redline | 2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

Target

8 (22).exe
Size

3.0MB
MD5

bb072cad921aa5ce8b97706ce01bc570
SHA1

18bf034906c1341b7817e7361ad27a4425d820bd
SHA256

817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
SHA512

d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Score

10^/10

redline vidar 933 ww aspackv2 evasion infostealer persistence stealer suricata trojan upx vmprotect

Malware Config

Extracted

Family

vidar

Version

39.6

Botnet

933

https://sslamlssa1.tumblr.com/

Attributes

profile_id
933

Extracted

Family

redline

Botnet

193.56.146.60:51431

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	2380	rUNdlL32.eXe	86

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral29/memory/2104-234-0x00000000003C0000-0x00000000003DB000-memory.dmp	family_redline
behavioral29/memory/2104-239-0x0000000004840000-0x000000000485A000-memory.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata

Nirsoft 1 IoCs

resource	yara_rule
behavioral29/memory/2856-213-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral29/memory/1844-151-0x00000000002C0000-0x000000000035D000-memory.dmp	family_vidar
behavioral29/memory/1844-152-0x0000000000400000-0x00000000008F2000-memory.dmp	family_vidar
behavioral29/memory/1788-266-0x000000000046B77D-mapping.dmp	family_vidar

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral29/files/0x000300000001310a-69.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-70.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-71.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-73.dat	aspack_v212_v242
behavioral29/files/0x00030000000130f2-76.dat	aspack_v212_v242
behavioral29/files/0x00030000000130f2-77.dat	aspack_v212_v242
behavioral29/files/0x00030000000130ec-78.dat	aspack_v212_v242
behavioral29/files/0x00030000000130ec-79.dat	aspack_v212_v242
behavioral29/files/0x0003000000013106-83.dat	aspack_v212_v242
behavioral29/files/0x0003000000013106-82.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-87.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-86.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-85.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-88.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-156.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-157.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-155.dat	aspack_v212_v242
behavioral29/files/0x000300000001310a-158.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

pid	Process
1520	setup_installer.exe
1724	setup_install.exe
1016	sonia_1.exe
1968	sonia_4.exe
1844	sonia_3.exe
1700	sonia_5.exe
784	sonia_6.exe
552	jfiag3g_gg.exe
2104	PpooxAEF6jLMzEQlxD6hje7x.exe
2116	zjJy7TxltXrDQT_5w0DfmlV6.exe
2168	IYl3dcUHhmdN55tuht5n8OrJ.exe
2140	oAIx8dxZmokCbFCAcZruSCWC.exe
2152	gZ6aAGFevQ8CFeLNUC7oYtJ6.exe
2180	GD12KYXobUF7jcSNyiZCCAo7.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral29/files/0x000500000001311e-160.dat	upx
behavioral29/files/0x000500000001311e-162.dat	upx
behavioral29/files/0x000500000001311e-159.dat	upx
behavioral29/files/0x000500000001311e-167.dat	upx
behavioral29/files/0x000500000001311e-166.dat	upx
behavioral29/files/0x000500000001311e-165.dat	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral29/memory/1732-235-0x0000000000400000-0x000000000067D000-memory.dmp	vmprotect

