redline | 2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

Target

8 (18).exe
Size

3.0MB
MD5

bb072cad921aa5ce8b97706ce01bc570
SHA1

18bf034906c1341b7817e7361ad27a4425d820bd
SHA256

817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
SHA512

d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Score

10^/10

redline smokeloader vidar 517 933 sewpalpadin aspackv2 backdoor discovery infostealer persistence ransomware spyware stealer suricata trojan upx

Malware Config

Extracted

Path

C:\_readme.txt

Ransom Note

ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-CnI3tI6Ktv Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0322gDrgoC4j04vLx6lqyFlyzpTC55w9igCGDgaBYLhUjv3Rr

Emails

[email protected]

URLs

https://we.tl/t-CnI3tI6Ktv

Extracted

Family

vidar

Version

39.6

Botnet

933

https://sslamlssa1.tumblr.com/

Attributes

profile_id
933

Extracted

Family

smokeloader

Version

2020

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Extracted

Family

vidar

Version

39.9

Botnet

517

https://prophefliloc.tumblr.com/

Attributes

profile_id
517

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral19/memory/1288-192-0x0000000002D70000-0x0000000002D8B000-memory.dmp	family_redline
behavioral19/memory/1288-196-0x0000000004760000-0x0000000004779000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata

Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral19/memory/1356-159-0x0000000002280000-0x000000000231D000-memory.dmp	family_vidar
behavioral19/memory/1356-160-0x0000000000400000-0x00000000008F2000-memory.dmp	family_vidar
behavioral19/memory/1668-203-0x000000000046B77D-mapping.dmp	family_vidar
behavioral19/memory/1668-202-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral19/memory/1676-206-0x00000000045B0000-0x000000000464E000-memory.dmp	family_vidar
behavioral19/memory/1668-207-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral19/files/0x000300000001314c-68.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-70.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-69.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-72.dat	aspack_v212_v242
behavioral19/files/0x000300000001314a-81.dat	aspack_v212_v242
behavioral19/files/0x0003000000013136-78.dat	aspack_v212_v242
behavioral19/files/0x0003000000013136-77.dat	aspack_v212_v242
behavioral19/files/0x0003000000013139-76.dat	aspack_v212_v242
behavioral19/files/0x0003000000013139-75.dat	aspack_v212_v242
behavioral19/files/0x000300000001314a-82.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-85.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-84.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-87.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-86.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-157.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-158.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-156.dat	aspack_v212_v242
behavioral19/files/0x000300000001314c-170.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 25 IoCs

pid	Process
684	setup_installer.exe
1696	setup_install.exe
1472	sonia_1.exe
1356	sonia_3.exe
1688	sonia_2.exe
1444	sonia_4.exe
1944	sonia_6.exe
1564	jfiag3g_gg.exe
1152	jfiag3g_gg.exe
1628	42CA.exe
1288	4E40.exe
1224	42CA.exe
776	42CA.exe
1636	42CA.exe
1676	DllHost.exe
1668	build2.exe
1584	build3.exe
852	build3.exe
1404	mstsca.exe
2196	mstsca.exe
2324	mstsca.exe
2340	mstsca.exe
2404	mstsca.exe
2420	mstsca.exe
2468	42CA.exe

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ConvertFromBackup.png => C:\Users\Admin\Pictures\ConvertFromBackup.png.nooa	42CA.exe
File renamed	C:\Users\Admin\Pictures\CopyInvoke.png => C:\Users\Admin\Pictures\CopyInvoke.png.nooa	42CA.exe
File renamed	C:\Users\Admin\Pictures\DebugExport.tif => C:\Users\Admin\Pictures\DebugExport.tif.nooa	42CA.exe
File renamed	C:\Users\Admin\Pictures\SaveUnlock.raw => C:\Users\Admin\Pictures\SaveUnlock.raw.nooa	42CA.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral19/files/0x0003000000013154-165.dat	upx
behavioral19/files/0x0003000000013154-169.dat	upx
behavioral19/files/0x0003000000013154-168.dat	upx
behavioral19/files/0x0003000000013154-167.dat	upx
behavioral19/files/0x0003000000013154-163.dat	upx
behavioral19/files/0x0003000000013154-162.dat	upx

