redline | 2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

Target

8 (23).exe
Size

3.0MB
MD5

bb072cad921aa5ce8b97706ce01bc570
SHA1

18bf034906c1341b7817e7361ad27a4425d820bd
SHA256

817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
SHA512

d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Score

10^/10

redline socelars vidar 933 ww aspackv2 evasion infostealer persistence stealer suricata trojan upx

Malware Config

Extracted

Family

vidar

Version

39.6

Botnet

933

https://sslamlssa1.tumblr.com/

Attributes

profile_id
933

Extracted

Family

redline

Botnet

193.56.146.60:51431

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral31/memory/2072-239-0x00000000003E0000-0x00000000003FB000-memory.dmp	family_redline
behavioral31/memory/2072-245-0x0000000004920000-0x000000000493A000-memory.dmp	family_redline
behavioral31/memory/2360-267-0x0000000000418E5E-mapping.dmp	family_redline
behavioral31/memory/2280-277-0x0000000000418E3E-mapping.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 1 IoCs

resource	yara_rule
behavioral31/files/0x0003000000013153-172.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata

Nirsoft 1 IoCs

resource	yara_rule
behavioral31/memory/2696-223-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral31/memory/1628-145-0x0000000000D30000-0x0000000000DCD000-memory.dmp	family_vidar
behavioral31/memory/1628-152-0x0000000000400000-0x00000000008F2000-memory.dmp	family_vidar
behavioral31/memory/2664-257-0x000000000046B77D-mapping.dmp	family_vidar

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral31/files/0x0003000000013132-69.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-71.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-70.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-73.dat	aspack_v212_v242
behavioral31/files/0x000300000001312e-76.dat	aspack_v212_v242
behavioral31/files/0x000300000001312d-79.dat	aspack_v212_v242
behavioral31/files/0x000300000001312d-78.dat	aspack_v212_v242
behavioral31/files/0x000300000001312e-77.dat	aspack_v212_v242
behavioral31/files/0x0003000000013130-82.dat	aspack_v212_v242
behavioral31/files/0x0003000000013130-83.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-85.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-86.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-88.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-87.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-157.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-156.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-155.dat	aspack_v212_v242
behavioral31/files/0x0003000000013132-163.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
1940	setup_installer.exe
1060	setup_install.exe
1520	sonia_2.exe
1700	sonia_4.exe
1628	sonia_3.exe
976	sonia_5.exe
1548	sonia_6.exe
1256	jfiag3g_gg.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral31/files/0x0003000000013135-159.dat	upx
behavioral31/files/0x0003000000013135-158.dat	upx
behavioral31/files/0x0003000000013135-161.dat	upx
behavioral31/files/0x0003000000013135-165.dat	upx
behavioral31/files/0x0003000000013135-166.dat	upx
behavioral31/files/0x0003000000013135-164.dat	upx

Loads dropped DLL 36 IoCs

pid	Process
1036	8 (23).exe
1940	setup_installer.exe
1940	setup_installer.exe
1940	setup_installer.exe
1940	setup_installer.exe
1940	setup_installer.exe
1940	setup_installer.exe
1060	setup_install.exe
1060	setup_install.exe
1060	setup_install.exe
1060	setup_install.exe
1060	setup_install.exe
1060	setup_install.exe
1060	setup_install.exe
1060	setup_install.exe
1532	cmd.exe
1532	cmd.exe
1584	cmd.exe
1584	cmd.exe
1800	cmd.exe
1008	cmd.exe
1628	sonia_3.exe
1628	sonia_3.exe
976	sonia_5.exe
976	sonia_5.exe
1576	cmd.exe
1548	sonia_6.exe
1548	sonia_6.exe
364	WerFault.exe
364	WerFault.exe
364	WerFault.exe
1548	sonia_6.exe
1548	sonia_6.exe
364	WerFault.exe
1256	jfiag3g_gg.exe
1256	jfiag3g_gg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sonia_6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
4	ipinfo.io
10	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
364	1060	WerFault.exe	27
2312	1628	WerFault.exe	38
2068	2664	WerFault.exe	84