Loads dropped DLL 51 IoCs

pid	Process
784	8 (22).exe
1520	setup_installer.exe
1520	setup_installer.exe
1520	setup_installer.exe
1520	setup_installer.exe
1520	setup_installer.exe
1520	setup_installer.exe
1724	setup_install.exe
1724	setup_install.exe
1724	setup_install.exe
1724	setup_install.exe
1724	setup_install.exe
1724	setup_install.exe
1724	setup_install.exe
1724	setup_install.exe
1584	cmd.exe
1584	cmd.exe
1344	cmd.exe
760	cmd.exe
760	cmd.exe
1512	cmd.exe
1840	cmd.exe
1844	sonia_3.exe
1844	sonia_3.exe
1700	sonia_5.exe
1700	sonia_5.exe
784	sonia_6.exe
784	sonia_6.exe
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe
784	sonia_6.exe
784	sonia_6.exe
552	jfiag3g_gg.exe
552	jfiag3g_gg.exe
1700	sonia_5.exe
1700	sonia_5.exe
1700	sonia_5.exe
1700	sonia_5.exe
1700	sonia_5.exe
1700	sonia_5.exe
1700	sonia_5.exe
1700	sonia_5.exe
1700	sonia_5.exe
2168	IYl3dcUHhmdN55tuht5n8OrJ.exe
2168	IYl3dcUHhmdN55tuht5n8OrJ.exe
2152	gZ6aAGFevQ8CFeLNUC7oYtJ6.exe
2152	gZ6aAGFevQ8CFeLNUC7oYtJ6.exe
2116	zjJy7TxltXrDQT_5w0DfmlV6.exe
2116	zjJy7TxltXrDQT_5w0DfmlV6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sonia_6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com
20	api.db-ip.com
21	api.db-ip.com
174	freegeoip.app
190	ipinfo.io
195	ipinfo.io
5	ipinfo.io
6	ipinfo.io
179	freegeoip.app
176	freegeoip.app
177	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1472	1724	WerFault.exe	28
2492	1844	WerFault.exe	36
1160	1732	WerFault.exe
2240	1300	WerFault.exe	99
2076	3892	WerFault.exe	155
3400	3588	WerFault.exe	150

