Overview

overview

10

Static

static

D598B2C4DD...60.exe

windows7_x64

10

D598B2C4DD...60.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    165s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    16/07/2021, 12:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    D598B2C4DD0AA8294BA321D2A5545A60.exe
  • Size 3.3MB
  • Sample210716-r6pr2jvjp2
  • SHA256 245df5e6eb13e960dc2cd57d5ee69c8cee7bd93edc1733cfec479711dac7c777
  • MD5 SHA1 SHA512
Score
10/10
redlinesmokeloadersocelarsvidar903backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanvmprotect

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://conceitosseg.com/upload/

  • http://integrasidata.com/upload/

  • http://ozentekstil.com/upload/

  • http://finbelportal.com/upload/

  • http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

  • vidar

Version

  • 39.6

Botnet

  • 903

C2

  • https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    903

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • Downloads MZ/PE file
  • Executes dropped EXE 47 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • autoit_exe 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2760
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2688
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2672
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2408
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2400
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1944
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1412
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1332
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                  • Modifies registry class
                  PID:1240
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1108
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:412
                    • C:\Users\Admin\AppData\Roaming\cdrcstt
                      C:\Users\Admin\AppData\Roaming\cdrcstt
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks SCSI registry key(s)
                      • Suspicious behavior: MapViewOfSection
                      PID:1452
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
                      2⤵
                      • Executes dropped EXE
                      PID:4936
                      • C:\Windows\SysWOW64\schtasks.exe
                        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
                        3⤵
                        • Creates scheduled task(s)
                        PID:2180
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                    1⤵
                      PID:68
                    • C:\Users\Admin\AppData\Local\Temp\D598B2C4DD0AA8294BA321D2A5545A60.exe
                      "C:\Users\Admin\AppData\Local\Temp\D598B2C4DD0AA8294BA321D2A5545A60.exe"
                      1⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:3872
                      • C:\Users\Admin\AppData\Local\Temp\Files.exe
                        "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                        2⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Suspicious use of WriteProcessMemory
                        PID:2744
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:188
                      • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                        "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3344
                        • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                          "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
                          3⤵
                          • Executes dropped EXE
                          PID:4456
                      • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                        "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1956
                        • C:\Users\Admin\AppData\Roaming\4311395.exe
                          "C:\Users\Admin\AppData\Roaming\4311395.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4616
                        • C:\Users\Admin\AppData\Roaming\3168628.exe
                          "C:\Users\Admin\AppData\Roaming\3168628.exe"
                          3⤵
                            PID:4636
                            • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                              "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                              4⤵
                              • Executes dropped EXE
                              PID:744
                          • C:\Users\Admin\AppData\Roaming\2836865.exe
                            "C:\Users\Admin\AppData\Roaming\2836865.exe"
                            3⤵
                            • Executes dropped EXE
                            • Checks BIOS information in registry
                            • Checks whether UAC is enabled
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            PID:4832
                        • C:\Users\Admin\AppData\Local\Temp\Info.exe
                          "C:\Users\Admin\AppData\Local\Temp\Info.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious use of SetWindowsHookEx
                          PID:4124
                          • C:\Users\Admin\Documents\GSDQmpqlHmpWvgxx21TdAYLj.exe
                            "C:\Users\Admin\Documents\GSDQmpqlHmpWvgxx21TdAYLj.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:3944
                            • C:\Users\Admin\Documents\GSDQmpqlHmpWvgxx21TdAYLj.exe
                              C:\Users\Admin\Documents\GSDQmpqlHmpWvgxx21TdAYLj.exe
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks processor information in registry
                              • Suspicious use of SetWindowsHookEx
                              PID:3676
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c taskkill /im GSDQmpqlHmpWvgxx21TdAYLj.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\GSDQmpqlHmpWvgxx21TdAYLj.exe" & del C:\ProgramData\*.dll & exit
                                5⤵
                                  PID:4848
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /im GSDQmpqlHmpWvgxx21TdAYLj.exe /f
                                    6⤵
                                    • Kills process with taskkill
                                    PID:1908
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout /t 6
                                    6⤵
                                    • Delays execution with timeout.exe
                                    PID:1580
                            • C:\Users\Admin\Documents\qO7GcPh14Bqz6JKXJDR0eu7z.exe
                              "C:\Users\Admin\Documents\qO7GcPh14Bqz6JKXJDR0eu7z.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4916
                              • C:\Users\Admin\Documents\qO7GcPh14Bqz6JKXJDR0eu7z.exe
                                C:\Users\Admin\Documents\qO7GcPh14Bqz6JKXJDR0eu7z.exe
                                4⤵
                                • Executes dropped EXE
                                PID:4892
                            • C:\Users\Admin\Documents\2yNsNXmVfe7_3hJIkbr_rGvO.exe
                              "C:\Users\Admin\Documents\2yNsNXmVfe7_3hJIkbr_rGvO.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:3012
                              • C:\Users\Admin\Documents\2yNsNXmVfe7_3hJIkbr_rGvO.exe
                                C:\Users\Admin\Documents\2yNsNXmVfe7_3hJIkbr_rGvO.exe
                                4⤵
                                • Executes dropped EXE
                                PID:3808
                              • C:\Users\Admin\Documents\2yNsNXmVfe7_3hJIkbr_rGvO.exe
                                C:\Users\Admin\Documents\2yNsNXmVfe7_3hJIkbr_rGvO.exe
                                4⤵
                                • Executes dropped EXE
                                PID:4324
                            • C:\Users\Admin\Documents\4PBKRxQs3qNFiefycFcBCAI2.exe
                              "C:\Users\Admin\Documents\4PBKRxQs3qNFiefycFcBCAI2.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:2176
                              • C:\Users\Admin\Documents\4PBKRxQs3qNFiefycFcBCAI2.exe
                                C:\Users\Admin\Documents\4PBKRxQs3qNFiefycFcBCAI2.exe
                                4⤵
                                • Executes dropped EXE
                                PID:5064
                              • C:\Users\Admin\Documents\4PBKRxQs3qNFiefycFcBCAI2.exe
                                C:\Users\Admin\Documents\4PBKRxQs3qNFiefycFcBCAI2.exe
                                4⤵
                                • Executes dropped EXE
                                PID:2180
                            • C:\Users\Admin\Documents\JLskscBOemt0NyrOXMEuqtGK.exe
                              "C:\Users\Admin\Documents\JLskscBOemt0NyrOXMEuqtGK.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1584
                            • C:\Users\Admin\Documents\ldXImA2ZtJIs9M88gjUlwHBf.exe
                              "C:\Users\Admin\Documents\ldXImA2ZtJIs9M88gjUlwHBf.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2316
                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4596
                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4252
                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4940
