C:\Users\Admin\AppData\Roaming\svgesfv
C:\Users\Admin\AppData\Roaming\svgesfv
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4012
- C:\Users\Admin\AppData\Roaming\svgesfv
  C:\Users\Admin\AppData\Roaming\svgesfv
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1952

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1308
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2772

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:896
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:848

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1904
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2504

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3600
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2684

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1612
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1900

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:812
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3436

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:200
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:388

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1132
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:700

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1028
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:724

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:996
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1268

C:\Users\Admin\AppData\Roaming\svgesfv
C:\Users\Admin\AppData\Roaming\svgesfv
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1408
- C:\Users\Admin\AppData\Roaming\svgesfv
  C:\Users\Admin\AppData\Roaming\svgesfv
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1748

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2040
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2352

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3660
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3232

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2668
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3776

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3136
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1336

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2072
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2732

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2804
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:2208

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:4008
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3868

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:1828
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:2332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-195-0x00000000008F0000-0x00000000008F9000-memory.dmp

Filesize
36KB

Download
memory/344-194-0x0000000000900000-0x0000000000905000-memory.dmp

Filesize
20KB

Download
memory/1420-175-0x0000000000EE0000-0x0000000000EE9000-memory.dmp

Filesize
36KB

Download
memory/1420-176-0x0000000000ED0000-0x0000000000EDF000-memory.dmp

Filesize
60KB

Download
memory/1668-168-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1668-177-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1952-157-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Filesize
48KB

Download
memory/1952-156-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

Filesize
28KB

Download
memory/2244-162-0x0000000000430000-0x000000000043B000-memory.dmp

Filesize
44KB

Download
memory/2244-161-0x0000000000440000-0x0000000000447000-memory.dmp

Filesize
28KB

Download
memory/2468-143-0x0000000000690000-0x00000000006FB000-memory.dmp

Filesize
428KB

Download
memory/2468-141-0x0000000000700000-0x0000000000774000-memory.dmp

Filesize
464KB

Download
memory/2748-186-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/2748-185-0x00000000001E0000-0x00000000001E4000-memory.dmp

Filesize
16KB

Download
memory/2800-191-0x0000000000960000-0x0000000000969000-memory.dmp

Filesize
36KB

Download
memory/2800-190-0x0000000000970000-0x0000000000975000-memory.dmp

Filesize
20KB

Download
memory/2808-131-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2808-129-0x0000000002120000-0x00000000021B1000-memory.dmp

Filesize
580KB

Download
memory/2824-249-0x0000000000F70000-0x0000000000F87000-memory.dmp

Filesize
92KB

Download
memory/2824-118-0x0000000000F30000-0x0000000000F47000-memory.dmp

Filesize
92KB

Download
memory/2824-289-0x0000000000FA0000-0x0000000000FB7000-memory.dmp

Filesize
92KB

Download
memory/3352-133-0x0000000002120000-0x00000000021B1000-memory.dmp

Filesize
580KB

Download
memory/3352-134-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/3484-117-0x0000000000460000-0x000000000050E000-memory.dmp

Filesize
696KB

Download
memory/3696-183-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/3696-182-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download
memory/3748-158-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/3748-145-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/3748-189-0x0000000008680000-0x0000000008681000-memory.dmp

Filesize
4KB

Download
memory/3748-150-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/3748-151-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/3748-140-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/3748-147-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/3748-192-0x0000000008150000-0x0000000008151000-memory.dmp

Filesize
4KB

Download
memory/3748-144-0x0000000077360000-0x00000000774EE000-memory.dmp

Filesize
1.6MB

Download
memory/3748-146-0x00000000060E0000-0x00000000060E1000-memory.dmp

Filesize
4KB

Download
memory/3748-159-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/3748-188-0x0000000007F80000-0x0000000007F81000-memory.dmp

Filesize
4KB

Download
memory/3748-149-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/3756-179-0x00000000003A0000-0x00000000003A5000-memory.dmp

Filesize
20KB

Download
memory/3756-180-0x0000000000390000-0x0000000000399000-memory.dmp

Filesize
36KB

Download
memory/3760-114-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4012-248-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/4036-200-0x0000000000460000-0x000000000050E000-memory.dmp

Filesize
696KB

Download