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
3864	timeout.exe
3376	timeout.exe
3792	timeout.exe
3920	timeout.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
1552	taskkill.exe
768	taskkill.exe
752	taskkill.exe
2612	taskkill.exe
2872	taskkill.exe
3148	taskkill.exe
3172	taskkill.exe
2088	taskkill.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6712D17C-CEB6-4886-9641-427AF3D488B7}\ = "PotPlayerMini_Enqueue"	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56E1AC5-92D0-4b2a-A8B2-D3E164F540DD}\LocalServer32	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56E1AC5-92D0-4b2a-A8B2-D3E164F540DD}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\GD12KYXobUF7jcSNyiZCCAo7.exe"	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\CLSID	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FFE7772-0EE7-40f4-B7D6-3A44BCF0C42A}	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1DEBA2A8-DF1C-40a5-BED4-29F118F80771}	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7CAD4875-0AB6-4178-9E77-7EFB04692A19}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\GD12KYXobUF7jcSNyiZCCAo7.exe"	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2985A0EF-30E2-4b31-B3B8-8ABA20E3BF97}\LocalServer32	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2985A0EF-30E2-4b31-B3B8-8ABA20E3BF97}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\GD12KYXobUF7jcSNyiZCCAo7.exe"	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1DEBA2A8-DF1C-40a5-BED4-29F118F80771}\LocalServer32	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6712D17C-CEB6-4886-9641-427AF3D488B7}\LocalServer32	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FFE7772-0EE7-40f4-B7D6-3A44BCF0C42A}\ = "PotPlayerLive_Play"	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7CAD4875-0AB6-4178-9E77-7EFB04692A19}\ = "PotPlayerMini_Play"	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7CAD4875-0AB6-4178-9E77-7EFB04692A19}\LocalServer32	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1DEBA2A8-DF1C-40a5-BED4-29F118F80771}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\GD12KYXobUF7jcSNyiZCCAo7.exe"	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6712D17C-CEB6-4886-9641-427AF3D488B7}	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56E1AC5-92D0-4b2a-A8B2-D3E164F540DD}	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56E1AC5-92D0-4b2a-A8B2-D3E164F540DD}\ = "PotPlayerMCE_Enqueue"	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FFE7772-0EE7-40f4-B7D6-3A44BCF0C42A}\LocalServer32	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FFE7772-0EE7-40f4-B7D6-3A44BCF0C42A}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\GD12KYXobUF7jcSNyiZCCAo7.exe"	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2985A0EF-30E2-4b31-B3B8-8ABA20E3BF97}	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6712D17C-CEB6-4886-9641-427AF3D488B7}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\GD12KYXobUF7jcSNyiZCCAo7.exe"	GD12KYXobUF7jcSNyiZCCAo7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7CAD4875-0AB6-4178-9E77-7EFB04692A19}	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2985A0EF-30E2-4b31-B3B8-8ABA20E3BF97}\ = "PotPlayerMCE_Play"	GD12KYXobUF7jcSNyiZCCAo7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1DEBA2A8-DF1C-40a5-BED4-29F118F80771}\ = "PotPlayerLive_Enqueue"	GD12KYXobUF7jcSNyiZCCAo7.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	sonia_5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	sonia_5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	sonia_5.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	194	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	199	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	sonia_4.exe
Token: SeDebugPrivilege	1472	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1520	784	8 (22).exe	26
PID 784 wrote to memory of 1520	784	8 (22).exe	26
PID 784 wrote to memory of 1520	784	8 (22).exe	26
PID 784 wrote to memory of 1520	784	8 (22).exe	26
PID 784 wrote to memory of 1520	784	8 (22).exe	26
PID 784 wrote to memory of 1520	784	8 (22).exe	26
PID 784 wrote to memory of 1520	784	8 (22).exe	26
PID 1520 wrote to memory of 1724	1520	setup_installer.exe	28
PID 1520 wrote to memory of 1724	1520	setup_installer.exe	28
PID 1520 wrote to memory of 1724	1520	setup_installer.exe	28
PID 1520 wrote to memory of 1724	1520	setup_installer.exe	28
PID 1520 wrote to memory of 1724	1520	setup_installer.exe	28
PID 1520 wrote to memory of 1724	1520	setup_installer.exe	28
PID 1520 wrote to memory of 1724	1520	setup_installer.exe	28
PID 1724 wrote to memory of 1584	1724	setup_install.exe	43
PID 1724 wrote to memory of 1584	1724	setup_install.exe	43
PID 1724 wrote to memory of 1584	1724	setup_install.exe	43
PID 1724 wrote to memory of 1584	1724	setup_install.exe	43
PID 1724 wrote to memory of 1584	1724	setup_install.exe	43
PID 1724 wrote to memory of 1584	1724	setup_install.exe	43
PID 1724 wrote to memory of 1584	1724	setup_install.exe	43
PID 1724 wrote to memory of 568	1724	setup_install.exe	32
PID 1724 wrote to memory of 568	1724	setup_install.exe	32
PID 1724 wrote to memory of 568	1724	setup_install.exe	32
PID 1724 wrote to memory of 568	1724	setup_install.exe	32
PID 1724 wrote to memory of 568	1724	setup_install.exe	32
PID 1724 wrote to memory of 568	1724	setup_install.exe	32
PID 1724 wrote to memory of 568	1724	setup_install.exe	32
PID 1724 wrote to memory of 760	1724	setup_install.exe	33
PID 1724 wrote to memory of 760	1724	setup_install.exe	33
PID 1724 wrote to memory of 760	1724	setup_install.exe	33
PID 1724 wrote to memory of 760	1724	setup_install.exe	33
PID 1724 wrote to memory of 760	1724	setup_install.exe	33
PID 1724 wrote to memory of 760	1724	setup_install.exe	33
PID 1724 wrote to memory of 760	1724	setup_install.exe	33
PID 1724 wrote to memory of 1344	1724	setup_install.exe	34
PID 1724 wrote to memory of 1344	1724	setup_install.exe	34
PID 1724 wrote to memory of 1344	1724	setup_install.exe	34
PID 1724 wrote to memory of 1344	1724	setup_install.exe	34
PID 1724 wrote to memory of 1344	1724	setup_install.exe	34
PID 1724 wrote to memory of 1344	1724	setup_install.exe	34
PID 1724 wrote to memory of 1344	1724	setup_install.exe	34
PID 1724 wrote to memory of 1512	1724	setup_install.exe	42
PID 1724 wrote to memory of 1512	1724	setup_install.exe	42
PID 1724 wrote to memory of 1512	1724	setup_install.exe	42
PID 1724 wrote to memory of 1512	1724	setup_install.exe	42
PID 1724 wrote to memory of 1512	1724	setup_install.exe	42
PID 1724 wrote to memory of 1512	1724	setup_install.exe	42
PID 1724 wrote to memory of 1512	1724	setup_install.exe	42
PID 1584 wrote to memory of 1016	1584	cmd.exe	41
PID 1584 wrote to memory of 1016	1584	cmd.exe	41
PID 1584 wrote to memory of 1016	1584	cmd.exe	41
PID 1584 wrote to memory of 1016	1584	cmd.exe	41
PID 1584 wrote to memory of 1016	1584	cmd.exe	41
PID 1584 wrote to memory of 1016	1584	cmd.exe	41
PID 1584 wrote to memory of 1016	1584	cmd.exe	41
PID 1724 wrote to memory of 1840	1724	setup_install.exe	35
PID 1724 wrote to memory of 1840	1724	setup_install.exe	35
PID 1724 wrote to memory of 1840	1724	setup_install.exe	35
PID 1724 wrote to memory of 1840	1724	setup_install.exe	35
PID 1724 wrote to memory of 1840	1724	setup_install.exe	35
PID 1724 wrote to memory of 1840	1724	setup_install.exe	35
PID 1724 wrote to memory of 1840	1724	setup_install.exe	35
PID 1344 wrote to memory of 1968	1344	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\8 (22).exe
"C:\Users\Admin\AppData\Local\Temp\8 (22).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Users\Admin\AppData\Local\Temp\7zS0F5B2864\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0F5B2864\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_2.exe
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_3.exe
      4⤵
      Loads dropped DLL
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F5B2864\sonia_3.exe
        