                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:3772
                            • C:\Users\Admin\Documents\Gxl1QKdTeDqiQ0k_NJk0fKB0.exe
                              "C:\Users\Admin\Documents\Gxl1QKdTeDqiQ0k_NJk0fKB0.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2084
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c taskkill /f /im chrome.exe
                                4⤵
                                  PID:1908
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im chrome.exe
                                    5⤵
                                    • Kills process with taskkill
                                    PID:4796
                              • C:\Users\Admin\Documents\CHwR3NfIojFJ3XvHmR9hq8Ks.exe
                                "C:\Users\Admin\Documents\CHwR3NfIojFJ3XvHmR9hq8Ks.exe"
                                3⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:688
                              • C:\Users\Admin\Documents\gE_JxjS53MdcHOjfnpK45Zru.exe
                                "C:\Users\Admin\Documents\gE_JxjS53MdcHOjfnpK45Zru.exe"
                                3⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:188
                                • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                  "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2168
                                • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                  "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  PID:4036
                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:632
                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3880
                                • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                  "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2436
                                  • C:\Windows\SysWOW64\rUNdlL32.eXe
                                    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                    5⤵
                                    • Loads dropped DLL
                                    • Modifies registry class
                                    PID:4780
                                • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                  "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1020
                              • C:\Users\Admin\Documents\rtFSG8nhNX09r_FJxOInPASB.exe
                                "C:\Users\Admin\Documents\rtFSG8nhNX09r_FJxOInPASB.exe"
                                3⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:2540
                              • C:\Users\Admin\Documents\7TrkRT2e86KVaohYz8v6v_f3.exe
                                "C:\Users\Admin\Documents\7TrkRT2e86KVaohYz8v6v_f3.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:3900
                                • C:\Users\Admin\Documents\7TrkRT2e86KVaohYz8v6v_f3.exe
                                  "C:\Users\Admin\Documents\7TrkRT2e86KVaohYz8v6v_f3.exe" -a
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4308
                              • C:\Users\Admin\Documents\Pn6w4W2g_MiiItWQ6LZcaB38.exe
                                "C:\Users\Admin\Documents\Pn6w4W2g_MiiItWQ6LZcaB38.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4748
                                • C:\Users\Admin\Documents\Pn6w4W2g_MiiItWQ6LZcaB38.exe
                                  "C:\Users\Admin\Documents\Pn6w4W2g_MiiItWQ6LZcaB38.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  PID:2196
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 1236
                                    5⤵
                                    • Program crash
                                    PID:4560
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 860
                                  4⤵
                                  • Program crash
                                  PID:4612
                              • C:\Users\Admin\Documents\RaexcY316F2VeedN234vQdZU.exe
                                "C:\Users\Admin\Documents\RaexcY316F2VeedN234vQdZU.exe"
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetWindowsHookEx
                                PID:4776
                                • C:\Users\Admin\AppData\Local\Temp\ODwoy4FIHU.exe
                                  "C:\Users\Admin\AppData\Local\Temp\ODwoy4FIHU.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4656
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
                                    5⤵
                                    • Creates scheduled task(s)
                                    PID:748
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\RaexcY316F2VeedN234vQdZU.exe"
                                  4⤵
                                    PID:4148
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /T 10 /NOBREAK
                                      5⤵
                                      • Delays execution with timeout.exe
                                      PID:5004
                              • C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                "C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
                                2⤵
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                PID:4192
                              • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                2⤵
                                • Executes dropped EXE
                                • Modifies system certificate store
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:4236
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c taskkill /f /im chrome.exe
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2260
                                  • C:\Windows\System32\Conhost.exe
                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    4⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of WriteProcessMemory
                                    PID:4636
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im chrome.exe
                                    4⤵
                                    • Loads dropped DLL
                                    • Kills process with taskkill
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:4760
                              • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: MapViewOfSection
                                PID:4268
                            • \??\c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s BITS
                              1⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3652
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                2⤵
                                • Drops file in System32 directory
                                • Checks processor information in registry
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                PID:4956
                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                              1⤵
                              • Drops file in Windows directory
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetWindowsHookEx
                              PID:1272
                            • C:\Windows\system32\browser_broker.exe
                              C:\Windows\system32\browser_broker.exe -Embedding
                              1⤵
                              • Modifies Internet Explorer settings
                              PID:2540
                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                              1⤵
                              • Modifies registry class
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:4592
                            • C:\Windows\system32\rUNdlL32.eXe
                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                              1⤵
                              • Process spawned unexpected child process
                              • Suspicious use of WriteProcessMemory
                              PID:4728
                              • C:\Windows\SysWOW64\rundll32.exe
                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                2⤵
                                  PID:4760
                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                PID:4772
                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                1⤵
                                • Modifies registry class
                                PID:4984
                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                1⤵
                                • Modifies registry class
                                PID:4272
                              • C:\Windows\system32\rUNdlL32.eXe
                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                1⤵
                                • Process spawned unexpected child process
                                PID:4636
                                • C:\Windows\SysWOW64\rundll32.exe
                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                  2⤵
                                  • Loads dropped DLL
                                  PID:4616
                              • \??\c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                1⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                PID:4856