Loads dropped DLL 61 IoCs

pid	Process
628	8 (18).exe
684	setup_installer.exe
684	setup_installer.exe
684	setup_installer.exe
684	setup_installer.exe
684	setup_installer.exe
684	setup_installer.exe
1696	setup_install.exe
1696	setup_install.exe
1696	setup_install.exe
1696	setup_install.exe
1696	setup_install.exe
1696	setup_install.exe
1696	setup_install.exe
1696	setup_install.exe
1956	cmd.exe
1956	cmd.exe
1052	cmd.exe
1052	cmd.exe
664	cmd.exe
664	cmd.exe
1824	cmd.exe
1356	sonia_3.exe
1356	sonia_3.exe
828	cmd.exe
1688	sonia_2.exe
1688	sonia_2.exe
1688	sonia_2.exe
1944	sonia_6.exe
1944	sonia_6.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1944	sonia_6.exe
1944	sonia_6.exe
1564	jfiag3g_gg.exe
1564	jfiag3g_gg.exe
1328	WerFault.exe
1944	sonia_6.exe
1944	sonia_6.exe
1152	jfiag3g_gg.exe
1152	jfiag3g_gg.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1628	42CA.exe
1224	42CA.exe
1224	42CA.exe
776	42CA.exe
1636	42CA.exe
1636	42CA.exe
1636	42CA.exe
1636	42CA.exe
1668	build2.exe
1668	build2.exe
1668	build2.exe
1668	build2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1236	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sonia_6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\80956fb5-625d-4970-85b6-70038e1932ee\\42CA.exe\" --AutoStart"	42CA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
79	api.2ip.ua
88	api.2ip.ua
154	api.2ip.ua
7	ip-api.com
77	api.2ip.ua

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 1224	1628	42CA.exe	52
PID 776 set thread context of 1636	776	42CA.exe	56
PID 1676 set thread context of 1668	1676	DllHost.exe	59
PID 1584 set thread context of 852	1584	build3.exe	61
PID 1404 set thread context of 2196	1404	mstsca.exe	72
PID 2324 set thread context of 2340	2324	mstsca.exe	76
PID 2404 set thread context of 2420	2404	mstsca.exe	78

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1328	1696	WerFault.exe	30
1896	1356	WerFault.exe	38

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1804	schtasks.exe
2276	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2176	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2116	taskkill.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	sonia_4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	sonia_4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	42CA.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	42CA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	sonia_4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1688	sonia_2.exe
1688	sonia_2.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1328	WerFault.exe
1200	Process not Found
1896	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1688	sonia_2.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	sonia_4.exe
Token: SeDebugPrivilege	1328	WerFault.exe
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeDebugPrivilege	1896	WerFault.exe
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeDebugPrivilege	1288	4E40.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeShutdownPrivilege	1200	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1200	Process not Found
1200	Process not Found