        sonia_3.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 964
        6⤵
        Program crash
        
        PID:2492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_4.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F5B2864\sonia_4.exe
        
        sonia_4.exe
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_6.exe
      4⤵
      Loads dropped DLL
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F5B2864\sonia_6.exe
        
        sonia_6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies system certificate store
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:2248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_7.exe
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_5.exe
      4⤵
      Loads dropped DLL
      PID:1512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_1.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 412
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1472

C:\Users\Admin\AppData\Local\Temp\7zS0F5B2864\sonia_5.exe
sonia_5.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1700
- C:\Users\Admin\Documents\PpooxAEF6jLMzEQlxD6hje7x.exe
  "C:\Users\Admin\Documents\PpooxAEF6jLMzEQlxD6hje7x.exe"
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Users\Admin\Documents\oAIx8dxZmokCbFCAcZruSCWC.exe
  "C:\Users\Admin\Documents\oAIx8dxZmokCbFCAcZruSCWC.exe"
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Users\Admin\Documents\zjJy7TxltXrDQT_5w0DfmlV6.exe
  "C:\Users\Admin\Documents\zjJy7TxltXrDQT_5w0DfmlV6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2116
- - C:\Users\Admin\Documents\zjJy7TxltXrDQT_5w0DfmlV6.exe
    C:\Users\Admin\Documents\zjJy7TxltXrDQT_5w0DfmlV6.exe
    3⤵
    PID:1788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im zjJy7TxltXrDQT_5w0DfmlV6.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\zjJy7TxltXrDQT_5w0DfmlV6.exe" & del C:\ProgramData\*.dll & exit
      4⤵
      PID:2084
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im zjJy7TxltXrDQT_5w0DfmlV6.exe /f
        5⤵
        Kills process with taskkill
        