                              Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    memory/68-491-0x000001B8B2A90000-0x000001B8B2B00000-memory.dmp
                                    Download

                                    memory/68-186-0x000001B8B2440000-0x000001B8B24B1000-memory.dmp
                                    Download

                                    memory/412-235-0x0000023E837D0000-0x0000023E83841000-memory.dmp
                                    Download

                                    memory/688-433-0x0000000005A50000-0x0000000005A51000-memory.dmp
                                    Download

                                    memory/688-398-0x0000000077C50000-0x0000000077DDE000-memory.dmp
                                    Download

                                    memory/744-238-0x00000000058C0000-0x00000000058C1000-memory.dmp
                                    Download

                                    memory/744-227-0x0000000005F50000-0x0000000005F51000-memory.dmp
                                    Download

                                    memory/1108-215-0x000001C3CD930000-0x000001C3CD9A1000-memory.dmp
                                    Download

                                    memory/1108-476-0x000001C3CDE40000-0x000001C3CDEB1000-memory.dmp
                                    Download

                                    memory/1240-242-0x00000216E8060000-0x00000216E80D1000-memory.dmp
                                    Download

                                    memory/1240-492-0x00000216E85B0000-0x00000216E8621000-memory.dmp
                                    Download

                                    memory/1332-499-0x000002186E9C0000-0x000002186EA31000-memory.dmp
                                    Download

                                    memory/1332-243-0x000002186E600000-0x000002186E671000-memory.dmp
                                    Download