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
868	ipconfig.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2936	taskkill.exe
2992	taskkill.exe
2928	taskkill.exe
2952	taskkill.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	sonia_3.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
364	WerFault.exe
364	WerFault.exe
364	WerFault.exe
364	WerFault.exe
364	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	sonia_4.exe
Token: SeDebugPrivilege	364	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1940	1036	8 (23).exe	26
PID 1036 wrote to memory of 1940	1036	8 (23).exe	26
PID 1036 wrote to memory of 1940	1036	8 (23).exe	26
PID 1036 wrote to memory of 1940	1036	8 (23).exe	26
PID 1036 wrote to memory of 1940	1036	8 (23).exe	26
PID 1036 wrote to memory of 1940	1036	8 (23).exe	26
PID 1036 wrote to memory of 1940	1036	8 (23).exe	26
PID 1940 wrote to memory of 1060	1940	setup_installer.exe	27
PID 1940 wrote to memory of 1060	1940	setup_installer.exe	27
PID 1940 wrote to memory of 1060	1940	setup_installer.exe	27
PID 1940 wrote to memory of 1060	1940	setup_installer.exe	27
PID 1940 wrote to memory of 1060	1940	setup_installer.exe	27
PID 1940 wrote to memory of 1060	1940	setup_installer.exe	27
PID 1940 wrote to memory of 1060	1940	setup_installer.exe	27
PID 1060 wrote to memory of 1672	1060	setup_install.exe	29
PID 1060 wrote to memory of 1672	1060	setup_install.exe	29
PID 1060 wrote to memory of 1672	1060	setup_install.exe	29
PID 1060 wrote to memory of 1672	1060	setup_install.exe	29
PID 1060 wrote to memory of 1672	1060	setup_install.exe	29
PID 1060 wrote to memory of 1672	1060	setup_install.exe	29
PID 1060 wrote to memory of 1672	1060	setup_install.exe	29
PID 1060 wrote to memory of 1532	1060	setup_install.exe	30
PID 1060 wrote to memory of 1532	1060	setup_install.exe	30
PID 1060 wrote to memory of 1532	1060	setup_install.exe	30
PID 1060 wrote to memory of 1532	1060	setup_install.exe	30
PID 1060 wrote to memory of 1532	1060	setup_install.exe	30
PID 1060 wrote to memory of 1532	1060	setup_install.exe	30
PID 1060 wrote to memory of 1532	1060	setup_install.exe	30
PID 1060 wrote to memory of 1584	1060	setup_install.exe	31
PID 1060 wrote to memory of 1584	1060	setup_install.exe	31
PID 1060 wrote to memory of 1584	1060	setup_install.exe	31
PID 1060 wrote to memory of 1584	1060	setup_install.exe	31
PID 1060 wrote to memory of 1584	1060	setup_install.exe	31
PID 1060 wrote to memory of 1584	1060	setup_install.exe	31
PID 1060 wrote to memory of 1584	1060	setup_install.exe	31
PID 1060 wrote to memory of 1800	1060	setup_install.exe	41
PID 1060 wrote to memory of 1800	1060	setup_install.exe	41
PID 1060 wrote to memory of 1800	1060	setup_install.exe	41
PID 1060 wrote to memory of 1800	1060	setup_install.exe	41
PID 1060 wrote to memory of 1800	1060	setup_install.exe	41
PID 1060 wrote to memory of 1800	1060	setup_install.exe	41
PID 1060 wrote to memory of 1800	1060	setup_install.exe	41
PID 1532 wrote to memory of 1520	1532	cmd.exe	40
PID 1532 wrote to memory of 1520	1532	cmd.exe	40
PID 1532 wrote to memory of 1520	1532	cmd.exe	40
PID 1532 wrote to memory of 1520	1532	cmd.exe	40
PID 1532 wrote to memory of 1520	1532	cmd.exe	40
PID 1532 wrote to memory of 1520	1532	cmd.exe	40
PID 1532 wrote to memory of 1520	1532	cmd.exe	40
PID 1060 wrote to memory of 1008	1060	setup_install.exe	39
PID 1060 wrote to memory of 1008	1060	setup_install.exe	39
PID 1060 wrote to memory of 1008	1060	setup_install.exe	39
PID 1060 wrote to memory of 1008	1060	setup_install.exe	39
PID 1060 wrote to memory of 1008	1060	setup_install.exe	39
PID 1060 wrote to memory of 1008	1060	setup_install.exe	39
PID 1060 wrote to memory of 1008	1060	setup_install.exe	39
PID 1060 wrote to memory of 1576	1060	setup_install.exe	32
PID 1060 wrote to memory of 1576	1060	setup_install.exe	32
PID 1060 wrote to memory of 1576	1060	setup_install.exe	32
PID 1060 wrote to memory of 1576	1060	setup_install.exe	32
PID 1060 wrote to memory of 1576	1060	setup_install.exe	32
PID 1060 wrote to memory of 1576	1060	setup_install.exe	32
PID 1060 wrote to memory of 1576	1060	setup_install.exe	32
PID 1584 wrote to memory of 1628	1584	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\8 (23).exe
"C:\Users\Admin\AppData\Local\Temp\8 (23).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\AppData\Local\Temp\7zS497FF5A4\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS497FF5A4\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_1.exe
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_2.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\7zS497FF5A4\sonia_2.exe
        