        PID:2872
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:3792
- C:\Users\Admin\Documents\gZ6aAGFevQ8CFeLNUC7oYtJ6.exe
  "C:\Users\Admin\Documents\gZ6aAGFevQ8CFeLNUC7oYtJ6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c taskkill /f /im chrome.exe
    3⤵
    PID:940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      PID:1552
- C:\Users\Admin\Documents\GD12KYXobUF7jcSNyiZCCAo7.exe
  "C:\Users\Admin\Documents\GD12KYXobUF7jcSNyiZCCAo7.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\11111.exe
    C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\11111.exe
    C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:2932
- - C:\Users\Admin\AppData\Local\Temp\22222.exe
    C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:316
- - C:\Users\Admin\AppData\Local\Temp\22222.exe
    C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:2932
- C:\Users\Admin\Documents\IYl3dcUHhmdN55tuht5n8OrJ.exe
  "C:\Users\Admin\Documents\IYl3dcUHhmdN55tuht5n8OrJ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4533445226.exe"
    3⤵
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\4533445226.exe
      "C:\Users\Admin\AppData\Local\Temp\4533445226.exe"
      4⤵
      PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "IYl3dcUHhmdN55tuht5n8OrJ.exe" /f & erase "C:\Users\Admin\Documents\IYl3dcUHhmdN55tuht5n8OrJ.exe" & exit
    3⤵
    PID:1684
- C:\Users\Admin\Documents\4JX1gAfRI7wxHLoicCCIYOOo.exe
  "C:\Users\Admin\Documents\4JX1gAfRI7wxHLoicCCIYOOo.exe"
  2⤵
  PID:2584
- - C:\Users\Admin\Documents\4JX1gAfRI7wxHLoicCCIYOOo.exe
    "{path}"
    3⤵
    PID:524
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im 4JX1gAfRI7wxHLoicCCIYOOo.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\4JX1gAfRI7wxHLoicCCIYOOo.exe" & del C:\ProgramData\*.dll & exit
      4⤵
      PID:3076
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:3920
- C:\Users\Admin\Documents\a7NvJs8A4ks5RLOtkEexE4Ip.exe
  "C:\Users\Admin\Documents\a7NvJs8A4ks5RLOtkEexE4Ip.exe"
  2⤵
  PID:2576
- C:\Users\Admin\Documents\YDkRjxHqx5gispVkWBsghWXv.exe
  "C:\Users\Admin\Documents\YDkRjxHqx5gispVkWBsghWXv.exe"
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "YDkRjxHqx5gispVkWBsghWXv.exe" /f & erase "C:\Users\Admin\Documents\YDkRjxHqx5gispVkWBsghWXv.exe" & exit
    3⤵
    PID:3004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "YDkRjxHqx5gispVkWBsghWXv.exe" /f
      4⤵
      Kills process with taskkill
      PID:2088
- C:\Users\Admin\Documents\GaqIn6PxoJPW8H89wGou7lxi.exe
  "C:\Users\Admin\Documents\GaqIn6PxoJPW8H89wGou7lxi.exe"
  2⤵
  PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im GaqIn6PxoJPW8H89wGou7lxi.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\GaqIn6PxoJPW8H89wGou7lxi.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:3020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im GaqIn6PxoJPW8H89wGou7lxi.exe /f
      4⤵
      Kills process with taskkill
      PID:2612
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:3376
- C:\Users\Admin\Documents\m6hgG_006blNY0D1lSrDa260.exe
  "C:\Users\Admin\Documents\m6hgG_006blNY0D1lSrDa260.exe"
  2⤵
  PID:2652
- C:\Users\Admin\Documents\s41bFcLCPXSxzPqG2OhkMADb.exe
  "C:\Users\Admin\Documents\s41bFcLCPXSxzPqG2OhkMADb.exe"
  2⤵
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:1420
  - - C:\Windows\SysWOW64\rundll32.exe
      rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
      4⤵
      PID:1756
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:2816
- C:\Users\Admin\Documents\U_2xtNHGGodH_ooFY5fChA6w.exe
  "C:\Users\Admin\Documents\U_2xtNHGGodH_ooFY5fChA6w.exe"
  2⤵
  PID:2544
- - C:\Program Files (x86)\Company\NewProduct\customer3.exe
    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
    3⤵
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:3412
- - C:\Program Files (x86)\Company\NewProduct\jooyu.exe
    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
    3⤵
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:3224
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    PID:1732
- C:\Users\Admin\Documents\wgfkgyY2WDwuvt3iScFULaEK.exe
  "C:\Users\Admin\Documents\wgfkgyY2WDwuvt3iScFULaEK.exe"
  2⤵
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\is-ADJT6.tmp\wgfkgyY2WDwuvt3iScFULaEK.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-ADJT6.tmp\wgfkgyY2WDwuvt3iScFULaEK.tmp" /SL5="$2017E,138429,56832,C:\Users\Admin\Documents\wgfkgyY2WDwuvt3iScFULaEK.exe"
    3⤵
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\is-F8GP2.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-F8GP2.tmp\Setup.exe" /Verysilent
      4⤵
      PID:1528
    - - C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:3268
    - - C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"
        5⤵
        