                                    memory/1412-236-0x0000026D4D870000-0x0000026D4D8E1000-memory.dmp
                                    Download

                                    memory/1412-486-0x0000026D4DE40000-0x0000026D4DEB1000-memory.dmp
                                    Download

                                    memory/1584-447-0x0000000002A52000-0x0000000002A53000-memory.dmp
                                    Download

                                    memory/1584-438-0x00000000009D0000-0x0000000000A7E000-memory.dmp
                                    Download

                                    memory/1584-440-0x0000000000400000-0x00000000009C4000-memory.dmp
                                    Download

                                    memory/1584-452-0x0000000002A53000-0x0000000002A54000-memory.dmp
                                    Download

                                    memory/1584-446-0x0000000002A50000-0x0000000002A51000-memory.dmp
                                    Download

                                    memory/1584-450-0x0000000002A54000-0x0000000002A56000-memory.dmp
                                    Download

                                    memory/1944-240-0x000002222E140000-0x000002222E1B1000-memory.dmp
                                    Download

                                    memory/1944-488-0x000002222E640000-0x000002222E6B1000-memory.dmp
                                    Download

                                    memory/1956-132-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
                                    Download

                                    memory/1956-142-0x00000000014F0000-0x00000000014F1000-memory.dmp
                                    Download

                                    memory/1956-150-0x000000001BAC0000-0x000000001BAC2000-memory.dmp
                                    Download

                                    memory/1956-146-0x0000000001520000-0x000000000153D000-memory.dmp
                                    Download

                                    memory/1956-147-0x0000000001500000-0x0000000001501000-memory.dmp
                                    Download

                                    memory/2168-422-0x00000000001F0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/2168-425-0x0000000000560000-0x00000000006AA000-memory.dmp
                                    Download

                                    memory/2316-442-0x000001FD6CE20000-0x000001FD6CE90000-memory.dmp
                                    Download

                                    memory/2316-444-0x000001FD6CF60000-0x000001FD6D031000-memory.dmp
                                    Download

                                    memory/2400-497-0x0000029201040000-0x00000292010B0000-memory.dmp
                                    Download

                                    memory/2400-194-0x00000292008D0000-0x0000029200941000-memory.dmp
                                    Download

                                    memory/2408-504-0x0000014B19DA0000-0x0000014B19E10000-memory.dmp
                                    Download

                                    memory/2408-207-0x0000014B19780000-0x0000014B197F1000-memory.dmp
                                    Download

                                    memory/2540-431-0x0000000002D70000-0x0000000002D71000-memory.dmp
                                    Download

                                    memory/2540-401-0x0000000077C50000-0x0000000077DDE000-memory.dmp
                                    Download

                                    memory/2672-244-0x000001A61FAD0000-0x000001A61FB41000-memory.dmp
                                    Download

                                    memory/2688-241-0x000001BF493D0000-0x000001BF49441000-memory.dmp
                                    Download

                                    memory/2760-487-0x0000024F949B0000-0x0000024F94A20000-memory.dmp
                                    Download

                                    memory/2760-208-0x0000024F94360000-0x0000024F943D1000-memory.dmp
                                    Download

                                    memory/3012-404-0x0000000004F40000-0x0000000004FB6000-memory.dmp
                                    Download

                                    memory/3016-265-0x0000000002B60000-0x0000000002B75000-memory.dmp
                                    Download

                                    memory/3652-483-0x0000018DD5380000-0x0000018DD53F0000-memory.dmp
                                    Download

                                    memory/3652-201-0x0000018DD50C0000-0x0000018DD5131000-memory.dmp
                                    Download

                                    memory/3652-482-0x0000018DD5140000-0x0000018DD518B000-memory.dmp
                                    Download

                                    memory/3652-501-0x0000018DD5050000-0x0000018DD509C000-memory.dmp
                                    Download

                                    memory/3652-193-0x0000018DD5000000-0x0000018DD504C000-memory.dmp
                                    Download

                                    memory/3676-430-0x0000000000400000-0x00000000004A1000-memory.dmp
                                    Download

                                    memory/3944-387-0x0000000005290000-0x0000000005291000-memory.dmp
                                    Download

                                    memory/4192-276-0x0000000003690000-0x00000000036F0000-memory.dmp
                                    Download

                                    memory/4192-253-0x00000000038E0000-0x00000000038F0000-memory.dmp
                                    Download