        sonia_2.exe
        5⤵
        Executes dropped EXE
        
        PID:1520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_3.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\7zS497FF5A4\sonia_3.exe
        
        sonia_3.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:1628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 948
        6⤵
        Program crash
        
        PID:2312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_6.exe
      4⤵
      Loads dropped DLL
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\7zS497FF5A4\sonia_6.exe
        
        sonia_6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_7.exe
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 412
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_5.exe
      4⤵
      Loads dropped DLL
      PID:1008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_4.exe
      4⤵
      Loads dropped DLL
      PID:1800

C:\Users\Admin\AppData\Local\Temp\7zS497FF5A4\sonia_4.exe
sonia_4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Users\Admin\AppData\Local\Temp\7zS497FF5A4\sonia_5.exe
sonia_5.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976
- C:\Users\Admin\Documents\U13JP94r37s9cLitgMUOyfDc.exe
  "C:\Users\Admin\Documents\U13JP94r37s9cLitgMUOyfDc.exe"
  2⤵
  PID:1768
- C:\Users\Admin\Documents\3uIW6VBC0wQL3EkDBD34fbHk.exe
  "C:\Users\Admin\Documents\3uIW6VBC0wQL3EkDBD34fbHk.exe"
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c taskkill /f /im chrome.exe
    3⤵
    PID:2364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      PID:2928
- C:\Users\Admin\Documents\pv75k1bgoT1d4LEoifq0Dd36.exe
  "C:\Users\Admin\Documents\pv75k1bgoT1d4LEoifq0Dd36.exe"
  2⤵
  PID:2096
- C:\Users\Admin\Documents\Xr25hkqwuauQQzTWl0_8fWb4.exe
  "C:\Users\Admin\Documents\Xr25hkqwuauQQzTWl0_8fWb4.exe"
  2⤵
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\11111.exe
    C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\11111.exe
    C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\22222.exe
    C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\22222.exe
    C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:2308
- C:\Users\Admin\Documents\whRK36UiO42SygDIm1mbMsWB.exe
  "C:\Users\Admin\Documents\whRK36UiO42SygDIm1mbMsWB.exe"
  2⤵
  PID:2072
- C:\Users\Admin\Documents\7VUqHSQ9tVRb6IqiR3J3yuSd.exe
  "C:\Users\Admin\Documents\7VUqHSQ9tVRb6IqiR3J3yuSd.exe"
  2⤵
  PID:2120
- - C:\Users\Admin\Documents\7VUqHSQ9tVRb6IqiR3J3yuSd.exe
    C:\Users\Admin\Documents\7VUqHSQ9tVRb6IqiR3J3yuSd.exe
    3⤵
    PID:2328
- - C:\Users\Admin\Documents\7VUqHSQ9tVRb6IqiR3J3yuSd.exe
    C:\Users\Admin\Documents\7VUqHSQ9tVRb6IqiR3J3yuSd.exe
    3⤵
    PID:2280
- C:\Users\Admin\Documents\wy2bWVokxTRtI2g1aEANwuON.exe
  "C:\Users\Admin\Documents\wy2bWVokxTRtI2g1aEANwuON.exe"
  2⤵
  PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "wy2bWVokxTRtI2g1aEANwuON.exe" /f & erase "C:\Users\Admin\Documents\wy2bWVokxTRtI2g1aEANwuON.exe" & exit
    3⤵
    PID:2836
- C:\Users\Admin\Documents\L8XoK4bOSWCLFZ2p62LWJpyy.exe
  "C:\Users\Admin\Documents\L8XoK4bOSWCLFZ2p62LWJpyy.exe"