        PID:2408
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im GameBox64bit.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im GameBox64bit.exe /f
        7⤵
        Kills process with taskkill
        
        PID:3172
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:3864
    - - C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
        5⤵
        
        PID:1300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 276
        6⤵
        Program crash
        
        PID:2240
    - - C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"
        5⤵
        
        PID:2576
      - C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"
        6⤵
        
        PID:1464
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1GfWv7
        7⤵
        
        PID:3368
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3368 CREDAT:275457 /prefetch:2
        8⤵
        
        PID:3000
    - - C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Roaming\6460644.exe
        
        "C:\Users\Admin\AppData\Roaming\6460644.exe"
        6⤵
        
        PID:3588
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3588 -s 1740
        7⤵
        Program crash
        
        PID:3400
      - C:\Users\Admin\AppData\Roaming\4789561.exe
        
        "C:\Users\Admin\AppData\Roaming\4789561.exe"
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Roaming\6743333.exe
        
        "C:\Users\Admin\AppData\Roaming\6743333.exe"
        6⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 1488
        7⤵
        Program crash
        
        PID:2076
      - C:\Users\Admin\AppData\Roaming\4318019.exe
        
        "C:\Users\Admin\AppData\Roaming\4318019.exe"
        6⤵
        
        PID:3872
    - - C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"
        5⤵
        
        PID:2424
    - - C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe" /Silent
        5⤵
        
        PID:840
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:752

C:\Users\Admin\AppData\Local\Temp\7zS0F5B2864\sonia_1.exe
sonia_1.exe
1⤵
- Executes dropped EXE
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 276
1⤵
- Program crash
PID:1160

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "IYl3dcUHhmdN55tuht5n8OrJ.exe" /f
1⤵
- Kills process with taskkill
PID:768

C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a
1⤵
PID:2824

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
PID:900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:2
  2⤵
  PID:2932

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 4JX1gAfRI7wxHLoicCCIYOOo.exe /f
1⤵
- Kills process with taskkill
PID:3148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-60-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download
memory/1472-163-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/1724-104-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1724-105-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1724-102-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1724-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1724-94-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1724-93-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1724-108-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1724-92-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1724-113-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1724-95-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1724-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1724-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1732-235-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/1844-151-0x00000000002C0000-0x000000000035D000-memory.dmp

Filesize
628KB

Download
memory/1844-152-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/1968-130-0x0000000001120000-0x0000000001121000-memory.dmp

Filesize
4KB

Download
memory/1968-148-0x000000001B170000-0x000000001B172000-memory.dmp

Filesize
8KB

Download
memory/2104-239-0x0000000004840000-0x000000000485A000-memory.dmp

Filesize
104KB

Download
memory/2104-234-0x00000000003C0000-0x00000000003DB000-memory.dmp

Filesize
108KB

Download
memory/2116-188-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/2140-222-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download
memory/2180-183-0x000007FEFB891000-0x000007FEFB893000-memory.dmp

Filesize
8KB

Download
memory/2180-190-0x0000000003070000-0x00000000030DF000-memory.dmp

Filesize
444KB

Download
memory/2180-191-0x00000000030E0000-0x00000000031B1000-memory.dmp

Filesize
836KB

Download
memory/2584-214-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/2856-213-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2960-226-0x0000000000B10000-0x0000000000B4C000-memory.dmp

Filesize
240KB

Download