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1200	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 684	628	8 (18).exe	29
PID 628 wrote to memory of 684	628	8 (18).exe	29
PID 628 wrote to memory of 684	628	8 (18).exe	29
PID 628 wrote to memory of 684	628	8 (18).exe	29
PID 628 wrote to memory of 684	628	8 (18).exe	29
PID 628 wrote to memory of 684	628	8 (18).exe	29
PID 628 wrote to memory of 684	628	8 (18).exe	29
PID 684 wrote to memory of 1696	684	setup_installer.exe	30
PID 684 wrote to memory of 1696	684	setup_installer.exe	30
PID 684 wrote to memory of 1696	684	setup_installer.exe	30
PID 684 wrote to memory of 1696	684	setup_installer.exe	30
PID 684 wrote to memory of 1696	684	setup_installer.exe	30
PID 684 wrote to memory of 1696	684	setup_installer.exe	30
PID 684 wrote to memory of 1696	684	setup_installer.exe	30
PID 1696 wrote to memory of 1956	1696	setup_install.exe	32
PID 1696 wrote to memory of 1956	1696	setup_install.exe	32
PID 1696 wrote to memory of 1956	1696	setup_install.exe	32
PID 1696 wrote to memory of 1956	1696	setup_install.exe	32
PID 1696 wrote to memory of 1956	1696	setup_install.exe	32
PID 1696 wrote to memory of 1956	1696	setup_install.exe	32
PID 1696 wrote to memory of 1956	1696	setup_install.exe	32
PID 1696 wrote to memory of 664	1696	setup_install.exe	33
PID 1696 wrote to memory of 664	1696	setup_install.exe	33
PID 1696 wrote to memory of 664	1696	setup_install.exe	33
PID 1696 wrote to memory of 664	1696	setup_install.exe	33
PID 1696 wrote to memory of 664	1696	setup_install.exe	33
PID 1696 wrote to memory of 664	1696	setup_install.exe	33
PID 1696 wrote to memory of 664	1696	setup_install.exe	33
PID 1696 wrote to memory of 1052	1696	setup_install.exe	34
PID 1696 wrote to memory of 1052	1696	setup_install.exe	34
PID 1696 wrote to memory of 1052	1696	setup_install.exe	34
PID 1696 wrote to memory of 1052	1696	setup_install.exe	34
PID 1696 wrote to memory of 1052	1696	setup_install.exe	34
PID 1696 wrote to memory of 1052	1696	setup_install.exe	34
PID 1696 wrote to memory of 1052	1696	setup_install.exe	34
PID 1956 wrote to memory of 1472	1956	cmd.exe	35
PID 1956 wrote to memory of 1472	1956	cmd.exe	35
PID 1956 wrote to memory of 1472	1956	cmd.exe	35
PID 1956 wrote to memory of 1472	1956	cmd.exe	35
PID 1956 wrote to memory of 1472	1956	cmd.exe	35
PID 1956 wrote to memory of 1472	1956	cmd.exe	35
PID 1956 wrote to memory of 1472	1956	cmd.exe	35
PID 1696 wrote to memory of 1824	1696	setup_install.exe	36
PID 1696 wrote to memory of 1824	1696	setup_install.exe	36
PID 1696 wrote to memory of 1824	1696	setup_install.exe	36
PID 1696 wrote to memory of 1824	1696	setup_install.exe	36
PID 1696 wrote to memory of 1824	1696	setup_install.exe	36
PID 1696 wrote to memory of 1824	1696	setup_install.exe	36
PID 1696 wrote to memory of 1824	1696	setup_install.exe	36
PID 1696 wrote to memory of 1340	1696	setup_install.exe	37
PID 1696 wrote to memory of 1340	1696	setup_install.exe	37
PID 1696 wrote to memory of 1340	1696	setup_install.exe	37
PID 1696 wrote to memory of 1340	1696	setup_install.exe	37
PID 1696 wrote to memory of 1340	1696	setup_install.exe	37
PID 1696 wrote to memory of 1340	1696	setup_install.exe	37
PID 1696 wrote to memory of 1340	1696	setup_install.exe	37
PID 1052 wrote to memory of 1356	1052	cmd.exe	38
PID 1052 wrote to memory of 1356	1052	cmd.exe	38
PID 1052 wrote to memory of 1356	1052	cmd.exe	38
PID 1052 wrote to memory of 1356	1052	cmd.exe	38
PID 1052 wrote to memory of 1356	1052	cmd.exe	38
PID 1052 wrote to memory of 1356	1052	cmd.exe	38
PID 1052 wrote to memory of 1356	1052	cmd.exe	38
PID 664 wrote to memory of 1688	664	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\8 (18).exe
"C:\Users\Admin\AppData\Local\Temp\8 (18).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\7zSCA27F975\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCA27F975\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_1.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\7zSCA27F975\sonia_1.exe
        