  2⤵
  PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "L8XoK4bOSWCLFZ2p62LWJpyy.exe" /f & erase "C:\Users\Admin\Documents\L8XoK4bOSWCLFZ2p62LWJpyy.exe" & exit
    3⤵
    PID:2916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "L8XoK4bOSWCLFZ2p62LWJpyy.exe" /f
      4⤵
      Kills process with taskkill
      PID:2992
- C:\Users\Admin\Documents\KadvCBCbRxcR7XUgoTXpgJpQ.exe
  "C:\Users\Admin\Documents\KadvCBCbRxcR7XUgoTXpgJpQ.exe"
  2⤵
  PID:2580
- C:\Users\Admin\Documents\cQrF7xTG9dqfOWks9VZZG6UE.exe
  "C:\Users\Admin\Documents\cQrF7xTG9dqfOWks9VZZG6UE.exe"
  2⤵
  PID:2548
- - C:\Users\Admin\Documents\cQrF7xTG9dqfOWks9VZZG6UE.exe
    "{path}"
    3⤵
    PID:2664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 1364
      4⤵
      Program crash
      PID:2068
- C:\Users\Admin\Documents\kmBMSQtTYnstIQUL8U3tMKhq.exe
  "C:\Users\Admin\Documents\kmBMSQtTYnstIQUL8U3tMKhq.exe"
  2⤵
  PID:2540
- C:\Users\Admin\Documents\HHylI1ioh68779pJOlutH9KC.exe
  "C:\Users\Admin\Documents\HHylI1ioh68779pJOlutH9KC.exe"
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im HHylI1ioh68779pJOlutH9KC.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\HHylI1ioh68779pJOlutH9KC.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:2832
- C:\Users\Admin\Documents\nu8RHTIaBIwhPXYCi48NcEhN.exe
  "C:\Users\Admin\Documents\nu8RHTIaBIwhPXYCi48NcEhN.exe"
  2⤵
  PID:2504
- - C:\Users\Admin\Documents\nu8RHTIaBIwhPXYCi48NcEhN.exe
    "{path}"
    3⤵
    PID:2360
- C:\Users\Admin\Documents\KZ7HdLu_AqXpWDVc43NcGYwo.exe
  "C:\Users\Admin\Documents\KZ7HdLu_AqXpWDVc43NcGYwo.exe"
  2⤵
  PID:2488
- - C:\Users\Admin\Documents\KZ7HdLu_AqXpWDVc43NcGYwo.exe
    "C:\Users\Admin\Documents\KZ7HdLu_AqXpWDVc43NcGYwo.exe"
    3⤵
    PID:2128
- C:\Users\Admin\Documents\MNEb8dEnp97f9xeSzjzYkuBf.exe
  "C:\Users\Admin\Documents\MNEb8dEnp97f9xeSzjzYkuBf.exe"
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c ipconfig /all
    3⤵
    PID:2184
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:868
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c wmic cpu get deviceid, name, numberofcores, maxclockspeed
    3⤵
    PID:2108
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic cpu get deviceid, name, numberofcores, maxclockspeed
      4⤵
      PID:756
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c wmic memorychip get BankLabel, DeviceLocator, MemoryType, TypeDetail, Capacity, Speed
    3⤵
    PID:2208
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic memorychip get BankLabel, DeviceLocator, MemoryType, TypeDetail, Capacity, Speed
      4⤵
      PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM chrome.exe
    3⤵
    PID:1132
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start chrome https://apps.extensionoutlet.net/clk/0842fa22-14da-4587-b1fe-3362054f3f99
    3⤵
    PID:2496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://apps.extensionoutlet.net/clk/0842fa22-14da-4587-b1fe-3362054f3f99
      4⤵
      PID:2620
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7feef614f50,0x7feef614f60,0x7feef614f70
        5⤵
        