                                    memory/4192-246-0x0000000003690000-0x00000000036A0000-memory.dmp
                                    Download

                                    memory/4192-139-0x0000000000400000-0x0000000000651000-memory.dmp
                                    Download

                                    memory/4192-261-0x0000000004A70000-0x0000000004A78000-memory.dmp
                                    Download

                                    memory/4192-269-0x0000000004D10000-0x0000000004D18000-memory.dmp
                                    Download

                                    memory/4192-266-0x0000000004D10000-0x0000000004D18000-memory.dmp
                                    Download

                                    memory/4192-264-0x0000000006770000-0x0000000006778000-memory.dmp
                                    Download

                                    memory/4192-263-0x0000000004D10000-0x0000000004D18000-memory.dmp
                                    Download

                                    memory/4192-262-0x0000000004DB0000-0x0000000004DB8000-memory.dmp
                                    Download

                                    memory/4268-198-0x0000000000400000-0x0000000002BF5000-memory.dmp
                                    Download

                                    memory/4268-163-0x0000000000030000-0x0000000000039000-memory.dmp
                                    Download

                                    memory/4616-245-0x0000000008470000-0x0000000008471000-memory.dmp
                                    Download

                                    memory/4616-175-0x00000000054F0000-0x0000000005518000-memory.dmp
                                    Download

                                    memory/4616-494-0x00000000040A0000-0x00000000040FD000-memory.dmp
                                    Download

                                    memory/4616-475-0x000000000414C000-0x000000000424D000-memory.dmp
                                    Download

                                    memory/4616-157-0x0000000000D70000-0x0000000000D71000-memory.dmp
                                    Download

                                    memory/4616-205-0x00000000055F0000-0x00000000055F1000-memory.dmp
                                    Download

                                    memory/4636-165-0x00000000027F0000-0x00000000027F1000-memory.dmp
                                    Download

                                    memory/4636-159-0x0000000000640000-0x0000000000641000-memory.dmp
                                    Download

                                    memory/4636-169-0x0000000002730000-0x000000000273E000-memory.dmp
                                    Download

                                    memory/4636-178-0x0000000005040000-0x0000000005041000-memory.dmp
                                    Download

                                    memory/4636-181-0x00000000027C0000-0x00000000027C1000-memory.dmp
                                    Download

                                    memory/4636-172-0x00000000098C0000-0x00000000098C1000-memory.dmp
                                    Download

                                    memory/4760-188-0x00000000048E0000-0x000000000493D000-memory.dmp
                                    Download

                                    memory/4760-185-0x0000000004989000-0x0000000004A8A000-memory.dmp
                                    Download

                                    memory/4776-449-0x0000000002630000-0x00000000026C3000-memory.dmp
                                    Download

                                    memory/4776-451-0x0000000000400000-0x00000000009F3000-memory.dmp
                                    Download

                                    memory/4780-478-0x00000000047A8000-0x00000000048A9000-memory.dmp
                                    Download

                                    memory/4780-479-0x00000000048B0000-0x000000000490C000-memory.dmp
                                    Download

                                    memory/4832-217-0x0000000077C50000-0x0000000077DDE000-memory.dmp
                                    Download

                                    memory/4832-228-0x0000000005D30000-0x0000000005D31000-memory.dmp
                                    Download

                                    memory/4832-199-0x00000000059E0000-0x00000000059E1000-memory.dmp
                                    Download

                                    memory/4832-187-0x00000000000A0000-0x00000000000A1000-memory.dmp
                                    Download

                                    memory/4832-204-0x0000000005A40000-0x0000000005A41000-memory.dmp
                                    Download

                                    memory/4832-195-0x0000000005FD0000-0x0000000005FD1000-memory.dmp
                                    Download

                                    memory/4832-212-0x00000000059C0000-0x0000000005FC6000-memory.dmp
                                    Download

                                    memory/4832-214-0x0000000005A80000-0x0000000005A81000-memory.dmp
                                    Download

                                    memory/4892-473-0x0000000005110000-0x0000000005716000-memory.dmp
                                    Download

                                    memory/4916-427-0x0000000005340000-0x0000000005341000-memory.dmp
                                    Download

                                    memory/4956-210-0x000001C8E7B00000-0x000001C8E7B71000-memory.dmp
                                    Download

                                    memory/4956-345-0x000001C8E93C0000-0x000001C8E93DB000-memory.dmp
                                    Download

                                    memory/4956-346-0x000001C8EA300000-0x000001C8EA406000-memory.dmp
                                    Download