        sonia_1.exe
        5⤵
        Executes dropped EXE
        
        PID:1472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_2.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:664
    - - C:\Users\Admin\AppData\Local\Temp\7zSCA27F975\sonia_2.exe
        
        sonia_2.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_3.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\7zSCA27F975\sonia_3.exe
        
        sonia_3.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1356
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 964
        6⤵
        Loads dropped DLL
        Program crash
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_4.exe
      4⤵
      Loads dropped DLL
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\7zSCA27F975\sonia_4.exe
        
        sonia_4.exe
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_5.exe
      4⤵
      PID:1340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_7.exe
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 412
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_6.exe
      4⤵
      Loads dropped DLL
      PID:828

C:\Users\Admin\AppData\Local\Temp\7zSCA27F975\sonia_6.exe
sonia_6.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1944
- C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1564
- C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  PID:600

C:\Users\Admin\AppData\Local\Temp\42CA.exe
C:\Users\Admin\AppData\Local\Temp\42CA.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1628
- C:\Users\Admin\AppData\Local\Temp\42CA.exe
  C:\Users\Admin\AppData\Local\Temp\42CA.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies system certificate store
  PID:1224
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\80956fb5-625d-4970-85b6-70038e1932ee" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\42CA.exe
    "C:\Users\Admin\AppData\Local\Temp\42CA.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:776
  - - C:\Users\Admin\AppData\Local\Temp\42CA.exe
      "C:\Users\Admin\AppData\Local\Temp\42CA.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Modifies extensions of user files
      Loads dropped DLL
      PID:1636
    - - C:\Users\Admin\AppData\Local\ca78118d-8986-43c9-9450-d4e647148a72\build2.exe
        
        "C:\Users\Admin\AppData\Local\ca78118d-8986-43c9-9450-d4e647148a72\build2.exe"
        5⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\ca78118d-8986-43c9-9450-d4e647148a72\build2.exe
        
        "C:\Users\Admin\AppData\Local\ca78118d-8986-43c9-9450-d4e647148a72\build2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\ca78118d-8986-43c9-9450-d4e647148a72\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\ca78118d-8986-43c9-9450-d4e647148a72\build3.exe
        
        "C:\Users\Admin\AppData\Local\ca78118d-8986-43c9-9450-d4e647148a72\build3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1584
      - C:\Users\Admin\AppData\Local\ca78118d-8986-43c9-9450-d4e647148a72\build3.exe
        
        "C:\Users\Admin\AppData\Local\ca78118d-8986-43c9-9450-d4e647148a72\build3.exe"
        6⤵
        Executes dropped EXE
        
        PID:852
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:1804

C:\Users\Admin\AppData\Local\Temp\4E40.exe
C:\Users\Admin\AppData\Local\Temp\4E40.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1676