        PID:2840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1064,18281652416836620793,10318993808090243297,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1076 /prefetch:2
        5⤵
        
        PID:920
    - - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
        5⤵
        
        PID:2108
      - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13f60a890,0x13f60a8a0,0x13f60a8b0
        6⤵
        
        PID:2348
- C:\Users\Admin\Documents\_W7AJfvQG773RNhi5MJ29oMY.exe
  "C:\Users\Admin\Documents\_W7AJfvQG773RNhi5MJ29oMY.exe"
  2⤵
  PID:2456
- C:\Users\Admin\Documents\R3G6Swx3x_iByB0BrtuOmg2m.exe
  "C:\Users\Admin\Documents\R3G6Swx3x_iByB0BrtuOmg2m.exe"
  2⤵
  PID:2852
- - C:\Users\Admin\Documents\R3G6Swx3x_iByB0BrtuOmg2m.exe
    "C:\Users\Admin\Documents\R3G6Swx3x_iByB0BrtuOmg2m.exe"
    3⤵
    PID:2096

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "wy2bWVokxTRtI2g1aEANwuON.exe" /f
1⤵
- Kills process with taskkill
PID:2936

C:\Users\Admin\AppData\Local\Temp\F844.exe
C:\Users\Admin\AppData\Local\Temp\F844.exe
1⤵
PID:1916

C:\Windows\system32\taskeng.exe
taskeng.exe {FD8832E8-5170-4AB4-808E-28084138D4B8} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:1500
- C:\Users\Admin\AppData\Roaming\gfeawci
  C:\Users\Admin\AppData\Roaming\gfeawci
  2⤵
  PID:3000
- C:\Users\Admin\AppData\Roaming\theawci
  C:\Users\Admin\AppData\Roaming\theawci
  2⤵
  PID:2040
- - C:\Users\Admin\AppData\Roaming\theawci
    C:\Users\Admin\AppData\Roaming\theawci
    3⤵
    PID:2740
- C:\Users\Admin\AppData\Roaming\gfeawci
  C:\Users\Admin\AppData\Roaming\gfeawci
  2⤵
  PID:2724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-167-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1036-60-0x0000000075051000-0x0000000075053000-memory.dmp

Filesize
8KB

Download
memory/1060-143-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1060-112-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1060-122-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1060-128-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1060-132-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1060-138-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1060-144-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1060-92-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1060-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1060-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1060-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1060-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1628-145-0x0000000000D30000-0x0000000000DCD000-memory.dmp

Filesize
628KB

Download
memory/1628-152-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/1700-141-0x000000001B2A0000-0x000000001B2A2000-memory.dmp

Filesize
8KB

Download
memory/1700-131-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/1768-191-0x00000000011C0000-0x00000000011C1000-memory.dmp

Filesize
4KB

Download
memory/2072-227-0x0000000000400000-0x0000000002C7C000-memory.dmp

Filesize
40.5MB

Download
memory/2072-239-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/2072-226-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2072-245-0x0000000004920000-0x000000000493A000-memory.dmp

Filesize
104KB

Download
memory/2088-213-0x0000000003080000-0x0000000003151000-memory.dmp

Filesize
836KB

Download
memory/2088-188-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Filesize
8KB

Download
memory/2088-209-0x0000000002140000-0x00000000021AF000-memory.dmp

Filesize
444KB

Download
memory/2096-186-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/2120-252-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2312-225-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2424-216-0x00000000003D0000-0x00000000003FE000-memory.dmp

Filesize
184KB

Download
memory/2424-224-0x0000000000400000-0x000000000325A000-memory.dmp

Filesize
46.4MB

Download
memory/2504-232-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/2504-218-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/2528-228-0x00000000008B0000-0x00000000008DF000-memory.dmp

Filesize
188KB

Download
memory/2528-229-0x0000000000400000-0x00000000008AA000-memory.dmp

Filesize
4.7MB

Download
memory/2548-219-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/2696-223-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download