C:\Windows\system32\taskeng.exe
taskeng.exe {D7E0CB9C-12EF-4C9A-B449-F6AEF756C495} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:1608
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:2196
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      4⤵
      Creates scheduled task(s)
      PID:2276
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2324
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:2340
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:2420
- C:\Users\Admin\AppData\Local\80956fb5-625d-4970-85b6-70038e1932ee\42CA.exe
  C:\Users\Admin\AppData\Local\80956fb5-625d-4970-85b6-70038e1932ee\42CA.exe --Task
  2⤵
  - Executes dropped EXE
  PID:2468
- - C:\Users\Admin\AppData\Local\80956fb5-625d-4970-85b6-70038e1932ee\42CA.exe
    C:\Users\Admin\AppData\Local\80956fb5-625d-4970-85b6-70038e1932ee\42CA.exe --Task
    3⤵
    PID:2572
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2560
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2588
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2836
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2880
- C:\Users\Admin\AppData\Roaming\erussdv
  C:\Users\Admin\AppData\Roaming\erussdv
  2⤵
  PID:2928
- C:\Users\Admin\AppData\Local\80956fb5-625d-4970-85b6-70038e1932ee\42CA.exe
  C:\Users\Admin\AppData\Local\80956fb5-625d-4970-85b6-70038e1932ee\42CA.exe --Task
  2⤵
  PID:3016
- - C:\Users\Admin\AppData\Local\80956fb5-625d-4970-85b6-70038e1932ee\42CA.exe
    C:\Users\Admin\AppData\Local\80956fb5-625d-4970-85b6-70038e1932ee\42CA.exe --Task
    3⤵
    PID:3052
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:3064
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2100
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:1128
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2164
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:1716
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2172
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2084
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:784
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:832
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:1280
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:1664
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2220
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2244
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:980
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:1720
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2280
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:1744
- C:\Users\Admin\AppData\Roaming\erussdv
  C:\Users\Admin\AppData\Roaming\erussdv
  2⤵
  PID:1588
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2348
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2380
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:340
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2188
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2484
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2372
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:1076
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2540
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2312
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:188
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2788
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2548
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2868
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:2856
- C:\Users\Admin\AppData\Roaming\erussdv
  C:\Users\Admin\AppData\Roaming\erussdv
  2⤵
  PID:2756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-59-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/852-208-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/852-213-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1200-288-0x0000000002BF0000-0x0000000002C05000-memory.dmp

Filesize
84KB

Download
memory/1200-161-0x0000000002A50000-0x0000000002A65000-memory.dmp

Filesize
84KB

Download
memory/1200-243-0x0000000002BD0000-0x0000000002BE5000-memory.dmp

Filesize
84KB

Download
memory/1224-184-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1224-187-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1288-200-0x0000000004944000-0x0000000004946000-memory.dmp

Filesize
8KB

Download
memory/1288-196-0x0000000004760000-0x0000000004779000-memory.dmp

Filesize
100KB

Download
memory/1288-194-0x0000000004943000-0x0000000004944000-memory.dmp

Filesize
4KB

Download
memory/1288-189-0x0000000000400000-0x0000000002C81000-memory.dmp

Filesize
40.5MB

Download
memory/1288-191-0x0000000004941000-0x0000000004942000-memory.dmp

Filesize
4KB

Download
memory/1288-193-0x0000000004942000-0x0000000004943000-memory.dmp

Filesize
4KB

Download
memory/1288-192-0x0000000002D70000-0x0000000002D8B000-memory.dmp

Filesize
108KB

Download
memory/1288-188-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/1328-171-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1356-160-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/1356-159-0x0000000002280000-0x000000000231D000-memory.dmp

Filesize
628KB

Download
memory/1444-148-0x0000000000410000-0x0000000000412000-memory.dmp

Filesize
8KB

Download
memory/1444-144-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/1584-209-0x00000000003B0000-0x00000000003B4000-memory.dmp

Filesize
16KB

Download
memory/1588-285-0x0000000000400000-0x0000000000896000-memory.dmp

Filesize
4.6MB

Download
memory/1628-183-0x0000000004620000-0x000000000473B000-memory.dmp

Filesize
1.1MB

Download
memory/1668-207-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1668-202-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1676-206-0x00000000045B0000-0x000000000464E000-memory.dmp

Filesize
632KB

Download
memory/1688-153-0x0000000000400000-0x0000000000896000-memory.dmp

Filesize
4.6MB

Download
memory/1688-152-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/1696-131-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1696-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1696-113-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1696-127-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1696-107-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1696-90-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1696-115-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1696-88-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1696-137-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1696-109-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1696-91-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1696-103-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1896-180-0x00000000003D0000-0x000000000042B000-memory.dmp

Filesize
364KB

Download
memory/2928-242-0x0000000000400000-0x0000000000896000-memory.dmp

Filesize
4.6MB

Download